Hacker News Reader

> Is this really a huge priority?

It is for people who rent out slices of a computer to a bunch of different people and promise that the script kiddie that lives on the same machine as you can't steal your members-only cat photos (e.g. cloud providers.)

Also anyone who runs JavaScript, since they work across processes.

Like yes hypothetically they could do that. But being an info sec person what I can tell you is much more likely is that 2 years ago a developer was having a bug that he fixed by downgrading the library that interacted with the database. It turned out there was a vulnerability in that version of the library allowing SQL injection, but now that is a core piece of business functionality and no cycles can be spared till "next sprint" which will never come because the company is still a scrappy startup that moves fast and break things. (Despite now having 100 developers and millions in revenue) then someone finds out and can exfiltrate your entire DB in about 20 minutes with automated tools.

Or what is more realistic is that they send an email to Sarah the the CEOs PA that says she needs to grant access to "John Smith" and she puts in her username and credentials in the corresponding link. Then those credentials are used to access GitHub (of course the secretary has GitHub access because one time the CEO wanted to look at something and couldn't so now he demands his secretary has full GitHub access) and then they find the root db username and password because after it was accidentally committed the intern decided just to delete it and put in a new commit because he didn't want to get in trouble. That attack took 10 minutes and an email.

My point being is if you are running something that is so secure it needs to be protected from this kind of hypothetical attack, while in that case you're probably already paying for a dedicated instance in the first place.

It's a matter of scale. If you or I individually have a moderately clever and determined local enemy, with access to an average garage toolbox and some commodity PC accessories, who is not afraid of legal consequences for stealing your information...it would take a lot less than $500 to get your information.

The difference, and the reason this exploit is a big deal, is that a huge swath of our economy and society is in The Cloud. There are extremely, extremely clever enemies who (like our local hypothetical) are unafraid of legal consequences, because they're protected by online anonymity and possibly thousands of miles of open ocean and countries without extradition treaties. But they're not determined in the slightest! If it takes 60 seconds or costs $0.06 to break your unique configuration it's not worth it to them.

It doesn't concern me that my coworker has a coffee cup in their desk drawer that contains sticky notes for some of their most important passwords. By the time there's a human being inside our building digging through desk drawers, we've pissed someone off far too much for that to be the weak link.

I am concerned that said coworker does not use the same password on their pizza delivery app as they do on our work accounts, because it's only a matter of time before the former suffers a leak of ten million plaintext password-email combos, and tries pointing automated ransomware at all of the associated domains.

RowHammer/RowPress are scarier than most other attacks, because they expose the fact that the memory chips do not behave as advertised, i.e. they do not keep the promise to return on reading the bits that have been written into them, even if their datasheet specifications are not violated.

Unlike any other attacks, the memory access patterns used by RowHammer/RowPress may happen when some program is run, without any intention, accidentally, and such an event would cause memory corruption.

Even if such access patterns are very unlikely, it would be an unreasonable burden for programmers to analyze all the programs, to be able to guarantee that such memory access patterns can never happen, especially taking into account that the actual access pattern can vary non-deterministically, due to out-of-order execution and interaction between concurrent threads.

The only acceptable solution is for the memory producers to improve their products so that their datasheets will correspond to their real behavior.

Thank you so much for that quote. I found the original article[1] from 2014 and it is perhaps the best computer security article I have ever read.

[1] https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Fantastic.

I half expected the article to be a single page telling the reader in a large font to never open PDF files linked to by random users on internet forums. It isn't that, but I wouldn't have been mad if it had been.

On one hand, I agree. On the other, we do have examples of nation states killing journalists and other people with the use of security bugs in applications. No one really knows when they're being targeted by nation state or when they fall into that category.... but when they do, they won't just being doing things to your email.

see: https://www.theguardian.com/world/2021/jul/18/nso-spyware-us...

Yes, I have the same feeling about the SPECTRE mitigations, for example. No one is going to be attacking my home Linux box with SPECTRE (has anyone ever been attacked with SPECTRE?), but by default they remove like 10+% CPU performance, just in case. I disabled the mitigations.

I think the threat there isn’t someone else attacking their VM to get to your machine - but that there was at least some proof of concept over JavaScript remotely.

But otherwise I agree.

There's also netspectre which remotely attacks a kernel with malformed network packets.

https://arxiv.org/abs/1807.10535

> but that there was at least some proof of concept over JavaScript remotely

Yeah, but that's exactly the rube goldberg kinda thing the quote in the OP is parodying. The threat is IF I come across a hostile page, AND I'm running a specific web browser with the right JS properties, AND I am also running the right security-critical software, AND the attacker can correctly guess the memory layout, AND the JS runs for long enough to pull enough bytes to actually be meaningful, AND the attacker can connect the meaningful secret with whatever purpose it's intended for, AND the attacker can pull my legit data out with all the false positives they're getting from running an un-targeted website, THEN they can maybe like log into my old AOL account or something.

It just isn't going to happen. There are usecases where SPECTRE is a meaningful attack (shared hosting being the obvious one), but a normal end-user machine? Nah. Certainly not likely enough to nuke 10% CPU perf on every machine by default.

> AND the attacker can correctly guess the memory layout

AMD has several unpatched vulnerabilities that leak the memory layout/page table mappings, effectively nullifying KASLR as well.

they can be mitigated by KPTI, but AMD ships that in a disabled state by default because of the performance implications (with ryzen's reliance on giant caches, flushing caches every time they make a syscall would be even more disastrous for them than for Intel, so they cheat and ship insecure-by-default).

The rest of that sentence is just an overwrought description of running a javascript segment in a web browser, there's nothing load-bearing there to prevent an attack.

For multi tenant environments like a provider running VMs, preventing speculative execution attacks is a priority; otherwise someone can literally see what another tenant is doing (and there are attack demos demonstrating it).

Furthermore, the entire concept of paging and virtual memory is built around the concept of not letting one process see what the other one is doing; the described attacks in the prime+probe/flush+reload attacks are quite practical and could let some JS on a website steal passwords (though the information leak rate is a little lower than what you generally get by outright stealing credential files using malware, though that tends to show up on EDRs, whereas speculative execution attacks just show up as memory access patterns with fewer cache hits than what’s expected.)

If we’re to say that you don’t need isolation, we could just drop paging and every process just have a view of every other process.

> the entire concept of paging and virtual memory is built around the concept of not letting one process see what the other one is doing... If we’re to say that you don’t need isolation, we could just drop paging and every process just have a view of every other process.

This seems to be moving goalposts. It's like saying curtains were built around the idea of not letting one person see inside a house, so the moment IR sensors (or Wi-Fi or radar or whatever) start being able to see in the house, everyone might as well just remove their curtains.

Yeah I think these sort of attacks only matter to people who run random code sent by untrusted parties on their machines.

But I mean that includes Amazon and everybody that browses the web with JavaScript enabled, so I guess it is a pretty big population that might be interested?

If your threat model now requires a browser in the chain, then we can fix it in the browser, no?

https://blog.mozilla.org/security/2018/01/03/mitigations-lan...

https://security.googleblog.com/2018/07/mitigating-spectre-w...

Still safe at full CPU perf.

I don’t think I’ve described a threat model, just given and example of a single vector that is pretty widespread.

I just assume processes on my system can get root if they really want.

Yes, but Spectre was easily fixed by limiting the accuracy of the Browsers’ window.Performance interface AFIR. Meltdown on the other hand required a Kernel patch and a general performance penalty.

I also have all meltdown mitigations turned off in the Kernel on my Laptop.

Well it is in a way like "herd immunity" - if everyone around has mitigations on, no one would bother to use it as an attack vector. If everyone would for some reason start disabling mitigations, then the bug will stasrt getting exploited.

> However, if someone is motivated enough to kill you by focusing electromagnetic energy through a Pringles can, you probably did something to deserve that.

Someone who isn't me picked up archery with the express purpose of shooting either their completely innocent and reigthous ex partner and/or their ex partners new partner during their wedding, so I would not say effort made to kill someone equates to them deserving it.

this is what people thought about buffer-overflow attacks back in the 80s and, unaccountably, 90s: theoretical but not practical

if you haven't been following computer security, exploiting buffer overflows has been routine and widespread for decades, and on one notable occasion in the 80s morris's worm used one to take down most of the internet at once by accident

As with many other areas of development, sexy stuff often edges out practical stuff for attention. A lot of this comes from the natural tendency of engineers to be interested in sexy stuff, and a lot of it comes from career advancement and the desire to pad your resume out with impressive looking projects to show how smart you are.

Somebody here on HN pointed out there's a security researcher constantly pumping out side-channel attacks that are hard to pull off but sound sensational - and making PR around it that makes the rounds on the internet including HN.

I’ve always thought it a little odd the janitor threat model is called Evil Maid.

Perhaps because maid is a household thing and using encryption and authn/z schemes to stop it is less likely in an informal home environment?

IIRC the name refers more to cleaning staff at a hotel, who would have access to your laptop while you’re out of the room.

I was under the impression that it usually referred to the 'maid' in a hotel room cleaning service, when rooms were cleaned more regularly before COVID.

If you were away on business somewhere sketchy, the cleaning service could physically access your room and your documents / laptop in an at rest state, potentially without you knowing. This could be particularly a concern years ago if the country that you were in was hostile and the cleaning crews in major hotels had embedded state security (the other side of the iron curtain than you were from or something)

Hmm, well, I suppose I see my home cleaning lady more than I travel!

Fair enough.

Maybe that's my interpretation but when I think "maid", I thing of someone who can access my bedroom, a private space. When I think "janitor" I think more of public spaces where I would be less inclined to leave my stuff unattended and where it would be easier for the evildoer to get caught.

In other words, a maid would be a more trusted and therefore more powerful attacker than a janitor.

https://xkcd.com/538/

My son was asking me how I hacked into things back in the day. I told him 95% of it is literally just talking to people and asking for the thing you want. You don't even have to lie because most people never even thought to ask "why." Well, the older generation didn't. I've noticed most younger people will ask "why", even when it is obvious.