SoylentNews

New Intel MDS attacks: RIDL and Fallout

posted by martyb on Wednesday May 15 2019, @03:07AM   
from the need-more-patches dept.

inertnet writes:

The RIDL and Fallout speculative execution attacks allow attackers to leak confidential data across arbitrary security boundaries on a victim system, for instance compromising data held in the cloud or leaking your information to malicious websites.

[...] RIDL (Rogue In-Flight Data Load) shows attackers can exploit MDS (Microarchitectural Data Sampling) vulnerabilities to mount practical attacks and leak sensitive data in real-world settings.

[....] Fallout demonstrates that attackers can leak data from Store Buffers, which are used every time a CPU pipeline needs to store any data. Making things worse, an unprivileged attacker can then later pick which data they leak from the CPU's Store Buffer.

---

Original Submission

• "independently discovered and reported" "independently discovered and reported" (Score: 3, Insightful) by RamiK on Wednesday May 15 2019, @11:34AM (1 child)

  by RamiK (1813) on Wednesday May 15 2019, @11:34AM (#843780)

  RIDL attacks were independently discovered and reported by:

          Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida at VUSec.
          Giorgi Maisuradze at CISPA.

  Fallout attacks were independently discovered and reported by:

          Marina Minkin at University of Michigan, Daniel Moghimi at Worcester Polytechnic Institute, Moritz Lipp, Michael Schwarz at Graz University of Technology, Jo Van Bulck at KU Leuven, Daniel Genkin at University of Michigan, Daniel Gruss at Graz University of Technology, Berk Sunar at Worcester Polytechnic Institute, Frank Piessens at KU Leuven and Yuval Yarom at University of Adelaide and Data61.

  That we know. With so many parties finding out about these independently, it's not unreasonable to assume governments and black-hats been exploiting them for years.

  --
  compiling...

  Starting Score:	1		point
  Moderation		+1
  Insightful=1, Total=1
  Extra 'Insightful' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		3

• Re:"independently discovered and reported" (Score: 2) by RamiK on Wednesday May 15 2019, @11:36AM

  by RamiK (1813) on Wednesday May 15 2019, @11:36AM (#843782)

  Almost forgot:

  MDS-class vulnerabilities were also reported by (in alphabetical order):

          Dan Horea Lutas' team at BitDefender.
          Daniel Gruss, Michael Schwarz, Moritz Lipp at TU Graz and Jo Van Bulck (imec-DistriNet, KU Leuven)
          You can find more details about their research at ZombieLoadattack.com
          Analysis done in collaboration with Ahmad "Daniel" Moghimi (Worcester Polytechnic Institute), Julian Stecklina, Thomas Prescher (Cyberus Technology)
          Lei Shi at QiHoo 360.
          Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco at Intel.
          Matt Miller, Brandon Falk at Microsoft.
          Volodymyr Pikhur .

  Winning.

  --
  compiling...

  Parent