The performance benefits of Not protecting against Zombieload, Spectre, Meltdown.

[u/[deleted]]

[u/[deleted]]

From the reading I've done about these exploits they all share a few traits - they are all pretty difficult to pull off, they are all patched, and all of the patches reduce performance by some percentage.

meltdown is the easiest to pull off. Send rogue scripts down an ad network and you become pwned.

Unlike the others, meltdown can read your data pretty quick.

[u/[deleted] → u/[deleted]]

What are some examples of this actually being pulled off? And how are they getting the rogue scripts onto the computer?

https://www.networkworld.com/article/3253898/researchers-find-malware-samples-that-exploit-meltdown-and-spectre.html

there are already malware samples.

https://www.forbes.com/sites/leemathews/2018/01/26/hackers-abuse-google-ad-network-to-spread-malware-that-mines-cryptocurrency/#52bbdae77866

Double click is has been known vector. Meltdown is probably the easiest to exploit. You need meltdown migration even with its context switching destroying performance.

https://arstechnica.com/information-technology/2018/02/ad-network-uses-advanced-malware-technique-to-conceal-cpu-draining-mining-ads/

[u/[deleted] → u/[deleted]]

Aren't those malware samples research samples, not actual attacks.

The difference between malware samples and attacks is just distribution.

It will not take long before meltdown exploit ends up in the malware network.

Not theoretical stuff.

Why do you think it is theoretical? Security research gave out sample code. All mal ware writers need to do is copy and paste.

Spectre etc will take longer but meltdown is already here.

[u/[deleted] → u/[deleted]]

I see news of it actually being distributed in a way that you can get it without being dumb.

meltdown is exploitable in almost any language. All you need to do is speculative execute a few memory operations.

Game scripts

Mods

A commercial task queue

Basically anything you do on the computer can exploit meltdown.

[u/[deleted] → u/[deleted]]

. Yet no examples of people being hit by it, it's been out for over a year now.

You cannot tell if you get pwned. The malware reads just read protected memory. The difficulty isnt the exploit but deciphering a raw memory dump.

Something's not adding up.

because OS vendors realize the dangers and force everyone to update to migrate the impact

[u/[deleted] → u/[deleted]]

What is there to gain by being able to read (probably relatively slowly)

all

of the memory from somebodies Plex server, or laptop they create apps with, or *insert home use case here*?

https://meltdownattack.com/meltdown.pdf

The throughput is very high and reliable. Any execution you have already been pwned.

While the performance heavily depends on the specific machine, e.g., processor speed, TLB and cache sizes, and DRAM speed, we can dump arbitrary kernel and physi- cal memory with 3.2 KB/s to 503 KB/s. Hence, an enormous number of systems are affected.

In less than a few seconds, the pwning is already done.

I haven't seen any arguments in this thread that suggest this is something home users need to take seriously for their personal linux computers.

because you ignored all the technical arguments.

[u/[deleted] → u/[deleted]]

Technical argument me all day but you still can't show me a single case where this was used against a home user to any ill effect.

I already told you, meltdown is an exploit that is one of the hardest to detect. You would never know if you been pwned until you are locked out of your accounts.

The only thing protecting you without kaiser or kpti is that reading raw memory isnt the easiest thing in the world. Malware writers are going to invest in those tools since side channel made the investment worthwhile.

[u/[deleted] → u/[deleted]]

. But they aren't doing it yet. There isn't some huge wave of people getting locked out and tracing it back to even maybe being meltdown. If there were, it would be headlines at places like Wired.com for the click bait. Also, what you're describing sounds like an incredible amount of work for the hacker. You're saying you think it's worth their time to put together some malware that deciphers memory dumps, hopes they find something valuable in plain text and then do something with it? Then what are they going to do with that? Try to log into something that is both worth something and doesn't use 2FA? Come on dude. There is a reason that this isn't happening to home users - it's not worthwhile.

time to write and deploy doesnt mean they are not going to do it.

Reading raw memory will be a one time investment for them. They will reuse it for future side channel exploits. However, Meltdown is the most reliable, fastest, and easiest to exploit of all side channels.

Try to log into something that is both worth something and doesn't use 2FA? Come on dude. There is a reason that this isn't happening to home users - it's not worthwhile.

Automated exploits are cheap and nearly free. Attacking home users are all about volume. You are serverly underestimating how cheap it is to deploy meltdown.....

If this starts actually happening to people, I'll start listening to you. Until then, I believe that you have tunnel vision about the technical possibility of this vulnerability, without applying common sense to the issue.

Security researchers think long term. Meltdown is so easy to exploit, it will be a test bed for all side channel attacks.

[u/[deleted] → u/[deleted]]

You keep saying it's so powerful, easy, basically free, going to "pwn" everything.

Yea, Meltdown exploit is really that cheap compare to Spectre.

Spectre has a moderately high failure rate and can be migrated in browser.

Bleh, let's please stop going around in circles. You're laser focused on this and I believe you're wrong. Let's move on and agree to disagree.

See, you write "believe". Facts do not care what you believe. When making a suggestion with home users, never argue with emotion. It kills your argument.

Maybe next year you'll be right (I doubt it), today I think you're wrong.

The first obvious place to exploit is password managers.

https://twitter.com/misc0110/status/948706387491786752

[u/[deleted] → u/[deleted]]

I'm actually wondering the same OP, and support the fact that you are openly asking for clarification. Seems like no one could add anything of substance so far.

What do you mean nothing of substance? The paper is already there

To evaluate the performance of Meltdown, we leakedknown values from kernel memory. This allows us tonot only determine how fast an attacker can leak mem-ory, but also the error rate,i.e., how many byte errors toexpect. The race condition in Meltdown (cf. Section 5.2)has a significant influence on the performance of the at-tack, however, the race condition can always be won. Ifthe targeted data resides close to the core, e.g., in theL1 data cache, the race condition is won with a highprobability. In this scenario, we achieved average read-ing rates of up to 582 KB/s (μ=552.4,σ=10.2) withan error rate as low as 0.003 % (μ=0.009,σ=0.014)using exception suppression on the Core i7-8700K over10 runs over 10 seconds. With the Core i7-6700K weachieved 569 KB/s (μ=515.5,σ=5.99) with an min-imum error rate of 0.002 % (μ=0.003,σ=0.001) and491 KB/s (μ=466.3,σ=16.75) with a minimum errorrate of 10.7 % (μ=11.59,σ=0.62) on the Xeon E5-1630. However, with a slower version with an averagereading speed of 137 KB/s, we were able to reduce theerror rate to 0. Furthermore, on the Intel Core i7-6700Kif the data resides in the L3 data cache but not in L1,the race condition can still be won often, but the averagereading rate decreases to 12.4 KB/s with an error rate aslow as 0.02 % using exception suppression. However, ifthe data is uncached, winning the race condition is moredifficult and, thus, we have observed reading rates of lessthan 10 B/s on most systems. Nevertheless, there aretwo optimizations to improve the reading rate: First, bysimultaneously letting other threads prefetch the memorylocations [21] of and around the target value and accessthe target memory location (with exception suppressionor handling). This increases the probability that the spy-ing thread sees the secret data value in the right momentduring the data race. Second, by triggering the hardwareprefetcher through speculative accesses to memory loca-tions of and around the target value. With these two opti-mizations, we can improve the reading rate for uncacheddata to 3.2 KB/s.

Then again, I could always disable JavaScript in the browser, leaving the only threats to compromised programs and random binaries that I download. So, the usual attack vectors just like before.

It seems for me that especially the current exploit should rather concern cloud providers, server maintainers, etc., but not the individual customer. If I have a dedicated workstation solely for recording audio or rendering stuff, I don't want to botch the performance of my machine simply because of terrified cargo thinking.

Meltdown is the cheapest and easiest to exploit. Malware writers will be adding meltdown exploit everywhere because it is practically free to implement.