Meltdown and Spectre CPU Flaws Affect Intel, ARM, AMD Processors

Meltdown and Spectre CPU Flaws Affect Intel, ARM, AMD Processors 

Unlike the initial reports suggested about Intel chips being vulnerable to some severe ‘memory leaking’ flaws, full technical details about the vulnerabilities have now been emerged, which revealed that almost every modern processor since 1995 is vulnerable to the issues.

Disclosed today by Google Project Zero, the vulnerabilities potentially impact all major CPUs, including those from AMD, ARM, and Intel—threatening almost all PCs, laptops, tablets, and smartphones, regardless of manufacturer or operating system.

These hardware vulnerabilities have been categorized into two attacks, named Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 and CVE-2017-5715), which could allow attackers to steal sensitive data which is currently processed on the computer.

Both attacks take advantage of a feature in chips known as "speculative execution," a technique used by most modern CPUs to optimize performance.

"In order to improve performance, many CPUs may choose to speculatively execute instructions based on assumptions that are considered likely to be true. During speculative execution, the processor is verifying these assumptions; if they are valid, then the execution continues. If they are invalid, then the execution is unwound, and the correct execution path can be started based on the actual conditions," Project Zero says.

Therefore, it is possible for such speculative execution to have "side effects which are not restored when the CPU state is unwound and can lead to information disclosure," which can be accessed using side-channel attacks.

Meltdown Attack

The first issue, Meltdown (paper), allows attackers to read not only kernel memory but also the entire physical memory of the target machines, and therefore all secrets of other programs and the operating system.

“Meltdown is a related microarchitectural attack which exploits out-of-order execution in order to leak the target’s physical memory.”

Meltdown uses speculative execution to break the isolation between user applications and the operating system, allowing any application to access all system memory, including memory allocated for the kernel.

“Meltdown exploits a privilege escalation vulnerability specific to Intel processors, due to which speculatively executed instructions can bypass memory protection.”

Nearly all desktop, laptop, and cloud computers affected by Meltdown.

Spectre Attack

The second problem, Spectre (paper), is not easy to patch and will haunt people for quite some time since this issue requires changes to processor architecture in order to fully mitigate.

Spectre attack breaks the isolation between different applications, allowing the attacker-controlled program to trick error-free programs into leaking their secrets by forcing them into accessing arbitrary portions of its memory, which can then be read through a side channel.

Spectre attacks can be used to leak information from the kernel to user programs, as well as from virtualization hypervisors to guest systems.

“In addition to violating process isolation boundaries using native code, Spectre attacks can also be used to violate browser sandboxing, by mounting them via portable JavaScript code. We wrote a JavaScript program that successfully reads data from the address space of the browser process running it.” the paper explains.

“KAISER patch, which has been widely applied as a mitigation to the Meltdown attack, does not protect against Spectre.”

According to researchers, this vulnerability impacts almost every system, including desktops, laptops, cloud servers, as well as smartphones—powered by Intel, AMD, and ARM chips.

What You Should Do: Mitigations And Patches

Many vendors have security patches available for one or both of these attacks.

• Windows — Microsoft has issued an out-of-band patch update for Windows 10, while other versions of Windows will be patched on the traditional Patch Tuesday on January 9, 2018
• MacOS — Apple had already fixed most of these security holes in macOS High Sierra 10.13.2 last month, but MacOS 10.13.3 will enhance or complete these mitigations.
• Linux — Linux kernel developers have also released patches by implementing kernel page-table isolation (KPTI) to move the kernel into an entirely separate address space.
• Android — Google has released security patches for Pixel/Nexus users as part of the Android January security patch update.  Other users have to wait for their device manufacturers to release a compatible security update.

Mitigations for Chrome Users

Since this exploit can be executed through the website, Chrome users can turn on Site Isolation feature on their devices to mitigate these flaws.

Here's how to turn Site Isolation on Windows, Mac, Linux, Chrome OS or Android:

• Copy chrome://flags/#enable-site-per-process and paste it into the URL field at the top of your Chrome web browser, and then hit the Enter key.
• Look for Strict Site Isolation, then click the box labeled Enable.
• Once done, hit Relaunch Now to relaunch your Chrome browser.

There is no single fix for both the attacks since each requires protection independently.

Read More

How Intel AMT Vulnerability Allows to Hack Computers Remotely - Explained

Explained — How Intel AMT Vulnerability Allows to Hack Computers Remotely

Earlier this week Intel announced a critical escalation of privilege bug that affects its remote management features shipping with Intel Server chipsets for past 7 years, which, if exploited, would allow a remote attacker to take control of vulnerable PCs, laptops, or servers.

The vulnerability, labeled CVE-2017-5689, affects Intel remote management technologies, including Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT) software, versions 6 through 11.6.

The flaw was originally discovered by Maksim Malyutin, a member of Embedi research team, in mid-February, who then responsibly disclosed it to the Intel security team.

My previous article, published earlier this week, was based on the partial information shared by Maksim to The Hacker News, as the reported Intel AMT vulnerability was highly critical and can be exploited remotely, Embedi held technical details until most sysadmins update their systems with a patched firmware.

Today, Embedi research team has disclosed complete technical details about the critical vulnerability, revealing that a remote attacker can hijack computers powered by Intel Chipset just by sending an empty authentication string.

To understand how, I have compiled this piece explaining:

• What is Intel AMT technology?
• Where the Intel AMT Vulnerability resides?
• How can an attacker exploit Intel AMT Vulnerability?

What is Intel AMT technology?

Intel-based chipsets come with an embedded technology, called Intel Active Management Technology (AMT), to enhance the ability of IT administrators, allowing them to remotely manage and repair PCs, workstations, and servers of their organization.

Using a web-based control panel, accessible from port 16992 and 16993, which comes pre-installed on the chipset, an administrator can remotely manage a system.

The Intel AMT Web Interface works even when the system is turned off, as long as the platform is connected to a line power and a network cable, as it operates independently of the operating system.

Where the Intel AMT Vulnerability resides?

To protect Intel AMT Web Interface from unauthorized users, the service makes use of HTTP Digest and Kerberos authentication.

The escalation of privilege vulnerability resides in the way Intel AMT Web Interface handles user authentication over HTTP Digest protocol, which is based on a simple challenge-response paradigm.

Before going into the technical details about the exploitation of this vulnerability, first, you need to know how the Digest authentication works.

The Digest authentication completes in the following steps:

• Client requests server to initiate login, and in response, the server returns a randomly generated 'nonce' value, the HTTP method, and the requested URI.
• Next, the user is prompted to enter his username and password.
• Once entered, the client machine sends an encrypted string (referred as user_response)—generated by applying a hash function to the entered username and password, server-supplied nonce value, HTTP method, and the requested URI—to the server.
• The server also calculates a similar encrypted string (referred as computed_response) using username and password stored in the database and all the other three values.
• The server compares both the strings using the strncmp() function and if they match, it allows the user to log into the Intel AMT Web Interface.

The Intel AMT vulnerability resides exactly in the strncmp() function that server uses to compare both encrypted strings.

Syntax example:
strncmp (string_1, string_2 , length)
—where, length parameter defines how many characters needs to be compared.

Strncmp() is a binary safe string comparison function that returns a negative, zero, or a positive integer depending upon whether string_1 is greater or less than string_2, and if they are equal, it returns zero.

As, it’s obvious, for successful authentication, user_response variable must be equal to computed_response variable; hence the strncmp() function must return a zero value for any length.

But, according to the researcher, the programmers who coded this authentication process for Intel platform mistakenly used the length of the user_response variable in strncmp() function, instead of the computed_response variable for response_length parameter.

How can an attacker exploit Intel AMT Vulnerability?

To exploit this logical flaw in Intel AMT Web Interface, all an unauthorized attacker needs to do is send nothing (null) into user_response to the server.

Since the strncmp() function is mistakenly using character length of the user_response variable to authorize the user, which in this case is null, the string comparison function would be tricked into matching nothing and believe that attacker's response (user_response) is equals to the computed_response.

As both variables matched, the attacker will be authenticated to log into the Intel AMT Web Interface and do whatever an authorized administrator can do, gaining high-level privileges on the system.

How Bad is this Vulnerability? Very Bad, Believe me.

An attacker can also use Keyboard Video Mouse (KVM) feature, available inside Intel AMT Web Panel, which runs at a hardware level and allows sysadmins to remotely take control of the whole system, and perform tasks like:

"[Attacker] can remotely load, execute any program to the target system, read/write any file (using the common file explorer)," the research team wrote in its paper [PDF]. "Using IDE-R (IDE Redirection), [the attacker] can remotely change the boot device to some other virtual image for example." 

"Using SOL (Serial over LAN), [the attacker] can remotely power on/power off/reboot/reset and do other actions with this feature. Also, it can be used to access BIOS setup for editing," the team added.

In short, a potential attacker can do everything that a sysadmin can do: he can log into a vulnerable machine's hardware, and silently perform malicious activities, like tampering with the system and installing virtually undetectable malware.

Install Firmware Update to Patch the Vulnerability NOW!

The bug affects Intel manageability firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 for Intel's AMT, ISM, and SBT platforms. However, versions before 6 or after 11.6 are not impacted.

Intel has rated the vulnerability as highly critical and released new firmware versions, instructions to detect if any workstation runs AMT, ISM, or SBT, a detection guide to check if your system is vulnerable, and a mitigation guide for those organizations that can not immediately install updates.

So, the Intel customers are strongly recommended to install a firmware patch without wasting a single second.

Also, there's a simple mitigation tool available on Github, created by Malware researcher Bart Blaze, which is based on the Mitigation Guide provided by Intel.

All an affected user has to do is, just download and run DisableAMT.exe, it will disable Intel AMT on Windows operating system (x86 and x64).

Read More

Intel’s Anniversary Pentium

Intel’s Anniversary Pentium may be the ultimate budget gaming CPU......

BY usama.asif on july 11,2014 at 3:35 pm...

Earlier this year, Intel announced that it would bring two new enthusiast overclocking processors to market — the Core i7-4790K (Devil’s Canyon) at the top end, and the low-end Pentium G3258. We’ve reviewed theCore i7-4790K recently, and found it wanting; the chip’s overclocking performance is only slightly higher than the Core i7-4770K’s, even if its thermals are much better — but the dual-core Pentium G3258 had more potential. With fewer cores under the heat spreader, there’s less of a chance of a hot spot choking the die’s performance.

According to the Tech Report, the G3258 has exactly the kind of legs that folks were hoping for. The chip proved capable of pushing from its 3.2GHz stock speed all the way to 4.8GHz with a final temperature of just 64C. That’s a 50% clock boost — not bad for a chip with a retail price of $72 (TR snagged it for $60 on sale).

Single-Thread superiority

One of the topics that comes up with great regularity in CPU reviews is whether or not single-thread performance remains important in the modern age. It’s not uncommon for an AMD fan to show up and declare that no, thanks to multi-threading and HSA, single-thread performance is utterly dead (or will be in the near future). There’s no doubt that multi-threading can provide a significant performance boost in many applications — indeed, in some tests, AMD remains competitive for precisely this reason.

What people forget, however, is that adding more threads only improves performance from your single-threaded baseline. In several of the applications TR tests, the Pentium G3258 punches far above its weight-class, beating past the quad-core AMD processors when both solutions are overclocked. In Crysis 3, this situation persisted — not only did the G3258 outperform the FX-8350 when overclocked to 4.8GHz, it nearly kept pace with Intel’s entire stable of Core i7 processors.

What’s most interesting for gaming is how the G3258 spends far less time above 33.3ms than any AMD solution, even the FX-8350 — and what an enormous difference the overclocking makes. Clearly, the chip’s high clock speed is compensating for its low core count — improving the clock speed by 50% cuts its time spent above 33.3ms by a factor of five. It’s not clear why this is happening — presumably, the dual-core CPU is running fast enough to handle multiple threads without a major performance penalty. If CryTek targeted a relatively low performance threshold (say, four Intel cores clocked at 2.4GHz), that would explain the difference.

The G3258 isn’t going to be a chip for everyone. While TR has promised a more thorough investigation, there are obviously going to be multi-threaded titles and applications where more cores trump higher clock speeds, particularly since both AMD and Intel have chips with eight threads on the market. AMD may also have a new core of its own available in the not-too-distant future — the current $99 option is the Athlon X4 750K, a Trinity-based chip from 2012.

If the G3258 keeps hitting these clocks, however, it has a real chance of cementing its status as a great budget option. Fast dual cores aren’t going to be an ideal match for every workload — but for $72? That’s a pretty sweet deal.

Read More