Specter what it is and why it is not solved by software

Specter: Google researchers investigating the scope and impact of Specter attacks have published a document (PDF) which confirms that Specter-type vulnerabilities will continue to exist on computers and that software-using techniques will result in a very high cost of performance.

Regardless of the cost, according to the research, the software will be inadequate, because some of the specter defects are not repaired with such changes.

The discovery and development of Meltdown and Specter attacks was undoubtedly one of them greatest in security history of computers. It was first unveiled last January, and since then new variations have been appearing throughout the year.

Note:

Below we will try, as much as we can explain the vulnerabilities, but also why software changes can not help. If you do not understand something, do not be disappointed, let's explain it below.

Both attacks are based on the discrepancies between the theoretical behavior of a processor and the documented behavior that depends on the developers and how they write their programs to determine the actual behavior of the applications.

In particular, all modern processors do something we call the theoretical execution (from speculative execution).

What does this mean; They make assumptions.

For example, consider a value read from hypothetic memory. If the case is true or false permits or does not allow execution of a command respectively. If the assumptions are correct, the theoretical results are retained. If not, the theoretical results are discarded and the processor repeats the calculation.

The theoretical execution is not an architectural feature of the processor. It is a feature of implementations and so it is supposed to be completely invisible to the applications running on your computer. When the processor rejects an incorrect case, it should be as if it never happened.

What the researchers of the Meltdown and Specter vulnerabilities found is that the theoretical execution is not completely invisible, and that when the processor discards the results, some data from the wrong assumptions are left behind.

For example, speculation can change the data stored in the cache of the processor. There are therefore applications that can detect these changes by measuring the time to read the values ​​from the memory.

Specter: attack and countermeasures

So the attacker can make the processor assume the wrong values ​​and use the cache changes to reveal the actual value. This becomes particularly threatening in applications like web browsers: a malicious one JavaScript can use such data to learn about the memory device, the process it runs, and then use this information to exploit other imperfections and execute arbitrary code.

Browser developers assume that they can build secure sandboxes to run a browser's processes. This way, scripts from malicious domains will not be able to learn about the memory layout and the processes that are running. Architecturally, these assumptions are correct. But the reality of Specter, came and landed too many.

Meltdown and Specter: Diversity

The Meltdown attack, which targeted and targeted its chips IntelOf Apple Lossless Audio CODEC (ALAC), and other manufacturers, it was a particularly unpleasant parchange of the above. The vulnerability allows a malicious program to extract data from the operating system kernel. Soon after Meltdown was discovered, changes were made to operating systems to hide their data from such malware.

However, Specter's vulnerability has so many different variations to date (and are still being discovered) that it makes it much more insidious. So developers try using various software development techniques to prevent data leakage in the processor or simply limit the information that can be revealed through the theoretical execution of the processor.

Google research has shown that these software-based measures are half-measures in essence. Some of them, such as blocking all cases after the values ​​are loaded from memory, protect against many attacks, but they are too weak in the system to be used in practice.

• Google Advanced Protection what is & how i enable it

The researchers experimented with modified versions of the machine JavaScript V8 στον Chrome και η χρήση αυτής της τεχνικής έριξε την απόδοση μεταξύ του ενός τρίτου και του ενός πέμπτου.

Here, let us mention that whatever measures they have taken, they have not discovered anything that protects absolutely. According to the researchers, a combination of techniques should be used and this will have cumulative effects on performance.

And now what;

So the company concluded that we cannot protect against the Specter vulnerability with software patches alone. Appropriate measures should be taken in the hardware as well, but this thought scares me why requires upgrades in millions of systems.

At present, applications that are trying to build secure environments based on guarantees provided by hardware to protect between processes.

For example, o Chrome has changed code to prevent content from running multiple domains in the same process. This still does not protect itself Chrome sandbox from a scripts attack, but ensures that a script cannot be attacked by multiple domains. Whatever we do, it's a kind of protection…

Overall, research shows that Specter will employ software developers, hardware makers and finalists. users for the next years.

Be strong…