|
|
Subscribe / Log in / New account

The "branch history injection" hardware vulnerability

The "branch history injection" hardware vulnerability

Posted Apr 10, 2024 1:52 UTC (Wed) by Heretic_Blacksheep (guest, #169992)
In reply to: The "branch history injection" hardware vulnerability by snajpa
Parent article: The "branch history injection" hardware vulnerability

The problem with your statement/belief is that the only way you'll know you've been hit by Spectre exploits is if someone discovers the exploit code in the wild, rather than discovering the attacks themselves. Spectre likely won't leave smoking guns in your logs that screams "THIS IS A SPECTRE ATTACK!!!111" unlike most malware in use today.

That's one reason the industry is unaware of such attacks, another being they'd have to be targeted to the hardware revision + bypassing any mitigations in place. It's like the Log4J vulnerability. Attacks have to be semi-targeted for the environment despite the wide spread use of Log4J. Simple for intelligence agencies and some moderately skilled groups. Less so for kiddies that carry out the majority of attacks.

Low hanging fruit: this particular series of attacks generally aren't low enough on the fruit tree to be widely used. There's a lot easier targets out there including and especially the human operators. That means these kinds of attacks are going to be reserved for harder nuts to crack.

Shared resource hardware has been known to be vulnerable to many attacks, both theoretical and practical ever since the first systems became available. It was a deliberate trade off in cost versus security all the way back to the 1960s. Well, now that decision is coming back to bite the industry in the butt, viciously and without remorse. It has nothing to do with planned obsolescence and everything to do with deliberate, calculated decisions made 50+ years ago when data security could be limited to locked rooms and gentleman's agreements not to be evil. Remote access was limited to physical modems and phone lines and easily kept secure with minimal effort.


to post comments


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds