Jonathan Care’s Post

Modern CPUs from Intel, including Raptor Lake and Alder Lake, have been found vulnerable to a new side-channel attack that could be exploited to leak sensitive information from the processors. The attack, codenamed Indirector by security researchers Luyi Li, Hosein Yavarzadeh, and Dean Tullsen, leverages shortcomings identified in Indirect Branch Predictor (IBP) and the Branch Target Buffer (BTB) to bypass existing defenses and compromise the security of the CPUs. "The Indirect Branch Predictor (IBP) is a hardware component in modern CPUs that predicts the target addresses of indirect branches," the researchers noted. "Indirect branches are control flow instructions whose target address is computed at runtime, making them challenging to predict accurately. The IBP uses a combination of global history and branch address to predict the target address of indirect branches." https://lnkd.in/grZSb8dv

Modern CPUs from Intel, including Raptor Lake and Alder Lake, have been found vulnerable to a new side-channel attack that could be exploited to leak sensitive information from the processors. The attack, codenamed Indirector by security researchers Luyi Li, Hosein Yavarzadeh, and Dean Tullsen, leverages shortcomings identified in Indirect Branch Predictor (IBP) and the Branch Target Buffer (BTB) to bypass existing defenses and compromise the security of the CPUs. https://lnkd.in/gduiePnR

Future Intel, AMD and Arm CPUs Vulnerable to New ‘SLAM’ Attack: Researchers: Security features that major CPU vendors plan on integrating into their future products can increase the surface for certain types of attacks. The post Future Intel, AMD and Arm CPUs Vulnerable to New ‘SLAM’ Attack: Researchers appeared first on SecurityWeek.

Another side-channel attack. Intel, Arm and AMD CPUs are vulnerable to exploitation of the Linear Address Masking (LAM) feature aka Upper Address Ignore (UAI) or Top Byte Ignore (TBI) in AMD and Arm parlance respectively. "While LAM is presented as a security feature, the study found that it ironically degrades security and "dramatically" increases the Spectre attack surface, resulting in a transient execution attack, which exploits speculative execution to extract sensitive data via a cache covert channel." https://lnkd.in/dM5qegCf

New GoFetch attack on Apple Silicon CPUs can steal crypto keys A new side-channel attack called "GoFetch" impacts Apple M1, M2, and M3 processors and can be used to steal secret cryptographic keys from data in the CPU's cache. The attack targets constant-time cryptographic implementations using data memory-dependent prefetchers (DMPs) found in modern Apple CPUs. This allows it to recreate the private cryptographic keys for various algorithms, including OpenSSL Diffie-Hellman, Go RSA, CRYSTALS Kyber, and Dilithium from the CPU's cache. https://lnkd.in/en25fw64 Contact us now: info@simplysecuregroup.com #cybersecurity #simplysecure #simplysecuregroup #tech #cybersecurityteam #business

Intel has released fixes to close out a high-severity flaw codenamed Reptar that impacts its desktop, mobile, and server CPUs. Tracked as CVE-2023-23583 (CVSS score: 8.8), the issue has the potential to "allow escalation of privilege and/or information disclosure and/or denial of service via local access." Successful exploitation of the vulnerability could also permit a bypass of the CPU's

New Intel CPU Vulnerability 'Indirector' Exposes Sensitive Data https://ift.tt/DvZQKdX Jul 02, 2024NewsroomHardware Security / Vulnerability Modern CPUs from Intel, including Raptor Lake and Alder Lake, have been found vulnerable to a new side-channel attack that could be exploited to leak sensitive information from the processors. The attack, codenamed Indirector by security researchers Luyi Li, Hosein Yavarzadeh, and Dean Tullsen, leverages shortcomings identified in Indirect Branch Predictor (IBP) and the Branch Target Buffer (BTB) to bypass existing defenses and compromise the security of the CPUs. "The Indirect Branch Predictor (IBP) is a hardware component in modern CPUs that predicts the target addresses of indirect branches," the researchers noted. "Indirect branches are control flow instructions whose target address is computed at runtime, making them challenging to predict accurately. The IBP uses a combination of global history and branch address to predict the target address of indirect branches." The idea, at its core, is to identify vulnerabilities in IBP to launch precise Branch Target Injection (BTI) attacks – aka Spectre v2 (CVE-2017-5715) – which target a processor's indirect branch predictor to result in unauthorized disclosure of information to an attacker with local user access via a side-channel. This is accomplished by means of a custom tool called iBranch Locator that's used to locate any indirect branch, followed by carrying out precision targeted IBP and BTP injections to perform speculative execution. Intel, which was made aware of the findings in February 2024, has since informed other affected hardware/software vendors about the issue. As mitigations, it's recommended to make use of the Indirect Branch Predictor Barrier (IBPB) more aggressively and harden the Branch Prediction Unit (BPU) design by incorporating more complex tags, encryption, and randomization. The research comes as Arm CPUs have been found susceptible to a speculative execution attack of their own called TIKTAG that targets the Memory Tagging Extension (MTE) to leak data with over a 95% success rate in less than four seconds. The study "identifies new TikTag gadgets capable of leaking the MTE tags from arbitrary memory addresses through speculative execution," researchers Juhee Kim, Jinbum Park, Sihyeon Roh, Jaeyoung Chung, Youngjoo Lee, Taesoo Kim, and Byoungyoung Lee said. "With TikTag gadgets, attackers can bypass the probabilistic defense of MTE, increasing the attack success rate by close to 100%." In response to the disclosure, Arm said "MTE can provide a limited set of deterministic first line defenses, and a broader set of probabilistic first line defenses, against specific classes of exploits." "However, the probabilistic properties are not designed to be a full solution against an interactive adversary that is able to brute force, leak, or craft arbitrary Address Tags." Found this article interesting? F...

Modern Intel processors, including chips from the Raptor Lake and the Alder Lake generations are susceptible to a new type of a high-precision Branch Target Injection (BTI) attack dubbed 'Indirector,' which could be used to steal sensitive information from the CPU. Indirector exploits flaws in Indirect Branch Predictor (IBP) and Branch Target Buffer (BTB), two hardware components found in modern Intel CPUs, to manipulate speculative execution for data extraction. Three researchers at the University of California, San Diego discovered and presented the Indirector attack, with full details to be presented at the upcoming USENIX Security Symposium in August 2024. #cybersecurity #intel #flaw

New TikTag Attack Targets Arm CPU Security Feature : Researchers have targeted the MTE security feature in Arm CPUs and showed how attackers could bypass protections. The post New TikTag Attack Targets Arm CPU Security Feature  appeared first on SecurityWeek.

AMD processors also plagued by significant security flaw. "Swiss researchers have found holes in AMD Ryzen processor security. AMD has outlined the newly uncovered "Inception" attack in its official CVE-2023-20569 bulletin. Like some of the most infamous CPU vulnerabilities, Inception is a speculative side channel attack, which can possibly lead to privileged data leakage to unprivileged processes. At the time of writing AMD is not aware of any Inception exploits outside of security research circles. Unfortunately for AMD and its users, Inception affects the latest AMD Ryzen processor families based on Zen 3 and Zen 4 cores — across data center, desktop, HEDT, and mobile. However, we must be thankful that, as details of Inception go live, mitigations are in the pipeline." #security #AMD #Ryzen #processors #hardware https://lnkd.in/eFypEgpK.