New CPU security vulnerability: PortSmash

[Underseer]

https://www.zdnet.com/article/intel-cpus-impacted-by-new-portsmash-side-channel-vulnerability/

Researches recommend abandoning SMT (simultaneous multithreading) entirely. Ouch.

 

[Jimmy Higgins]

https://www.zdnet.com/article/intel-cpus-impacted-by-new-portsmash-side-channel-vulnerability/

Researches recommend abandoning SMT (simultaneous multithreading) entirely. Ouch.

This is well out of my knowledge zone, but I'm going to provide my opinion anyw...

...no I'm not. I have no idea how big of a problem this is, or whether this can be properly mitigated as per Intel's information.

 

[bilby]

https://www.zdnet.com/article/intel-cpus-impacted-by-new-portsmash-side-channel-vulnerability/

Researches recommend abandoning SMT (simultaneous multithreading) entirely. Ouch.

Or perhaps IaaS isn't such a great idea.

Running stuff on your own, secured, hardware would seem to almost completely mitigate this risk - or at least, it gives black hats the headache of getting their malware into your environment. These kinds of side-channel attacks are really only practical when attackers can rent CPU time on the same hardware as their victims.

There's no such thing as 'the cloud' - it's just somebody else's computer.

 

[Underseer]

https://www.zdnet.com/article/intel-cpus-impacted-by-new-portsmash-side-channel-vulnerability/

Researches recommend abandoning SMT (simultaneous multithreading) entirely. Ouch.

Or perhaps IaaS isn't such a great idea.

Running stuff on your own, secured, hardware would seem to almost completely mitigate this risk - or at least, it gives black hats the headache of getting their malware into your environment. These kinds of side-channel attacks are really only practical when attackers can rent CPU time on the same hardware as their victims.

There's no such thing as 'the cloud' - it's just somebody else's computer.

Correction: "the cloud" is someone else's computers. Plural.

 

[barbos]

https://www.zdnet.com/article/intel-cpus-impacted-by-new-portsmash-side-channel-vulnerability/

Researches recommend abandoning SMT (simultaneous multithreading) entirely. Ouch.

Or perhaps IaaS isn't such a great idea.

Running stuff on your own, secured, hardware would seem to almost completely mitigate this risk - or at least, it gives black hats the headache of getting their malware into your environment. These kinds of side-channel attacks are really only practical when attackers can rent CPU time on the same hardware as their victims.

There's no such thing as 'the cloud' - it's just somebody else's computer.

No, not gonna work. Every time you run an app on your smart phone or even visit a website you are renting your CPU to someone.
Virtualization/sandboxing is a must today. And all these side channel attacks (Spectre, Meltdown, L1TF and now PortSmash) are killing it.

PortSmash is different from previous shit because it does not rely on cache side channel. It relies on SMT when two threads running on the same core affect each other timing, SMT is fundamentally insecure and must die.

 

[Tigers!]

And I had just worked out Spectre.

 

[bilby]

And I had just worked out Spectre.

The Special Executive for Counterintelligence, Terrorism, Revenge and Extortion? They haven't been much of a threat since 007 killed Blofeld in Diamonds are Forever.

 

[Bomb#20]

And I had just worked out Spectre.

The Special Executive for Counterintelligence, Terrorism, Revenge and Extortion? They haven't been much of a threat since 007 killed Blofeld in Diamonds are Forever.

 

[Tigers!]

And I had just worked out Spectre.

The Special Executive for Counterintelligence, Terrorism, Revenge and Extortion? They haven't been much of a threat since 007 killed Blofeld in Diamonds are Forever.

I told you it took me a while.