meltdown – markusfeilner.de

Thanks to Snowden: “Security, Safety and fair market: Access by Openness and Control of the supply chain.” By KIT

KIT (Karlsruhe Institute of Technology, Institut für Technikfolgenabschätzung und Systemanalyse) has published a great study that I haven’t read completely, but though it’s worth sharing: KIT – ITAS – Research – Project overview – Quattro S: Security, Safety, Sovereignty, Social Product … Especially regarding:

“This project will provide solutions for multiple problems. The first one is the security of information technology. The range of issues addressed includes zero-day exploits (e.g., WannaCry ransomware), denial of service attacks (e.g., Mirai), hardware attacks (e.g. based on the Meltdown and Spectre CPU flaws) up to novel types of hardware Trojans. The possibilities for these attacks originate from weaknesses in the long IT supply chains and threaten the confidentiality, integrity and availability of systems. The second problem is that these attacks can also threaten the safety of products, e.g., in energy infrastructures or in the automotive industry. The third problem consists of a loss of value added because of a migration of production and competences towards competing economies (e.g. US and China). Sovereignty would mean to have full control of the characteristics of information technology, to be sure that no hidden features are implemented, that no business secrets can be stolen, and to benefit economically from such control.“

#Meltdown-#Spectre: I Guess the NSA knew about it since 1995…

The Intel 80x86 Platform should never be used in environments that need security... Here is a study from 1995 which was paid for by the NSA (I guess that is what “under the auspices” means?) and that comes to very frightening findings. Well, at least if you’re in security and IT:

“An in-depth analysis of the 80×86 processor families identifes architectural properties that may have unexpected, and undesirable, results in secure com-

puter systems. In addition, reported implementation errors in some processor versions render them undesirable for secure systems because of potential security and reliability problems.”

“This analysis is being performed under the auspices of the National Security Agency’s Trusted Product Evaluation Program (TPEP).”

I think this study sheds a strange light on the following quote from the Washington post:

“Rob Joyce, White House cybersecurity coordinator, said, “NSA did not know about the flaw, has not exploited it and certainly the U.S. government would

never put a major company like Intel in a position of risk like this to try to hold open a vulnerability.”

Oh really? A #Meltdown?

Media is going crazy about #Meltdown and #Spectre. Should you panic, too?

Here are some of my thoughts on that recent security desaster:

Don’t worry. Your systems have been damaged for twenty years, probably. A hardware vendor (probably more, maybe all of them) sold buggy chips, and they have been broken since 1995 or so.
It became known during the summer of 2017. At least, but surely not only since then a realistic chance of exploits was around, which became imminent some weeks ago and led Google/Intel to withdrawing from deadline and going public.
Yes, your systems are most likely affected. If you were not asked recently (i.e. since last Wednesday) to upgrade your kernel, then you have a problem. You are not affected if you are running hardware older than 1995 or some ARM stuff. Your kernel should now be 4.14.11 or newer – or contain backported code if it is an older version.
The patches deployed by all major OS vendors last week will make your systems significantly slower. However they will fix most of the problems, but not the ones that are so deep into hardware that no software can fix. Yes there are. But if you are only gaming, sending mails, writing office documents and browsing the web, you won’t even notice. However, if you are a database admin or running DNS servers or Enterprise Clouds – anything with many “context switches” between userland and kernel space, then you’re likely to suffer from performance loss..
The whole story may even become an #intelgate, because rumors have it that Intel had prior knowledge and some strange things going on with testing. Rumors, nothing more, except for a CEO selling most of his Intel stock in November and a flaw that makes systems 30-50% faster, but for what a price?

Justmy2cents.