Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Hardware vulnerabili ...

 Business

Researchers at both the University of Maryland in the U.S. and Tsinghua University in China have published a scientific paper documenting a new side-channel attack method that exploits a previously unknown hardware vulnerability in Intel processors. Although the vulnerability seems to affect the chipmakers latest   show more ...  

processors, its most effective in attacking older models that are also exposed to the Meltdown vulnerability. The paper would likely be purely of scientific interest were it not for one aspect: attackers steal sensitive information by changing flag register data. In English, please Hardware processor vulnerabilities linked to speculative execution of instructions have been the subject of much research for more than five years. To simplify as much as possible, all the proposed attacks can be summed up as follows: the CPU is somehow forced to read data that user should not have access to. Imagine this theoretical scenario: the attackers program doesnt have access to the encryption key used to protect sensitive data. If we instruct the CPU to read the encryption key at a certain address, the instruction simply wont be followed. Help arrives (to the attacker) in the form of speculative execution of instructions – an important feature of modern CPUs, which has been around for almost three decades: to speed things up, instead of waiting for one instruction to finish, the processor executes the next in parallel. If the first instruction checks access rights to sensitive information, it should in theory not allow execution of the following instruction to read this information. But its too late: the following instruction is being executed speculatively. Note that we dont yet have access to this data – but the CPU does. In the case of known vulnerabilities such as Spectre, data is temporarily loaded into the CPUs cache, but it cant be read just like that. However, it can be read through side channels; for example, by repeatedly executing an instruction – the processing time of which varies depending on the data in the cache. Repeating such an operation many (thousands of!) times allows attackers to recover data just by watching how quickly or slowly some seemingly harmless command is executed. We realize that this simple description still sounds complicated. The new paper is even more perplexing, especially since the authors decided not to spend time on a detailed description of the attack. The diagram below outlines it in full: Overview of transient execution timing side-channel. Source. Lets try to figure it out. EFLAGS is a flag register in the Intel processor that keeps track of the CPUs operating status. It can store the result of calculations, in particular if this is equal to zero (the so-called zero flag or ZF). Next comes the magic: imagine a colleague of yours thinks of a number from 1 to 10 and is told to keep it to themselves. You keep calling out the numbers 1 through 10 (looking for whatever signs could give your colleague away), but they dont want to share the correct answer with you, and respond each time with the word chrysanthemum. However, when you utter the correct number, they take a little longer to say chrysanthemum compared with other times. Something similar happens in this new attack: we perform numerous calculations with sensitive data. All these calculations are done speculatively. The result is written to the ZF flag (equal or not equal to zero). We cant directly know the status of this flag. But then we execute a rather useless JCC instruction (specifically the JZ instruction – jump if zero), which runs a little slower if we guessed right! And its this measurable delay in the response that constitutes the vulnerability. Not yet a problem The most interesting aspect of this attack is that it doesnt work by itself. To ensure that speculative execution of the required instructions is possible, the bad guys need to exploit one more vulnerability. The paper were discussing uses the Meltdown vulnerability, discovered in 2018, which happily provides access to information thats off-limits to outsiders. As a result, sensitive data was read with 100% reliability on all old CPUs affected by this vulnerability (the study used sixth and seventh-generation Intel Core i7). Although the experiment failed on tenth-generation CPUs, they too experience some delay when executing a certain instruction from the JCC set. In reality, even more versatile types of attacks like Spectre, which steal information from the CPUs cache, have a rather narrow application. But at least in their case it was obvious that something had to be done with them: the likelihood of an advanced attack targeting critical data was non-zero. As for the new paper, were dealing more with an idea that, if it works at all, it applies to older Intel processors. But the news itself is significant: theres now a new side-channel mechanism for extracting data using the flag status register. It cant be ruled out that in the future this approach, combined with some other vulnerability, will impact new CPUs as well. Or maybe it will all be resolved before we see a new attack: after all, dependence of the instruction execution time on the data is quite a serious issue. Theres an entire subdiscipline of cryptography that deals with protection of encryption algorithms from timing attacks. In any case, research into the specifics of modern CPUs is ongoing. Fortunately, executing attacks on hardware vulnerabilities is just as difficult as understanding them. And although weve yet to see anything that could be applied on a massive scale, infosec officers in companies that handle highly sensitive data would be wise to factor in such threats and, at a minimum, monitor their evolution.

 Malware and Vulnerabilities

Analyzing the info-stealer with a decompiler, researchers noticed a number of interesting function names, including anti-debugging features and stealing data from web browsers, Discord, Steam, and cryptocurrency wallets, among others.

 Trends, Reports, Analysis

The volume of identity fraud incidents last year barely changed from an all-time high recorded in 2021, with Google Voice accounts the most popular target, according to the Identity Theft Resource Center (ITRC).

 Trends, Reports, Analysis

“According to our findings, Microsoft Teams is one of the ten most targeted sign-in applications, with nearly 40% of targeted organizations having at least one unauthorized login attempt trying to gain access,” said researchers at Proofpoint.

 Breaches and Incidents

Dunghill sent an email to TechTarget Editorial with a link to a Tor site that allegedly contained 5 TB of sensitive corporate data, including emails, client documents, and the personal data of 10,000 Gentex employees such as Social Security numbers.

 Companies to Watch

Accenture has made a strategic investment, through Accenture Ventures, in SpiderOak, a Reston, Virginia-based leader in zero-trust cybersecurity and resiliency solutions for next-generation space systems. The amount of the deal was not disclosed.

 Feed

Ubuntu Security Notice 6092-1 - Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement speculative execution barriers in usercopy functions in certain situations. A local attacker could use this to expose sensitive information. Xingyuan Mo discovered that the x86 KVM   show more ...  

implementation in the Linux kernel did not properly initialize some data structures. A local attacker could use this to expose sensitive information.

 Feed

Red Hat Security Advisory 2023-3167-01 - New Red Hat build of Cryostat 2.3.0 on RHEL 8 container images have been released, adding a variety of features and bug fixes. Issues addressed include a denial of service vulnerability.

 Feed

Ubuntu Security Notice 6091-1 - It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information. Ziming Zhang discovered that the VMware Virtual GPU DRM   show more ...  

driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service.

 Feed

Red Hat Security Advisory 2023-3229-01 - An update for openshift-gitops-kam is now available for Red Hat OpenShift GitOps 1.8. Red Hat Product Security has rated this update as having a security impact of Important. Issues addressed include a bypass vulnerability.

 Feed

Ubuntu Security Notice 6090-1 - It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information. Zheng Wang discovered that the Intel i915 graphics driver   show more ...  

in the Linux kernel did not properly handle certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a denial of service.

 Feed

Ubuntu Security Notice 6089-1 - It was discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Red Hat Security Advisory 2023-3195-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, cross site scripting, information leakage, and insecure permissions vulnerabilities.

 Feed

Apple on Thursday rolled out security updates to iOS, iPadOS, macOS, tvOS, watchOS, and the Safari web browser to address three new zero-day flaws that it said are being actively exploited in the wild. The three security shortcomings are listed below - CVE-2023-32409 - A WebKit flaw that could be exploited by a malicious actor to break out of the Web Content sandbox. It was addressed with

 Feed

Malicious Google Search ads for generative AI services like OpenAI ChatGPT and Midjourney are being used to direct users to sketchy websites as part of a BATLOADER campaign designed to deliver RedLine Stealer malware. "Both AI services are extremely popular but lack first-party standalone apps (i.e., users interface with ChatGPT via their web interface while Midjourney uses Discord)," eSentire

 Feed

Google has announced plans to officially flip the switch on its twice-delayed Privacy Sandbox initiatives as it slowly works its way to deprecate support for third-party cookies in Chrome browser. To that end, the search and advertising giant said it intends to phase out third-party cookies for 1% of Chrome users globally in the first quarter of 2024. "This will support developers in conducting

 Feed

Active Directory (AD) is among the oldest pieces of software still used in the production environment and can be found in most organizations today. This is despite the fact that its historical security gaps have never been amended. For example, because of its inability to apply any security measures beyond checking for a password and username match, AD (as well the resources it manages) is

 Feed

Two malicious packages discovered in the npm package repository have been found to conceal an open source information stealer malware called TurkoRat. The packages – named nodejs-encrypt-agent and nodejs-cookie-proxy-agent – were collectively downloaded approximately 1,200 times and were available for more than two months before they were identified and taken down. ReversingLabs, which broke

2023-05
Aggregator history
Friday, May 19
MON
TUE
WED
THU
FRI
SAT
SUN
MayJuneJuly