![]() |
Spectre Next Generation has arrived - and its worse than last time
https://borncity.com/win/2018/05/03/...in-intel-cpus/
I read in German about it yesterday, here now is the first English translation. At least 8 new vulnerabilities of Intel CPUs have been found by German magazine "C'T". They are kept secret in explanations about their design, so that they win some time to catch up with them, but it is said these new vulnerabilities are more dangeorus than the last ones, since they do no longer need special, hard-to-obtain and hard-to-carry-out special knowledge to make use of them. The risk to private users may be a bit smaller than for server service operators, cloud providers and others. The CPUs by Intel are not described as having some holes, but to be "holey like Swiss cheese". I'm so lucky that I use my Intel gaming machine on W10 only for games, and nothing else. Bought in in Nove,mbre, but wiht the revelatiosn of the past 4 months I would never buy Intel again anymore, not for the next couple of years. Too expensive for the risk-package stuff you get. If I would have waited just 6 weeks longer back then... The German article that dropped the bomb yesterday: https://www.heise.de/ct/artikel/Supe...g-4039134.html |
I see that the original German article meanwhile also has been officially translated:
https://www.heise.de/ct/artikel/Excl...s-4040648.html |
Quote:
|
It's the end of the world!!! Aaaahhhh!!!
Seriously, though: I always take as many precautions as I can against this kind of thing, and I will certainly continue to do so. But, you'll have to forgive me if I don't run around like my hair is on fire upon hearing this. It's a serious problem - no doubt about it. I just think people tend to get a little hyperbolic when assessing these kinds of threats. There are many dangers when it comes to your personal information online - and as far as I can tell, there always will be. But, some common sense and a few precautions can go a long way to keeping your data and your finances safer. (I doubt that they will ever be completely safe ... anywhere.) |
If you think this is only about personal data theft, than you have not understood the dimension of the problem. Although personal data theft already is serious enough, when you consider login data for online shops and online banking/brokering, but also your profile: risk evaluation when you ask an insurance company for a policy, getting sniffed out when you ask an employer for a job, targetted advertisement by businesses as well as political parties, social bonus points and bad notes for you when analysis shows that you like or dislike like you should (or should not), and your typed in views being in line or not with the wanted public opinions and views... Look at China, they are doing right this now, it gets reported these days.
Think in terms of enforced remote control of IT infrastructure in cities, traffic infrastructures and institutions, hospitals, energy production - blackmailing, cyber warfare - oh wait - that hospitals get blackmailed by cyber attackers, already is a common practice now it seems. Think in terms of taking over IT hardware - and everything that it controls. Think in terms of bot nets. Like it is said somewhere in the articles: our complete IT infrastruture's security is rotten at the very core level already. And the easier it is to abuse these weaknesses, the more dangerous the situation becomes, and the more likely it becomes that attacks take place. Spectre NG represents such a dramatic simplification, in parts at least. I have read this morning that it got leaked that one of those eight vulnerabilities consists of only four brief lines of code injected in an environment that bases on the use of a VM. What the...? Just four lines of code to spell desaster? It takes years to become a competent fencer and hit your opponent at 1 meter. But every every idiot can shoot and hit with a pistol at 10 meters. Thats why simplifying the execution of Meltdown- and Spectre-based attacks is so dangerous. |
Read the article...
I've seen several "before and after" benchmarks for Linux and Windows. Several processors from Intel, and AMD were tested. Meltdown usually resulted in performance losses, which varied by task. Spectre had performance losses, but not to the degree of Meltdown. (both were mostly I/O task, but some other task as well.) Except for the FX8350, which after a Spectre patch ( I forget which atm), was actually faster on several task... Maybe this is the next performance boost for my PC. :hmmm::haha: This is the list of a search with the word "spectre". https://www.phoronix.com/scan.php?page=search&q=spectre I'll see if I can dig up the benchmarks. Barracuda |
Ehem just to be clear, the thread and my links are about at least eight NEW vulernabilities, not so much about the already known ones. ;)
And it seems to me that it will not stop there. Even less so when considering that the patching so far has introduced knew problems itself, and Microsoft is in open retreat from Windows regarding its quality assurance. The whole hardware philosphy, especially for CPUs, is compromised. New hardware and chips also have to be put in question when considering that they get produced under influence of for exmaple known American and probably also unknown Chinese legislation that demands access for their intel services and thus hardware must and will have wanted security problems and backdoors that already get build into it in the factory. |
Let me break this down...
Quote:
Let *me* be clear. My post was about the 'new' bugs as well, in reference to the known bugs. Quote:
However, IF: Quote:
Quote:
And more recently with Benchmarks used to determine where, and how much performance loss after the patches. This part: Quote:
AND to setup this piece of info: Quote:
Some INTEL and (AMD) Ryzen have Spectre. And all of these suffer performance losses with the patches applied. However . the FX-8350 had a performance _*GAIN*_. I have a FX-8350, I'm typing on it now... SO... Quote:
Joke side: phhbbtttt, patches will slow it down... it didn't last time! Serious side: Well it was warned that it could be a sizable loss, but I actually got a fair gain, when all others did not. We shall see what happens this time. *IF* the patches follow the same "curve", then my FX-8350 could very well get another performance boost. (I'm not saying this next set of patches will, but it is possible.) Quote:
You might find the one I mentioned. Also, you might get an idea of what to expect with any further performance losses/gains. Quote:
So *YOU* can see the results yourself. Now on to the rest of your post: Quote:
As far as Microsoft/Windows, They've had it far worse than Linux has (at least for me), as far as stability and performance is concerned. Quote:
When you put all of your valuables on a shelf acessible from the *outside* of your home, you should not be surprised if (/when) you find them missing. Barracuda |
I did not want to give the impression that these new bugs are resulting from patching the old ones. The lousy patches for Intel CPUs as well as Microsoft microcode of the past 3 months or so just opened problems and technical issues as well - additionally to the old bugs and now new bugs. And quite some people who thought they made everything right when jumping on the initially recommended firmware updates deeply regretted it afterwards, too.
Nichts für ungut...:up: How things have changed. In years long gone by, you were safer when installing new microsoft updates as fast as possible. Nowadays you all too often are far better off if you avoid them as long as you can. My update options are on 30-35-365, and I set my cable connection to "metered". And even these settings are known to have been ignored and bypassed by Microsoft quite often in order to enforce their latest version 1803 on machines of people who did not want to serve in the first line of betatest lambs, but wanted to stick with 1709, or even 1703. Woody's list of what all is wrong with this months' update again, already is impressively long. No change to the past months' list, the past two years' lists. Some current entries are real bummers for those affected. |
Quote:
I got to thinking about it as I was reading your previous post. Subtly and Nuance don't always translate well. So I decided to be "blunt" or "straight on" with my explanations of what I meant. Quote:
(Fedora does have automated test, backed up by user testing for updates.) I'll play Linux native versions of games (example Kerbal Space Program), and/or use WINE. I'm not screwed over by Windows constantly having problems due to Meltdown/Spectre. But this does ruin it for Windows users that just want to use their computer. Which is ultimately, the saddest part of the whole thing. Barracuda |
Linux patches have started landing...
Some of these have links to additional information. Spectre Variants 3A & 4 Exposed As Latest Speculative Execution Vulnerabilities: https://www.phoronix.com/scan.php?pa...ulnerabilities Linux 4.9, 4.14, 4.16 Point Releases Bring SSBD For Spectre V4: https://www.phoronix.com/scan.php?pa...9-To-4.16-SSBD And some early benchmarks: An Initial Look At Spectre V4 "Speculative Store Bypass" With AMD On Linux https://www.phoronix.com/scan.php?pa...-initial&num=1 From the last link: Quote:
Barracuda |
All times are GMT -5. The time now is 05:58 AM. |
Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright © 1995- 2024 Subsim®
"Subsim" is a registered trademark, all rights reserved.