-
Posts
1,160 -
Joined
Content Type
Profiles
Forums
Events
Bug Tracker
Applications
Status Updates posted by Maverick
-
There was once a man, a man so colorful and dark as the darkness that lived upon us in Space.
He was the darkest of the dark, he was the most cheerful of the cheerful and the most vainglorious soul there is.
One day the darkest of the dark soul couldn't handle the two friends who he hung out with, Light and Moon. The darkest of the dark couldn't handle the synergy that was being thrown his way and decided to join the lowest of the ground, the ground of nothing where he began his journey to climb into the silver city, only to be shun down multiple times.
He the darkest of the dark decided to end his journey by betraying his two greatest friends only to become the most disgraceful thing - the disgraceful thing was joining the lowest of the low to achieve something.
His friends changed his title "the darkest of the darkest" to the "lowest of 'em all". He was too much of a crying soul, he wanted his friends back - but story has it that he's no longer able to serve the friends, and was banished into the realms where the slums and dogs live now.
The disgraceful grounds is what the Kings Order called them.
Fairy tales are nice. Isn't that right, @Leandro?
- Story ends here.
- Based on some event.
- Ground-S.
-
Happy 50th birthday!
I know how you young people are. Like to drop it like it's hot in the club.
Reported btw.
-
Hello, Witch.
It has come to my attention that you're casting spells without permissions and I am going to have to take your wand away.
Now stop it.
-
Leandra is a stealer. Did you know that?
Also! I am really a Vampire, and you’re a Witch! Master of the dark arts.
- Show previous comments 6 more
-
lQN4u0GfYbzHdO08hoiOKVJuVJ5DTpbG6xENWvCWWmw @Maverick
-
Overview of Meltdown and Spectre
You have probably heard the news of new vulnerabilities that affect most major chipsets,
including Intel, Arm, and AMD. This means that the vulnerability affects nearly everyone
who owns a computing device.
What is the vulnerability?
The vulnerability affects how systems isolate sensitive data in memory. Exploiting the
vulnerability could allow an attacker to gain access to data such as passwords, encryption
keys, or potentially data from other virtual systems on the same server.
Right now there are two specific vulnerabilities being dubbed Meltdown and Spectre.
Meltdown: This vulnerability is the easiest to exploit and the one getting the most
attention. It primarily affects the Intel chipset and is current being addressed with
operating system level patches from Microsoft, Apple and various Linux distributions. It
works by using a method called "speculative execution" to infer values in protected memories. This vulnerability has been assigned CVE-2017-5754
Who is affected?
Basically anyone with a computer. This would include local devices you use like laptop and
desktop computers, but also potentially your phones and tablets, as well as IoT devices. It
also includes servers and services you may visit as well, most notably cloud systems that
offer virtualization. The vulnerability has been verified to work on chipsets going back to at
least 2011 and likely affect CPUs going back as far as 1995.
Most at risk right now are systems using the Intel chipset as they are the easiest to exploit,
and the first proof-of-concept exploits are being released target Intel. This means that your
laptop is probably more at risk than your phone, for now.
How can this be attacked?
To exploit these vulnerabilities, an attacker would need to execute code on a local system.
This could be performed in a variety of ways. Being locally logged in, even as a low-level or
nearly unprivileged user, would allow the attacker to launch the attack. Attackers could also
launch the attack remotely if they can get malicious code executed on a local system. This
could take the form of downloaded malware and malware pushed via malicious websites or
even through malicious documents.
Has it been attacked "in the wild"?
Nothing has been detected as being exploited in the wild so far. Since these vulnerabilities
have been disclosed by security researchers rather than being discovered in an active
attack, it's likely that attackers were not aware of these vulnerabilities until everyone else.
This will quickly change however, as proof-of-concept exploits are already being written and
floated around the internet. It is probably only a matter of time until we see these
vulnerabilities exploited in malware and local attacks.
What is the solution?
Since these issues are hardware related and vary widely dependent on specific software,
complete fixes will be complex and likely take a while to get here. Luckily while Meltdown is
easier to exploit, it's also easier to address. And while Spectre is a harder problem to patch,
it is also much harder to exploit (right now).
Currently OS vendors like Microsoft, Apple and Linux are releasing patches that will provide
protection against Meltdown attacks. These patches work by removing shared kernel
mapping which prevents the ability to predict values in protected memory. Unfortunately, by
removing this feature, a lot of processing efficiency is removed as well. This will result in
some performance decrease for those systems. What that decrease is will depend on how
heavily software relies on this memory access, but current estimates suggest anywhere
from a 5%-30% decrease in overall software performance.
Intel has released firmware updates, but some people seem to have a misconception that
firmware updates occur as a simple, generic patch that anyone can download. This is far
from the truth. The biggest problem with the firmware updates that are being released is
that firmware will be vendor and model specific. Intel develops multiple firmware updates for
each different chip. These firmware updates are then distributed to the computer vendors
like HP and Dell who, in turn, have to test and release them to their customers for each
model of computer they sell.
For instance, here's Intel's page on how to get their firmware updates. It basically provides
links to the individual computer vendor's site:
https://www.intel.com/content/www/us/en/support/articles/000025619/software.html
If you look at Dell's linked page, as an example, you can see dozens of updates that are
model dependent:
Adding insult to injury, most firmware updates need to be installed directly on the system
requiring a person physically in front of the machine. Whether you send every user a USB
stick with instructions for installation (and lots of prayer) or you send an IT person to every
terminal, you can see how burdensome and complex the process can become. Even
figuring out which updates are needed for an enterprise fleet of computers of different
vendors and models can be an overwhelming task. Pair this with the need for software
patches, like those from MS, Apple and Linux and every company's IT will be in overdrive
for the foreseeable future over this issue.
In the meantime, all the things we currently recommend to prevent malware apply here.
Avoid suspicious email attachments, documents and websites. Make sure you use long and
complex passwords to prevent unauthorized users from accessing your system and keep
your software up to date with patches.
Additional resources
FAQ and Technical Documents: https://meltdownattack.com/
Round Up of Vendor Responses: https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre-heres-what-intel-apple-microsoft-others-are-doing-about-it
SpiderLabs will be keeping an eye on these vulnerabilities as more information is released.
Original post: https://www.trustwave.com/Resources/SpiderLabs-Blog/Overview-of-Meltdown-and-Spectre/
[UPDATED 1/5: typo correction, expansion of "What is the solution?" section and addition of
"Additional resources" section]
-
First chat on xat to have a mobile background - http://xat.com/xat5
(iPhone 6s users would see the background in better quality vs than other phones).