Hacker News Reader

Comment by adg001 | Hacker News Reader

Author of the paper here; AMA.

I would recommend having a look at advanced side-channel PCIe bus DMA taps used by game cheats. They use a second computer along with an external HDMI mask-overlay mixer, to dump the target computers internal game-engine state through unencrypted DMA access to the overlay channel. Thus, gives the cheaters x-ray vision and aim-bot features for games protected by kernel level anti-cheat software.

Highly entertaining nuisance users. =3

Does this work with IOMMU?

Unknown, but there were a few obvious bios options I saw that are needed to make the kits performant with some systems.

I still find it absurd people would go that far to cheat at a game. =3

> I still find it absurd people would go that far to cheat at a game. =3

I guess it turns the cheating into its own meta-game!

True, but a blacklisted $5k GPU seems like a bit of a risk. =3

it would be at a low enough level to reprogram IOMMU unless a hypervisor will prevent it.

if you have a hypervisor you can prevent the other to do the dma freely in memory because u can use iommu and things like amd-vi to separate it good. but if you dont have the hv below it, any devices with dma can do the duty across entire ram.

BTW, project summary is here https://www.pwnshow.com/investigations/INV-006/

In comparing xen to qubes bulletins does the vastly different user count affect the analysis?

While user count can affect absolute disclosure volume it does not drive the main comparison in my paper. What I do is to use Xen advisories to measure upstream dependence: how much of the Qubes public advisory record is attributable to Xen/CPU/upstream components rather than Qubes core logic? That attribution result is internal to the Qubes record, so it is much less sensitive to Xen’s much larger user base.

Reply on news.ycombinator.com