Spectre of the £50bn PPI crisis looms large on banking sector

How a car finance ruling is affecting UK banks - The Banker

Spectre

This article is based on my <a href="http://pluralsight.pxf.io/c/1191769/424552/7490?subId1=solving&amp;u=https%3A%2F%2Fapp.pluralsight.com%2Fprofile%2Fauthor%2Fdavid-clinton" target="_blank">Linux Performance Monitoring and Tuning course on Pluralsight</a> which, by coincidence, was released just before news of Spectre and Meltdown broke.

Cleaning up after Spectre and Meltdown: figuring out how badly they slowed down your servers

In a <a href="https://medium.com/revissolutions/spectre-meltdown-processor-vulnerabilities-what-you-need-to-know-587ebb37f2dc" target="_blank">previous post</a> we discussed the recently disclosed processor attacks called Spectre (<a href="https://nvd.nist.gov/vuln/detail/CVE-2017-5753" target="_blank">CVE-2017–5753</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2017-5715" target="_blank">CVE-2017–5715</a>) &amp; Meltdown (<a href="https://nvd.nist.gov/vuln/detail/CVE-2017-5754" target="_blank">CVE-2017–5754</a>). While we know that most of our readers are users of technology who simply want to be better at security (and aren’t interested in the technical), we also know that some of our readers enjoy going a bit deeper into the technical weeds. In this post we’ll highlight some of the key technical learning that comes from Spectre and and Meltdown.

Spectre & Meltdown Processor Vulnerabilities: A Technical Introduction

There’s never just one or two isolated, one-off flaws in complex computing products. Especially with a product as complex and widely used as Intel CPUs, once one <a href="https://hackernoon.com/tagged/security" target="_blank">security</a> vulnerability is exposed, many more will soon follow.

Spectre and Meltdown are just the beginning

At <a href="https://criticalblue.com" target="_blank">CriticalBlue</a>, we’ve been discussing the newly disclosed Meltdown and Spectre flaws and their impact on <a href="https://approov.io" target="_blank">device security</a>. Our CTO, Richard Taylor, wrote two blog posts giving a nice overview of the exploits and their likely impact on mobile device security. <a href="https://hackernoon.com/you-just-need-to-speculate-to-exfiltrate-a093a31aa904" target="_blank">Part 1</a> provides a clear explanation of the attacks and goes a little deeper than most. Part 2, focused on Android exploits, is included below to help get the word out.

The Spectre of the Zygote

<a href="https://googleprojectzero.blogspot.com/" target="_blank">Google’s Project Zero</a> dropped a <a href="https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html" target="_blank">bombshell</a> on the security community last week detailing CPU bugs affecting <a href="https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf" target="_blank">Intel</a>, <a href="https://www.amd.com/en/corporate/speculative-execution" target="_blank">AMD</a>, and <a href="https://developer.arm.com/support/security-update" target="_blank">ARM</a> architectures going back as far as Pentium Pros. Yup, the chip with a mountain of cache and immortalized by Weird Al.

Exploiting Spectre with Deep learning

Over the last couple of days, two major vulnerabilities — Spectre and Meltdown — have surfaced. These vulnerabilities, which affect nearly all intel chips from the past decade, are two of the most — if not the most — dangerous vulnerabilities the IT world has ever seen.

Explain Spectre and Meltdown Like I’m 5

TL;DR: a PoC demonstrating <a href="https://spectreattack.com/" target="_blank">Spectre</a>, the nasty CPU bug, running on Kubernetes.

Spectre-on-Kubernetes, a proof of concept

A coordinated disclosure overnight brought forth details of two large vulnerabilities affecting nearly all computer users worldwide. This comes after days of mounting speculation online following benchmarks of an unexplained bug fix reportedly causing performance losses of anywhere from 5 to 30% depending on the task at hand.

Meltdown and Spectre: what are they and what should I do?

The end of 2017 has seen some pretty ridiculous headlines about the tech industry. 2018 will be the year the cool tech guy in the hoodie is finally revealed to be the not so cool tech guy who’s “hacking” your attention to get more money from advertisers. It’s going to be the year that “Move Fast and Break Things” turns into “Move Slow and Check For Bugs”.

2018 Will be the Year of Sane Technology

At <a href="https://criticalblue.com" target="_blank">CriticalBlue</a>, we’ve been discussing the newly disclosed Meltdown and Spectre flaws and their impact on <a href="https://approov.io" target="_blank">device security</a>. Our CTO, Richard Taylor, wrote a <a href="https://www.approov.io/blog/you-just-need-to-speculate-to-exfiltrate.html" target="_blank">blog post</a> giving a nice overview of the exploits. It’s a clear explanation and goes a little deeper than most, so I have included his thoughts below to help get the word out.

You Just Need to Speculate to Exfiltrate

If you’ve read <a href="https://www.nytimes.com/2018/01/03/business/computer-flaws.html" target="_blank">today’s tech news</a>, you’ve heard about the new Meltdown and Spectre attacks. Unlike most attacks, these target hardware flaws, rather than software flaws. While computer security researchers have apparently known about the for months, they were kept secret — “embargoed” — to give vendors a head start to fix the problems. But rumors started circulating over the holiday weekend, and now the cat is out of the bag.

Timing is Everything

I just read the <a href="https://meltdownattack.com/meltdown.pdf" target="_blank">white paper on the “Meltdown” CPU security bug</a> because I was curious about what exactly was going on here. The whitepaper explains it in detail but it’s fairly long and academic so I thought a simpler overview was in order.

A Simplified Explanation of the “Meltdown” CPU Vulnerability

This started out as a <a href="https://twitter.com/cnorthwood/status/949620698795913216" target="_blank">Twitter thread</a> which has been robustly challenged by my followers, but it probably deserves a more detailed exploration.

Why do we run un-trusted code, and how do we stop?

Surely you’ve heard of Meltdown by now. It’s a hardware vulnerability that allows an unauthorized process access to privileged memory. It affects Intel processors produced since 1995. Here are some details: <a href="https://en.wikipedia.org/wiki/Meltdown_%28security_vulnerability%29" target="_blank">https://en.wikipedia.org/…/Meltdown_(security_vulnerability)</a>

System calls have become more expensive with Meltdown. How to avoid them?

Serious CPU design vulnerability that needs to be addressed via a patch to the operating system. Automatic updates to the rescue!

Meltdown and Spectre

There's a lot at stake with Amazon's (so far unsuccessful) attempt to create a franchise around the James Bond name.

Amazon's $8.45 Billion Gamble Clashes with Broccoli Family's Iron Grip on 007

Dive into the world of ethical hacking with Benicio and Simplicius as they exploit vulnerabilities in a popular food delivery app. From social engineering to SQ

Are You Hungry, Bro? Let’s Hack Your Favorite Food Delivery App

This paper explores vulnerabilities in DAG-based blockchain protocols, showing how greedy miners exploit the random transaction selection strategy. 

The Greedy Miner’s Dilemma: Flaws in DAG-Based Consensus Protocols

Explore the landscape of DAG-based blockchain protocols—consensus mechanisms, mining and trade-offs between decentralization, scalability, and security. 

Comparative Study of DAG Protocols and Their Impact on Blockchain Performance

Explore incentive attacks within DAG-based blockchain protocols, focusing on greedy miners deviating from the RTS strategy.

Identifying Incentive Attacks in DAG-Oriented Blockchain Protocols

This paper explores how greedy miners deviating from the random transaction selection strategy in DAG-based blockchain protocols can outperform honest miners. 

How Greedy Miners Are Breaking DAG Blockchains

This research paper investigates just how secure Firecracker is against microarchitectural attacks.

Microarchitectural Security of AWS Firecracker VMM: Analysis of Microarchitectural Attack & Defenses

Microarchitectural Security of AWS Firecracker VMM: Background

Microarchitectural Security of AWS Firecracker VMM: Analysis of Firecracker's Containment Systems

Spectre is a cloud-based data platform to manage and monitor critical, production-grade data.

SPECTRE

spectredata.io

Since 2021

Spectre's stories on HackerNoon