STE WILLIAMS

The epidemic of Twitter-based Bitcoin scams took another twist this week as attackers tweeted scams directly from two verified high-profile accounts. Criminals sent posts from both Google’s G Suite account and Target’s official Twitter account.

Cryptocurrency giveaway scams work by offering money to victims. There’s a catch, of course: They must first send a small amount of money to ‘verify their address’. The money in return never shows up and the attackers cash out.

Authenticity is a key factor in these scams. Accounts with verified status shown by a blue tick carry more of that. So it makes sense for attackers to hack verified accounts and then use them to impersonate very high profile people with lots of followers. Elon Musk and Ethereum founder Vitalik Buterin have both been targets for imposters.

On Tuesday, criminals went one better, managing to compromise the official account of Google’s G Suite. This gave them an authentic platform to address the account’s 822,000 followers as Google itself, rather than impersonating it with another hacked account.

The Bitcoin giveaway scam quickly followed, claiming that G Suite was now accepting cryptocurrency payments and offering a total of 10,000 Bitcoins (BTC) to “all community”. The scammers asked for between 0.1 and 2 BTC, and promised to return ten times the amount sent. They also added a bonus: send 1 BTC or more and get an additional 200% back.

Well, with an offer like that, who could say no? Thankfully, everyone. A quick look at the address posted in the scam revealed no transactions at the time of writing. This is probably because Google removed the post quickly after spotting what had happened.

The same couldn’t be said for readers of Target’s Twitter feed, which was hit by a similar attack the same day. The address used in the Target hack was also used in an attack earlier this week on Elon Musk. Unlike the Target and G Suite accounts, though, Musk’s wasn’t hacked. Instead, the criminals hacked the @farahmenswear Twitter account, which has verified status, and then changed the name on the account to resemble Musk’s.

Altogether, the Musk/Target scammers scooped 5.86 BTC, amounting to $32,700 as of yesterday’s exchange rate. Yesterday afternoon, the crooks began cashing out, sending money from the scam Bitcoin address to others.

These are the latest in a long string of cryptocurrency frauds perpetrated on Twitter that the company has struggled to contain. It banned the use of Elon Musk handles in July, in a bizarre game of whack-a-mole which parodists and criminals alike – including this week’s scammer – easily won by using slightly different characters in Musk-like names.

In September, CEO Jack Dorsey testified before Congress that blockchain technology itself may be a solution to the rampant scams on the network. He said:

So blockchain is one that I think has a lot of untapped potential, specifically around distributed trust and distributed enforcement, potentially.

We haven’t gone as deep as we’d like just yet in understanding how we might apply this technology to the problems we are facing at Twitter but we do have people within the company thinking about it today.

That’s a statement of interest, not a solution.

Account owners have their part to play, too. It isn’t clear whether Google and Target were using two-factor authentication, which Twitter launched in basic form in 2013 and updated to support Authenticator apps in 2017. If they were, then the hackers somehow got around it. If they were not, then why not?

While Twitter continues to try and work this problem out, it’s advisable for everyone who uses Twitter (and any other site that has the option) to turn on 2FA – and avoiding giving money to strangers!

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/WcTLZFlZluA/

Whether you’re sussing out vulnerabilities or defending enterprise networks, Black Hat Europe’s lineup of Briefings, Trainings, and Arsenal tools will help you take things to the next level.

Network defense is a fundamental aspect of cybersecurity, so if you’re attending Black Hat Europe in London next month consider making time to check out some of the latest techniques and tools at this premier information security event.

In Stage 2 Security’s AWS Azure Exploitation: Making The Cloud Rain Shells! Training, attendees will get valuable insight into how to apply modern penetration testing skills to cloud-centric networks and environments. This fast-paced, hands-on course is designed to equip you with the tools, tactics, and techniques you need to infiltrate and expand access within remote networks, which are ever more common in today’s cloud-centric world.

Hone your network pentesting skills at Pentesting Academy’s Active Directory Attacks For Red And Blue Teams Training, which will demonstrate how to attack the modern Active Directory environment using built-in tools like PowerShell and other trusted OS resources. This is important because AD often forms the backbone of the complete enterprise network, and to secure such networks against bad actors it’s critical to understand AD and the different techniques and attacks used against it.

Speaking of Active Directory attacks, The University of Tokyo will be presenting a Briefing on Real-Time Detection of Attacks Leveraging Domain Administrator Privilege  You’ll learn how attackers targeting the Active Directory try to take over Domain Administrator privilege and create a backdoor which disguises them as arbitrary legitimate accounts, in order to obtain long-term administrator privilege. This Briefing will also introduce you to a real-time detection method for attack activities leveraging Domain Administrator privilege (including Golden Tickets) by using Domain Controller Event logs.

In Gigamon’s Network Defender Archeology: An NSM Case Study in Lateral Movement with DCOM, Black Hat Europe attendees will learn to combat attackers making malicious use of Windows’ Component Object Model (COM) and Distributed Component Object Model (DCOM) systems. This Briefing will showcase how DCOM can be used as a lateral movement technique by antagonists, and provide a methodical walkthrough of the technique from both the attacker and defender perspectives.

Also, make time to swing by the Black Hat Europe Arsenal and check out some useful new network protection tools, including LMYN: Let’s Map Your Network. Network security depends on you having a complete picture of all the systems which are connected to your network, and LMYN aims to provide (using basic network commands like traceroute, ping scans, etc.) an easy-to-use interface with which security engineers and network administrators can map their domains in graphical form with zero manual error.

If you’re concerned about wireless network breaches, check out the Drosera: Using Wireless Honeypot to Protect Wireless Networks Arsenal demo. Drosera is a wireless honeypot platform for discovering wireless intrusion attacks and identifying intruders. When an attacker takes the bait and goes after a Drosera-protected honeypot network, Drosera will record all actions before and after the attacker connects to the network, including the process of attempting to connect to the network at the 802.11 frame level. Drosera can accurately identify the attack, and, what’s more, it can help you get information about who’s attacking your network(s), how they’re doing it, and how good they really are.

Black Hat Europe returns to The Excel in London December 3-6, 2018. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/learn-how-to-better-protect-your-network-at-black-hat-europe/d/d-id/1333272?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Secure code development should be a priority, not an afterthought, and adopting the software development life cycle process is a great way to start.

The increasing dependence on software in every aspect of our lives makes us more vulnerable to cybercrime. Not only are breaches getting more ingenious and frequent, but they are also getting more expensive in terms of cost and damage to reputation. The average cost of a data breach is $3.86 million, up 6.4% from last year. Even more unnerving: 60% of small companies go out of business within six months of an attack.

Organizations are actively responding to the rising threats — $1 trillion is expected to be spent globally on cybersecurity from 2017 through 2021, according to Cybersecurity Ventures. However, for cybersecurity to successfully thwart attacks, we need to be proactive in patching code as it is developed rather than being reactive and fixing it after deployment. What’s required is a multipronged strategy with security built in, in a sustainable manner from the first line of code.

The secure software development life cycle (SDLC) process is gaining ground as an effective methodology to do precisely that by integrating activities such as penetration testing, code review, and architecture analysis into the SDLC.

What Is a Secure SDLC?
Here is a quick visual snapshot of the Secure SDLC:

Why Is the Secure SDLC a Necessity? 
Vulnerabilities that creep into software because of minor kinks and overlooked aspects can be successfully dealt with only when security becomes a continuous concern. The Secure SDLC does that — and more. Here are three key areas where the Secure SDLC shines.

#1 Creates a Security-focused Culture
The Secure SDLC provides a practical framework to realize a security-focused culture.

#2 Mitigates Risks
Baking security in from requirements gathering and design leads to more predictable deployments, fewer rollbacks, and higher customer satisfaction.

#3 Cost Benefits
It is almost 100 times more expensive to fix security flaws in deployed software than during the requirements stage, thus reducing a project’s overall expense.

Tips to Implement the Secure SDLC

Select a Secure SDLC Model
The first step to implementing the Secure SDLC is picking a model. Here are some commonly used models:

•  OWASP’s S-SDLC
•  MS SDL
•  NIST 800-64

Get Buy-in, Train, and Champion
After finalizing your methodology, the next step is to get buy-in, train, and champion. As with the adoption of any other organizationwide process change, for it to be a success, the triad of executive buy-in, companywide training and dedicated security champions are a must.

While stakeholder buy-in is needed to drive change across the various teams, developer, tester, and analyst buy-in is critical for Secure SDLC, too, because it fundamentally alters the way they develop, test, and analyze. Those three groups need to fully grasp the benefits of including security and testing right from the nascent stages. Architects, developers, testers, and analysts must be trained to maintain a security-focused “privacy by design” (a GDPR requirement) mentality/development process that infuses security from the time requirements are gathered. Some ways include:

● Architects and analysts need to perform architecture reviews and threat modeling. Using tools like the OWASP Top Ten, they must understand critical web application security risks. Decisions about the design and app infrastructure — technology, frameworks, and languages — need to be made with regulatory considerations and possible vulnerabilities in mind.

● Developers should add security code testing and security plug-ins to their daily coding routine/IDE. They need to adopt secure coding standards, static code analysis, and unit testing along with peer code reviews during the development stage. Checks should be put in place to update software, libraries, and tools on a regular basis to address vulnerabilities.

● Quality analysts need to thoroughly execute test plans with the help of automated testing tools and perform penetration testing on the final product.

● While the Secure SDLC can be kick-started with security champions, a dedicated software security group is a must for a sustainable implementation. It is an effective way to educate, assess, and enforce established security measures across the organization.

Building a Culture of Security
Secure code development should be a priority, not an afterthought. The benefits are significant and well worth the additional time and effort. Building a culture of security with the help of tools, processes, and training, is the strongest offense against the onslaught of malware, spyware, viruses, worms, Trojans, adware, and ransomware.

Related Content:

• 12 AppSec Activities Enterprises Can’t Afford to Skip
• RIP, ‘IT Security’
• 5 Things the Most Secure Software Companies Do (and How You Can Be Like Them)
• Not Every Security Flaw Is Created Equal

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Brian Rutledge is a Certified Information Systems Security Professional (CISSP) in the cybersecurity industry for more than 20 years. He’s currently the security and compliance engineer at Spanning, driving all audit compliance initiatives and managing the company’s overall … View Full Bio

Article source: https://www.darkreading.com/risk/from-reactive-to-proactive-security-as-the-bedrock-of-the-sdlc/a/d-id/1333255?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In addition, most have “unacceptable” privacy policies and “non-existent user support.”

Mobile VPNs are raising major privacy concerns as researchers find more than 50% of free VPN apps on Apple’s App Store and Google Play are from Chinese developers or owned by China.

Simon Migliano, head of research at Metric Labs, which runs the Top10VPN portal, says researchers analyzed the top 20 free apps displayed in the search results for VPN in the App Store and Play Store within the UK and US. This ultimately led to a list of 30 apps, considering the overlap between the stores and locales, he explains in a blog post on his findings.

They found 59% (17 apps) had links to China and 86% had “unacceptable” privacy policies and “non-existent user support.” Privacy issues discovered among VPN apps included lack of detail around logging policies, generic policies with no VPN-specific terms, no policy at all, and/or tracking user activity or sharing it with third parties. Several apps’ privacy policies explicitly stated they share data with China, Migliano says, pointing to privacy issues.

“Our investigation uncovered that over half of the top free VPN apps either had Chinese ownership or were actually based in China, which has aggressively clamped down on VPN services over the past year and maintains an iron grip on the internet within its borders,” he states.

More than half (55%) of privacy policies were “hosted in an amateur fashion” in free WordPress sites with ads or in plain text files on Pastebin. Sixty-four percent of apps had no dedicated website, and several had no online presence beyond their app store listing.

VPNs are among the most-searched apps in the world, with hundreds of millions of installs collectively worldwide, Migliano explains. Some of the most common with Chinese ownership, as acknowledged in his post, include TurboVPN, Snap VPN, VPN Proxy Master, X-VPN, and VPN 360.

Read more details here.

 

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/risk/more-than-50--of-free-mobile-vpn-apps-have-chinese-ties/d/d-id/1333278?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Yoshitaka Sakurada, who recently took on the role after a cabinet shuffling, says it’s up to the government to deal with it.

The debate over whether computer or security expertise should dominate a CISO’s credentials is long, but rarely has someone tilted the balance as far as Yoshitaka Sakurada, cybersecurity strategy chief for the Japanese government. Sakurada says he’s never used a computer.

The revelation came in response to a question from a lawmaker in the lower house of the Diet. When the lawmaker expressed amazement that the person setting cybersecurity strategy has never used a computer, Sakurada responded, “It’s a matter that should be dealt with by the government as a whole. I am confident that I am not at fault.”

Sakurada became cyber minister in October after a cabinet shuffling in Prime Minister Sinzo Abe’s government.

Read more here.

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/risk-management/japan-cyber-minister-says-he-has-never-used-a-computer/d/d-id/1333280?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Another US government panel has warned of the dangers of over-reliance on Chinese tech vendors: the US-China Economic and Security Review Commission.

The commission released its 2018 annual report today, and in it warned that China’s plans to dominate two key tech sectors – the Internet of Things, and 5G – represented a threat to US critical infrastructure.

The report noted “significant state funding for domestic firms and 5G deployment, limited market for foreign competitors, China-specific technical standards, increased participation in global standards bodies, localisation targets, and alleged cyber espionage and intellectual property theft” as problematic, both in security and competitive terms.

The well-known insecurity of IoT devices, plus their frequent dependence on vendor servers, also got a serve.

China wins one, loses one in US trade spats

READ MORE

The data collected by Things can “reveal information the user did not intend to share”, the report noted, and “US data could be exposed through unsecure [sic] IoT devices, or when Chinese IoT products and services transfer US customer data back to China, where the government retains expansive powers to access personal and corporate data.”

The commission also warned about China’s central role in the global tech supply chain, something highlighted by the huge-if-true (but widely discredited) Super Micro “motherboard tampering” story.

“While not all products designed, manufactured, or assembled in China are inherently risky, the US government lacks essential tools to conduct rigorous supply chain risk assessments,” the report stated, adding that procurement laws and regulations are “often contradictory, and are inconsistently applied.”

The report’s recommendations included getting the Office of Management and Budget to oversee how government agencies manage supply chain risks; possible US Trade Representative action in the World Trade Organisation; and the National Telecommunications and Information Administration and the FCC should be directed to take steps to ensure the security of America’s 5G rollout, and look at whether some kind of new security bureaucracy is needed “to ensure the security of domestic 5G networks.”

That’s just the start: the report also made recommendations about US-China economic relations, China’s agricultural policies, Chinese militarisation (particularly in the South China Sea), the Middle Kingdom’s “Belt and Roads” foreign aid program, and China’s relations with US allies, Taiwan, Hong Kong, and North Korea. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/15/us_government_wary_of_china_tech/

Webcast If you like true crime stories, you already know that at the end the criminal is usually revealed to be someone the victim knew well.

The same is often true of cybercrime. Organisations might put in as many layers of IT security as they can in an attempt to keep the criminals out, but meanwhile the real threat to their precious data could already be inside.

A poorly vetted subcontractor, a privileged client, an employee tempted to steal or another falling for a well-crafted phishing attack all have the potential to cause significant damage simply because they are considered trustworthy and are close to the organisation’s systems and data.

How do you deal with the dangers that your multitude of security measures fail to prevent? And how can you balance the need for pre-emptive action with intrusiveness?

Scenarios

Insider threat incidents can be motivated by a variety of reasons, from mere carelessness to criminal intent and international espionage. Understanding why you might be a target is a start in helping you build an effective insider threat strategy. More important than imagining every possible scenario is analysing how breaches take place. What user behaviours indicate an attempted raid on data? Which risk factors are most important to track?

The more visibility you have into user behaviour, and the better your alerting systems are, the more likely you are to catch an incident in progress and put a stop to it before it causes devastation and lands you in the headlines.

Join our on-demand webcast to hear Simon Sharp from ObserveIT outline his five step programme for dealing with insider threat incidents, from assessment to visibility and enforcement. You will learn about some high-profile cases and how you can prevent anything like them happening to you. The presenter, as ever, is Reg resident expert Jon Collins.

We broadcast live on 22 November at 11am GMT (12pm CET). Sign up right here.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/15/insider_threat_rogue_staff_webcast/

A security researcher recently figured out how to stash the complete works of Shakespeare in a single tweet, which sounds like a really neat way to conceal private data right in public eye…

…but the “hiding place” is pretty obvious once you know what to look for.

You end up with a 64×64 pixel image that weighs in at 2MB, instead of the 10KB or so it would normally be, which could end up attracting the very sort of surveillance attention you were hoping to avoid.

The art of hiding data in plain sight is called steganography – but just how safe is it as a cybersecurity trick?

Here’s what you need to know, all in plain English.

(Watch directly on YouTube if the video won’t play here.)

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/YFRoB-i1-Ws/

The Russian government has denied having anything to do with hacking the US Democratic party in 2016, although in a court filing this week stressed that even if it did break into the DNC’s servers, it is immune from prosecution.

And furthermore the Kremlin claimed America is “one of the most prolific practitioners of cyberattacks and cyber-intrusions on the planet.” So, nerr!

“The [Foreign Sovereign Immunities Act] FSIA provides that foreign sovereign states enjoy absolute jurisdictional immunity from suit unless a plaintiff can demonstrate that one of the FSIA’s enumerated ‘exceptions’ applies,” argued [PDF] the Russian government this week in a New York court in response to a lawsuit from the DNC.

The DNC claims that it was subject to a “military attack” by Kremlin intelligence, causing Russia to argue back that any act of its military is a sovereign action and so therefore it can’t be sued for it.

It’s an amazing defense though one the DNC foresaw. It argued in its initial court paperwork [PDF] that “Russia is not entitled to sovereign immunity because the DNC’s claims arise out of Russia’s trespass onto the DNC’s private servers – a tort allegedly committed in the United States.

“In addition, Russia committed the trespass in order to steal trade secrets and commit economic espionage, two forms of commercial activity undertaken in and directly affecting the United States.”

Of course this being 2018 and Russia, the Putin administration can’t leave it at that, and takes the opportunity to troll the US government by pointing out that the immunity provision is also heavily relied upon by Uncle Sam and its officials abroad.

“The United States benefits significantly from the sovereign immunity that it enjoys (and US officials enjoy) in foreign courts around the world with respect to the United States’ frequency acts of cyber intrusion and political interference,” Russia’s response reads. “As current and former US officials have acknowledged on many occasion, the United States – acting primarily through the National Security Agency (NSA) with the US Department of Defense – is one of the most prolific practitioners of cyberattacks and cyber-intrusions on the planet.”

Besides the point?

And Vlads’ lads are not done with the trolling yet. Seemingly in response to the DNC lawsuit, which paints the hack as a conspiracy between the Trump campaign, Wikileaks, and the Russian government, their response thumbs its nose at the DNC for losing the election.

“These are State-to-State matters,” it says. “The US Executive and US Congress are the proper actors to address this ‘political question’… Significantly neither the Executive nor the US Congress has taken any steps to involve the Judicial Branch in their response. The US Congress has also resisted naive calls over the past decade to create a ‘cyberattack’ exception to the FISA.”

The Russians are not the only trolls in this lawsuit. For some reason, US citizen David Andrew Christenson has taken it on himself to file numerous letters [PDF] to the court over this case, complaining about the DNC, in particular its decision to champion Hillary Clinton rather than Bernie Sanders as its presidential candidate.

Christenson who hails from – you guessed it – Florida, was informed repeatedly by the judge that he had nothing to do with the case, and should take his issues up elsewhere. But after more than 30 letters and having ignored two explicit orders from the judge to stop, the judge finally cut him off [PDF] and said the court wouldn’t entertain any more of his conspiratorial ramblings.

The hack of the DNC’s mail server became a major headache for Democrats during the hotly contested presidential election in 2016, with confidential emails leaked to Wikileaks and used to undermine and embarrass Clinton and her advisers.

An investigation into the cyber-intrusion, which dates back to 2015, revealed that the Kremlin was behind it, and by October 2016 the US government was formally accusing the Russians.

Conspiracy theories

That was followed in July 2018 by a formal indictment against 12 Russian spies who the US Department of Justice named and said worked for Russia’s GRU military intelligence agency. They were charged with conspiracy, money laundering, and identity theft.

Two months before that indictment, however, the DNC sued the Russian government in New York – and pulled in a number of members of the Trump campaign, including Donald Trump himself, campaign managers Paul Manafort and Roger Stone, Trump’s son-in-law Jared Kushner, as well as Wikileaks, and its founder Julian Assange.

It alleges a conspiracy between the Trump campaign, Wikileaks and the Russian government – something that continues to be investigated by special prosecutor Robert Mueller. Mueller is expected to hand down more indictments in the coming weeks. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/13/russia_immune_dnc_hack/

Computer security researchers have uncovered yet another set of transient execution attacks on modern CPUs that allow a local attacker to gain access to privileged data, fulfilling predictions made when the Spectre and Meltdown flaws were reported at the beginning of the year.

In short, these processor security flaws can be exploited by malicious users and malware on a vulnerable machine potentially to lift passwords, encryption keys, and other secrets, out of memory that should be off-limits. To date, we’re not aware of any software nasties exploiting these holes in the wild, but nonetheless they have been a wake-up call for the semiconductor industry, forcing redesigns of silicon and changes to toolchains.

The bit boffins responsible for uncovering these latest vulnerabilities – Claudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp, Benjamin von Berg, Philipp Ortner, Frank Piessens, Dmitry Evtyushkin, and Daniel Gruss, from Graz University of Technology, imec-DistriNet at KU Leuven, and the College of William and Mary – include some of the same computer scientists who discovered the original Spectre and Meltdown weaknesses.

They argue that the term “transient execution” is preferable to other terminology like “speculative execution” to describe the Spectre, Meltdown, and Foreshadow attacks.

“‘Speculative execution’ is often falsely used as an umbrella term for attacks based on speculation of the outcome of a particular event (i.e., conditional branches, return addresses, or memory disambiguation), out-of-order execution, and pipelining,” they explain in a paper distributed through ArXiv on Tuesday.

“However, Spectre and Meltdown exploit fundamentally different properties of CPUs. A CPU can be vulnerable to Spectre but not Meltdown (e.g. AMD), and vice versa. The only common property of both attacks is that they exploit side effects within the transient execution domain, i.e., within never-committed execution.”

The not-so-magnificent seven

The researchers describe seven new transient execution attacks, consisting of two new Meltdown variants (Meltdown-PK on Intel, and Meltdown-BR on Intel and AMD) and five new Spectre branch predictor mistraining strategies for previously disclosed flaws known as Spectre-PHT (Bounds Check Bypass) and Spectre-BTB (Branch Target Injection). They say they’ve responsibly disclosed their findings to chip vendors.

Where Spectre exploits branch prediction to gain access to transient data, Meltdown bypasses the isolation between applications and the operating system by evaluating transient out-of-order instructions following a CPU exception to read kernel memory.

Previously, there were five publicly disclosed Meltdown variants: Meltdown-US (Meltdown), Meltdown-P (Foreshadow), Meltdown-GP (Variant 3a), Meltdown-NM (Lazy FP), and Meltdown-RW (Variant 1.2).

The researchers propose two more: Meltdown-PK and Meltdown-BR.

The Meltdown-PK attack can defeat a defense in Intel Skylake-SP server chips called memory-protection keys for user space (PKU), which lets processes alter the access permissions of a page of memory from user space, without a syscall/hypercall.

Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign

READ MORE

“Meltdown-PK shows that PKU isolation can be bypassed if an attacker has code execution in the containing process, even if the attacker cannot execute the wrpkru instruction (e.g., due to blacklisting),” the researchers explain. “Moreover, in contrast to cross-privilege level Meltdown attack variants, there is no software workaround. Intel can only fix Meltdown-PK in new hardware or possibly via a microcode update.”

Meltdown-BR provides a way to bypass bound checks, which raise exceptions when an out-of-bound value is found. It exploits transient execution after such an exception to capture out-of-bounds secrets that wouldn’t otherwise be accessible.

The researchers demonstrated their attack on an Intel Skylake i5-6200U CPU with MPX support, an AMD 2013 E2-2000 and an AMD 2017 Ryzen Threadripper 1920X. They note this is the first time a Meltdown-style transient execution attack has been shown to be able to take advantage of delayed exception handling on AMD hardware.

As for the novel approaches to mistraining the branch predictor in Spectre-PHT and Spectre-BTB attacks, the researchers tested their proof-of-concept exploits on Intel Skylake i5-6200U and Haswell i7-4790, on AMD Ryzen 1950X and a Ryzen Threadripper 1920X, and on an Arm-based NVIDIA Jetson TX1.

All vendors have processors that are vulnerable to these variants, they claim. The same, they say is true for Spectre-BTB, though they consider potential attack scenarios far more limited. Presently, no CVEs for these issues have been assigned.

La la la we can’t hear you!

In a statement emailed to The Register, an Intel spokesperson brushed off the findings. “The vulnerabilities documented in this paper can be fully addressed by applying existing mitigation techniques for Spectre and Meltdown, including those previously documented here, and elsewhere by other chipmakers,” Intel’s spokesperson said.

“Protecting customers continues to be a critical priority for us and we are thankful to the teams at Graz University of Technology, imec-DistriNet, KU Leuven, and the College of William and Mary for their ongoing research.”

Arm’s spokesperson said, “The recent Spectre and Meltdown vulnerabilities identified by academic researchers can be addressed by applying existing mitigations as described previously in Arm’s white paper found here.”

AMD did not immediately respond to a request for comment.

The chip vendors’ insistence that they’re not affected contradicts the researchers’ published statements. “Even with all mitigations enabled, we were still able to execute Meltdown-BR, Meltdown-PK, and Meltdown-RW,” they state in their paper, adding that “some transient execution attacks are not successfully mitigated by the rolled out patches and others are not mitigated because they have been overlooked.”

Complicating the security picture, some people have taken to disabling established mitigations because they hinder performance too much. Daniel Gruss, assistant professor at Graz University of Technology one of the researchers, said via Twitter than one of the points of the paper is to push for better fixes to resolve the root cause of transient execution attacks.

PortSmash attack blasts hole in Intel’s Hyper-Threading CPUs, leaves with secret crypto keys

READ MORE

As was suggested when Spectre and Meltdown were first disclosed, better fixes may mean redesigned hardware. In a statement emailed to The Register, Cody Brocious, a security researcher at HackerOne, said, “As long as speculative execution is performed in processors, this type of bug will continue to be discovered. It’s impossible to perform operations without side-effects on a hardware level, and abstractions that pretend such operations are side-effect-free and always going to cause security issues.”

While a remote Spectre attack called NetSpectre has been proposed by other researchers, these latest techniques appear to be local threats for the time being.

“Remote attacks are very difficult to mount for now,” said Gruss in an email to The Register.

“The threat from transient-execution attacks did not change in any way with this publication. The main thing we tried to contribute to the community was a clear way to analyze and categorize new variants, a clear way to validate and analyze defense techniques. So, this is what changed: Now we can better assess what specific defense techniques offer.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/14/spectre_meltdown_variants/