So annoying when researchers stumble over your government backdoor. 😞

@_Safety_Third_

Ай бұрын

☝️

@CommanderRiker0

Ай бұрын

No joke...

@Volvith

Ай бұрын

I wouldn't be surprised if there's a whooole lot of 0days we just don't know about. And by 'we' i mean the common people, us plebs.

@Knowbody42

Ай бұрын

@@Volvith Of course there are. Stuxnet proves this. Using several zero day vulnerabilities and a leaked private key from Realtek.

@Dekatelon

Ай бұрын

it's just one of many...

One day is not a vacation, that's called sleeping in.

@Kane0123

Ай бұрын

When you have a few thousand degenerate pseudo-children in the form of Twitch viewers, any day off would feel like a holiday.

@MegasXaos

Ай бұрын

You mean a weekend?

@kingoffongpei

Ай бұрын

He's making an effort to take more "mini-retirements."

@snooks5607

Ай бұрын

@@MegasXaos less than a weekend

@Kane0123

Ай бұрын

Prime retiring from streaming. It’s official.

Chat message I saw was so funny… > users act worried about a low level vulnerability, meanwhile they're giving league of legends a rootkit

@Volvith

Ай бұрын

Lmao. _If you think it's just league of legends you should look up how many rootkit-access level anticheats/DRM's are employed in the gaming industry._ The best part is they don't even work. Cheaters can literally just sidestep nearly all of them. And what few they can't, they will some time in the future.

@xeqqail3546

Ай бұрын

It's a good thing guys! a reason to finally ditch the game cuz tencent gonna data mine your pc through root kit

@OveRaDaMaNt

Ай бұрын

@@Volvithwhile they are frequently side stepped, they aren't that big of a deal to have on your pc. People have been whining about it for years and yet nothing bad has happened. This is why normies don't even care about that stuff.

@sathalel4084

Ай бұрын

@@OveRaDaMaNt ESEA literally used their kernel level anti cheat as a bitcoin miner. Vangaurd has been shown to cause multiple issues with end user machines crashing them over driver issues. Just because you aren't aware of issues doesn't mean they don't exist.

@moonasha

Ай бұрын

@@OveRaDaMaNt nothing bad has happened? didn't hackers use the rootkit DRM in that one chinese gacha game to install ransomware on people's computers? And then the one that helldivers uses has had loads of bad publicity. And I know these things definitely do interfere with drivers, lots of reports of people's peripherals refusing to work. These things literally tamper with other processes. They don't just read them, they write

much love to the LowLevelLearning drop in for more intel, that was cool

@svenmify

Ай бұрын

It’s not intel, it’s apple

@marss4536

Ай бұрын

@@svenmify i think he meant intelligence

@svenmify

Ай бұрын

@@marss4536 well yeah, obviously

"As an adult, I don't put stickers on my laptop" Tough but fair - I needed to hear this.

@cenobitedk

Ай бұрын

Its so true

@wholesomeducky

Ай бұрын

Putting stickers on stuff has absolutely nothing to do with maturity, it was a trash take from a guy who wanted to take a low swing at many Apple users because “I’m so much better with my Linux laptop, look how mature I am”. There is nothing wrong with putting something fun and whimsical and bringing just a little bit more happiness into your day instead of being a gruff, coffee-chugging grouchy computer engineer. Some of us want to actually be happy

@TALHA-hr6xf

Ай бұрын

@@wholesomeducky You use a mac and put stickers on it? Do you get your fruit cut up into slices with a sippy cup as well lol

@littlemeg137

Ай бұрын

I'm old as dirt and the whole lid of my Thinkpad is stickerbombed.

@jeromemainaud

Ай бұрын

Having stickers on a laptop is a security. It make your computer unique and reduce the risk of substitution (either on purpose or by mistake) when you use it in a public area.

The Meltdown is, basically, this: you say "CPU, take the value at this memory address I don't own, and treat it as the relative address in my current memory space". CPU retrieves the value you don't own, goes to the address in your address space, and fetches it into the cache. And then drops the result because of the security. But! As a 16-bit value can only have 65k variants, you can check which of the 65k memory values in your address space is in the cache - by trying to retrieve it and measuring the response time. The address of it is the value by that address you don't own.

@StinkyCatFarts

Ай бұрын

We know

@MisterAssasine

Ай бұрын

I didnt, this was a very concise explanation which helped me understand the problem@@StinkyCatFarts

@chordogg

Ай бұрын

Thanks! I didn’t watch the video but wanted to know the vulnerability.

@deadchannel8431

Ай бұрын

@@StinkyCatFarts 🤓

@StinkyCatFarts

Ай бұрын

@@deadchannel8431 🤡

Side channel attacks are a fascinating topic. I remember hearing of one where a specific encryption algorithm was cracked for a specific device, because the device had an LED that would blink when data was being written to memory, which would leak the cryptographic keys to an attacker looking at that LED.

@0dsteel

Ай бұрын

and then it evolves into the LED is lit, but when the cpu draws slightly more power for some specific operation, the LED emits slightly less light D:

@juleswernes

Ай бұрын

but the framerate of the security camera was too low, so they used the moving shutter effect to get a time resolution of the energyconsumption

@earthling_parth

Ай бұрын

@@juleswernesI remember seeing a video about that. It was absolutely wild that researchers were able to guess the card keys used by most hotels with a 24fps feed from a run-of-the-mill security camera.

@garystinten9339

Ай бұрын

It's like watching the HDD light on your PC to determine time of operation... You can see the time and rhythm of a bootup and how your computer processes information

"I want on a vacation for a day" is the most American thing ThePrimeagen has ever said.

@Tidbit0123

Ай бұрын

LMAO

@Enhancedlies

Ай бұрын

nail on the head , Americans dont understand

@meanmole3212

Ай бұрын

I WANT on a vacation for a day, as in they don't even get that 1 day off, it is only in their dreams.

Apple knew about this exploit, it's in M1 and M2 chips.M3 chips had a single bit flag added to the hardware to override the prefetch behaviour on demand... they knew. Chip design takes years to get from inception to production, this was found three or four years ago when M3 was a glimmer in Apple's eye...

@TheBswan

Ай бұрын

This does not seem likely. Knowingly doing this would be super illegal and highly risky, and 95+% of users are not going to upgrade to patch a theoretical vulnerability. If your infosec team at work isn't taking away your M1 or M2, they're either incompetent or this isn't a big deal. Caveat I write JavaScript professionally so all this is speculation from a filthy casual.

@framegrace1

Ай бұрын

If they knew, why not fix the issue instead of disabling the whole thing?

@ingodubingo

Ай бұрын

@@framegrace1 $$$

@1DJRikkiBee

Ай бұрын

​@@framegrace1Because if they don't fix it, people will buy both.

@earthling_parth

Ай бұрын

So you're saying that before Apple even released their first M1 chips, they knew about this and still chose to release computing systems with that vulnerable chip in there? Doesn't apple always prioritize your security and privacy though? /s

Spectre and Meltdown described as "back in the day". Hooooo boy.

@zeuglcockatrice4633

Ай бұрын

we gettin old son

@nosleep7026

Ай бұрын

i mean... thats almost 10 years ago

@wafinashwan8242

Ай бұрын

god we old. i have a laptop vulrable by spectre

@codey1391

Ай бұрын

@@nosleep7026 6 years is not almost 10 years

@MrHaggyy

Ай бұрын

Spectre was possible on some high end chips from 2008 and many chips from 2012 onwards but you needed physical access to the socket. In the 2017/2018 breach the problem was that you could do the same things via remote diagnostics if the system was setup for it. Which sadly many chipset-bios-cpu combination were out of factory.

Oh snap, it’s Low Level Learning! He rocks!

@w3w3w3

Ай бұрын

yea fr

It scares me how smart hackers are, and the techniques they have that I would never think to defend against.

@JohnathanMenezes-yb2ux

Ай бұрын

because you don’t have the resources of a major nation state behind you….

@garystinten9339

Ай бұрын

It's just like taking a 3d cube and turning to it looks at the same cube but from a different angle.. basically reordering the information into another outcome based on what info you have and how you want to twist it.

@beofonemind

Ай бұрын

@@garystinten9339 Interesting way to put it, Thank You.

@JeffSherlock

Ай бұрын

Smart or not, its what they do. They that millions of other people used to do things, before computers put them out of business.

Honestly! Super cool that you just plugged lowlevelearning into your stream. 👏👏 nice job with your community prime!

I had someone ask about the stickers on my laptop... I said they're the computer geek version of prison tattoos

@_Safety_Third_

Ай бұрын

I've got an ironic CIA sticker on my laptop. What's that the computer geek version of?

@monad_tcp

Ай бұрын

@@_Safety_Third_ Who knows, but it is not ironic.

@Volvith

Ай бұрын

@@_Safety_Third_ Letting your buddy, who 'totally has like done a lot of tattoos before yo', tattoo a d*ck on your forehead.

@icodestuff6241

Ай бұрын

@@_Safety_Third_ blood gang tattoos

@karmatraining

Ай бұрын

That's funny

You are the PRIME source of tech news. I love coming back to your videos EGEAN and EGEAN

@Eldarlll

Ай бұрын

Fitting pfp

@wafinashwan8242

Ай бұрын

fireship better

@Eldarlll

Ай бұрын

@@wafinashwan8242 they different things. fireship is shallow and just gives a short summary, while prime often gives great insight

@wholesomeducky

Ай бұрын

He can't even talk about tech news without acting special for having a system76 laptop (which were vulnerable to Meltdown/Spectre in the past), I would hardly say he's a good source.

Been watching for a while, absolutely love the streams. Endless fun and tons of info. Thanks!

Basically, a side-channel attack is being able to derive information from observing the operation of some system.

@SaraMorgan-ym6ue

29 күн бұрын

basically stop watching Microsoft porn kid🤣🤣🤣🤣🤣🤣🤣

Let's say hypothetically they knew that this "0day" was here, and love that it will force people to prematurely retire M1 machines.

@mcchaderson

Ай бұрын

The people who would care about this would change hardware…no?

@CommanderRiker0

Ай бұрын

@@mcchaderson Agree, but more so they would use software based disk encryption if they were really paranoid.

@doresearchstopwhining

Ай бұрын

Stock is up despite being sued via anti-trust laws...

@IOverlord

Ай бұрын

Appletards gonna be happy to buy another improved and secured device only for $6942.0 just because it doesn't have that backdoor.

@owenelliott5742

Ай бұрын

@@doresearchstopwhiningwe're approaching the end of capitalism

Original side-channel issues where (as I recall) first raised as an issue right after virtualization was becoming mainstream in datacenters... about 2003-2004 or there about. At the time VMware and other type-1 hypervisor publishers (most not yet mainstream) were struggling to create methods to protect VMs watching VMs on the same physical machines.... explaining this issue... to non-technical management... was I think one of the most difficult things I have had to do in my 30+ IT career in virtualization/security/infrastructure design work. And what is possible now, is light years more complex, you have only scratched the surface of what the real zero-day exploits are now.

@SaraMorgan-ym6ue

29 күн бұрын

are those encryption keys critical security flaws or are they the option to allow you to replace the ssd on the apple laptop has anyone checked out if that is possible with that leak?

To explain it further, a side channel attack is an attack that doesn't use flaws in something, but observes how it is working. The famous example is the pizzerias near the Pentagon: The pentagon is extremely secure so knowing then they're planning something is (let's say) impossible... But when everybody is working, they eat at the facility, so you see a spike in orders at nearby pizzerias! The spectre/meltdown attacks work by making the CPU think it's gonna load something by for example running a function repeatedly that always returns something. Once it's "trained", you suddenly make the function return something else. The CPU will have already returned the value you repeatedly calculated before, and it has to redo the operation once it sees it's wrong. By timing how long the CPU takes to correct the mistake you're able to understand what it's doing! Spectre/meltdown use this to gather data about what is in cache (for example, doing a simple operation multiple times on parts of memory you can access, then suddenly try to do the same operation on a part of memory you can't access so the CPU does it, realizes it can't, and corrects the mistake while you time it), without actually ever reading the cache. Super cool! Explanation about the actual attack is very simplified because I don't know how it works more in depth than this lol. It's black magic

I love how prime is just as intrigued by xor swap as I was. I found it myself when trying to swap too variables without using an intermediate variable and I wanted to do it in a way that wasn't just using an intermediate behind the scenes. then i quickly looked it up and was glad to see it was a very old algorithm

Icestorm cores are the name for the efficiency cores. The performance cores are called Firestorm cores. Likely a reference to their impact on the thermal envelope of the CPU.

5:15 Someone had that same battle net update popup happen to them at the end of a no-hit run in Dark Souls and died because of it.

@super_salty9189

Ай бұрын

Zentreya. Was the saddest shi ever.

Cool cameo by LowLevelLearning!

@monad_tcp

Ай бұрын

lol "cameo" its a voice "cameo"

@johnchilton4005

Ай бұрын

@@monad_tcp I don't find that "cameo" is limited to visual media

Low Level Learning X Prime 🔥🔥🔥🔥🔥

It sounds like they're saying since they know the encryption function, the IsPointer function, and if IsPointer has returned true (since they can see if the cache has updated?), they construct a piece of data x that goes in like IsPointer(encrypt(x, key)) and if IsPointer returns true or false that narrows down the possible values of the key.

This is totally patchable. Pop the CPU out of the socket and pop a new one in. That was the fix for the Pentium fdiv bug. Apple just has to mail everyone a new CPU. Expensive, for sure. But this is what companies with recalled products do. Oh, soldered in and glued together.... yeah "modern" computing is dumb.

@yearswriter

Ай бұрын

M1 die soldered . But I get teh idea

@NotYourSpy

Ай бұрын

boomer take. monolithic everytime. all day battery. i do not own a mac.

Ай бұрын

​@@NotYourSpybig dum dum take. No replacement for displacement. Enjoy your Tesla.

@Chamieiniibet

Ай бұрын

Well, it's almost the entire machine is that "CPU". So the replacement item price would anyway be almost equal to the price of complete mainboard

@monad_tcp

Ай бұрын

SOCKET, ahahah hhaaqhahaha haaaaaaaaaaaaaaaaaa haha no sockets, you have to use a BGA reflow station and pay $$$$ for specialized service. get rekt

I'd imagine your isPointer(value) function would be something like - The HW MMU knows the pages allocated to the virtual memory sandbox the application is in. So the HW cache looks at the upper bits of values in the cache and if they match a virtual page address mapped in that processes virtual memory sandbox, that's pretty likely to be a pointer. I think it'd probably just look a few resent cache page addresses, like a TLB. Scanning through all allocated pages would obviously be a performance loss in a L1 or L2 cache.

@monad_tcp

Ай бұрын

I still wonder why they don't use pointer tagging via hardware, its just 3 extra bits, how much more expensive that can be ?

@DigitalOsmosis

Ай бұрын

Additionally, in normal operation at a hardware level there are probably patterns that repeat, so tracking state over time you could probably build an engine that could improve performance by guessing if the next operation "isPointer"

It’s very easy to imagine a looks_like_ptr() function. Only some ARM instructions allow pointer operands. So if you have some data that is the same as an ARM machine code which takes a pointer operand, and the “pointer” looks like a viable virtual address, then the data looks like a pointer.

The highlight of this video for me is that Low-level learning follows the primeagen!

For the memory leak from the cache, an attacker could tell the CPU to return values from memory outside the range of where data is protected because the branching prediction doesn't check the memory space restrictions, therefore you can effectively get some data from the branch prediction outside of its own memory space. The data may be inaccurate because it's only a prediction, but it's still data regardless.

looks like a pointer in prefetcher is simply if this address was previously used as a pointer (and that instruction committed ok) then the prefetcher "learns" that information in what you can think of a "hardware table." So, address 0xdead was once accessed as a pointer, then prefetcher allocates a row in that table and remembers this address in case it sees it again in the future. Now there is another problem here: all these uArchitecture optimizations are left as is during context switches (too expensive to clean up everything,) so you could leak information across context too... It's can of worms that shows up with prefetchers and branch predictors

Side channel sounds scary AF, the kinda thing you go into a habbit role of madness to avoid if you're really paranoid.

Pc: vulnerability found and lessons learned in 2016. Apple: well let’s do it in 2024

Responsible disclosure can also be "seeing active exploit in the wild". A theoretical attack that isn't being actively exploited is lower risk, but active exploits need to alert people so they can defend.

great content! Thanks Prime. See you next week

As for pointer prediction, I think there are "usual cases". For example, if I am not mistaken, even if an address is 64 bits wide, the hardware uses only 48 to address memory (~256TB), meaning the top 16 bits are always 0 (if not stuffed with other bits for other optimizations by the programmer ... used, for example, in fast map datastructures). Another part of it is that an application's virtual memory range is typically the same. The stack and heap usually fall within the roughly similar regions (despite ASLR / KASLR), which are later translated by the MMU (memory management unit). Another great way to predict if a value is a memory address is to look at the instructions it is operated upon by. If a value has load, store, offset, and "memory-like" calculations performed on it, it is almost certainly an address. Classic access patterns such as virtual-table indirection for runtime-polymorphism use pretty uniform implementations, so that can be another good metric. I think these operations are not as hard to implement as they seem to be. The first can be done with simple bit-masking. After that, you can check if the value lies b/w some VM ranges (the kernel can do this, and given tight hardware-kernel integration on macs, this shouldn't be impossible to achieve). By this point the value is almost certainly an address. And by perhaps checking what previous instructions were executed on this value, you can pretty confident that something is an address. I mean, it made sense to implement it at a hardware/firmware level and spend really expensive silicon realestate for it, so I think it's safe to assume the implementation itself wasn't thaaaaat hard (for smart engineers), and took up fairly small cost in terms up hardware/firmware resources.

Well pointers (that aren't null) tend to be big positive numbers, so I guess every big positive number is a pointer now.

If im not wrong, for the isPointer function, you could get the memory segments of the process and then just check if the val that is inside the ptr is seg.min. Making sure its 8 bit alligned, and a bunch of other stuff to check if its a pointer. Not 100% all the time, but very close to it

2:25, no, the reverse, it is when something about the implementation of an otherwise completely theoretically secure encryption algorithm leaks enough information to help you break said encryption. Eg. If you had one time pad encryption and never reused the pad, then theoretically it's 100% secure and unbreakable. If however you prepared the two matching pads (key streams) using carbon paper and someone got a hold of the carbon paper and used it to get some of the pad and used it to decrypt some of the cypher text that would be a side channel attack.

Values tend to not use the full range of what numbers have to offer. Take uint64. Most uint64s would fit into uint32...and most 32s into 16s. For signed ints you would have that 1 significant bit for the minus then lots of zeros so 100000011 is probably -3 000000011 is probably 3 101101011 is probably a pointer

It means that understanding the implementation lets you interpret interference signals. Maybe it's if you use pointer instructions on the data

What an awesome explanation by LLL

It doesn’t require physical, as in touching the processor, access. You need access to the same processor as another process you want to infer information from

My noob self caught mention of the XOR swap earlier this year and I looked it up and found articles but man was I too stupid to grasp their explanation. That bit magic eludes me.

@nyx211

Ай бұрын

It's simple: a XOR a = 0 a XOR 0 = a a XOR b = b XOR a That means that: a XOR b XOR a = b b XOR a XOR b = a

@garystinten9339

Ай бұрын

Think algebra terms

i swapped to popOS cuz of yall, system76 looks great price wise. hadn't heard of them before. hope you get commission or osmethin lmao

Bitwise math is cool, and more people should know it in programming

I forget who said it first, but laptop stickers are the tech equivalent of prison tattoos.

That we still load cryptographic secrets into general purpose hardware with caching and branch prediction &c. Is absolutely insane plus a general backdoor into all current computers. We only use specialized hardware for login and disk encryption, so why not also for all other crypto with universal kernel support and a common little C library? And I mean since 2014 or so, when timing attacks on otherwise unreachable memory were a big topic for the first time?

Thank you for the "how would I code that" part

If you're the processor, it's not hard to "guess" if something is a pointer. First of all, pointers tend to be word-aligned -- if your word is 64 bits long, it means every pointer will be a multiple of 8. Second of all, with Virtual Memory, your pointers don't have absolute memory addresses, but they're all relative to some base (that you, as the MMU, know). So the first guess would be: any word-sized value that's a multiple of 8 and is within this process' virtual page boundaries. Not all integers can be pointers in most architectures. Especially modern ones. This isn't something silly.

@6:00 spectre works something like this: 1. Allocate Memory Array: The attacker creates a program that allocates a memory array. 2. Condition Branch Predictor: The attacker conditions the CPU's branch predictor to predict that a bounds check will pass. 3. Access Out-of-Bounds Memory: The attacker feeds an out-of-bounds address to the array. 4. False Branch Prediction: The CPU's branch predictor falsely predicts that the bounds check will pass. 5. Speculative Execution: The CPU speculatively executes code, including accessing data from the out-of-bounds address and using it to index another array (the "capture" array) owned by the attacker. This causes that part of the capture array to be put into cache. 6. Branch Misprediction: The CPU eventually realizes the branch prediction was wrong and undoes the speculatively executed code. 7. Cache Side-Channel: The CPU does not undo the cache fetching of the capture array, leaving traces of the speculative execution. 8. Access Time Measurement: The attacker measures access times to the capture array to determine which index corresponds to the data accessed speculatively. 9. Cache Eviction and Repeat: The attacker evicts the cache for the capture array and repeats the process.

a pointer is usually word aligned, page aligned etc.

Man I must be a mad nerd.. because I’m just cracking up at “looks like a pointer code” you’re awesome prime.

This only works if your Mac is already compromised, it’s an issue with the silicon but if it gets to that point then your machine is already infected.

@L1Q

Ай бұрын

Wrong, you would not call your machine infected because you run JavaScript on Amazon page. When meltdown and spectre happened, js engines exposed enough precision in their timing APIs it was a viable vector of attack.

Seems that only cryptographic algorithms running on Application Processors are at risk, not Secure Enclave(SE)-backed ones like FileVault on internal SSDs or login passwords. So applications that don't utilize SE, including encrypted Time Machine backups on external drives, are no longer secure until patched.

So the thing about the XOR trick is that you can actually do it with numbers too! And I think it makes it make a whole lot more sense. (well, floating points wont work due to rounding, but everything else is fine) let a = 10; let b = 6; //First we set a to be the sum of the values a = a + b //a is now 16 //Then, since a is the sum of the two original values, subtracting off b, should give the original value of a b = a - b //b is now 10, the original value of a //a is still the sum of the originals, but b is now the original value of a, so subtracting it off should give the original value of b a = a - b //a is now 6. the original value of b To understand the XOR trick, note the following: - XOR is actually a lot like addition: it's a binary operation, it's commutative, and it's associative. It just acts on binary strings instead of numbers - XOR is also it's own inverse: a XOR b XOR b gives you a back. SO in a way, XOR is also like subtraction too Thus, all you need to do to get the XOR trick, is replace both the addition _and_ subtraction in the number version with XOR, and it should work perfectly.

It's all about dangling pointers and backdoors.

14:10 I guess one big thing might be the address space the pointer is in and what kind of alignment the data has. Like when a 64 bit value has a value above a specific number and the last 6 bits are 0 it is not *that* far fetched to assume it is a pointer to something with a 64bit alignment.

Love Low Level Learning

Good thing you pointed this out 😆

Well that was a big brain crossover, love it

One thing to note is that the XOR trick (17:38 - 20:57) doesn't work if both operands are the same variable (or accessing the same memory location). a ⊕ a is always 0, which gets assigned back to a. Since both operands are now 0, a would always end up being 0 instead of its original value like it would be with a true swap. It seems odd to swap a variable with itself, but could be concern if you implement this with a function that takes two pointers and then pass the same pointer to both arguments. Here's an example in C. #include void xor_swap(int *a, int *b) { *a ^= *b; *b ^= *a; *a ^= *b; } int main(void) { int x = 5; int y = 7; printf("Before swaps: x=%d y=%d ", x, y); xor_swap(&x, &y); printf("Swapped x with y: x=%d y=%d ", x, y); xor_swap(&x, &x); printf("Swapped x with x: x=%d y=%d ", x, y); return 0; } It prints the following: Before swaps: x=5 y=7 Swapped x with y: x=7 y=5 Swapped x with x: x=0 y=5

15:06, I'd hazard a guess the the "looks like a pointer" checks if the value is in the same address space that currently working in

It's a feature: Hangman, you guess a letter, CPU tells you if it's in there or not.

LLL was on the ball... super clear and succinct... Fantastic!

Girthy ... lol. Was in a band named "Girth" once. We had side-chain leaking issues too.

Another useful purpose of XOR: XOR a value with itself equals 0. This sounds trivial, but is used heavily on for instance the Z80 processor in the Game Boy and MSX. Often you need the value 0 to be in register A. In C this would be something like: int a = 0. So, intuitively you’d think: load 0 in register a (ld a, 0) right? Well, that works, but it can be done way more efficient. "ld a, 0" costs 2 bytes and consumes 8 cycles, whereas "xor a" is only 1 byte with 4 cycles. And on a small CPU like the Z80, that’s a massive improvement.

Hoping I can run Linux on the new Arm-based Surface laptops. Keen for that battery life, performance and build quality but with an OS I can actually use for professional development work

Calling Georgia Tech “JIT” is going to show up in my nightmares

errrr no ... spectre / meltdown - yes, those were speculative branch predictor exploits, but the problem was that the predictor, while trying to predict execution path - it would NOT care about memory security. It was perfectly allowed to read from anywhere in memory (even protected one) via dead branch (like if(false) but a bit more complex) and then make the write create an delay dependant on the value read. The alive branch of your code would simply time it and figure out what was the result and store that tiny bit of information somewhere for you. Alto process was very slow, limited to few bits (maybe a byte) at a time, if this was stuffed in a infinite loop one could read whole region of memory. Of-course nobody would do that, since I don't want to see your dikc pics, but I would love to know your banking access key I would only read small region of memory containing that. This pales in comparison with heartbleed that would just memcopy your whole server memory via TCP ;)

internal ssd encryption/decryption is not done on the cpu but in the secure enclave.

im taking a basic comp & archi module i thought it was useless but now i appreatiate uni for this module .

Say what you will, it's impressive as hell that this backdoor was only found four years later. On an entirely new architecture that had lots of tech-savvy early adopters, to boot.

@pradhumnkanase8381

Ай бұрын

It was not found after after 4 years lol. It was made public after 4 years

@oleg4966

Ай бұрын

​@@pradhumnkanase8381 Fine, if you want me to be precise: found by people who did not put it there.

I’m just commenting to support the Chanel

Icestorm classification looks like spell casting or making up badges!

Has Apple mentioned being able to disable DMP on the M3 chips (they have the ability to turn it off for a performance hit unlike M1/M2)?

Although it's beyond my current ability as well, to design a pointer detector, where I detect you barking up the wrong tree is in that you're talking about programming the pointer-detector using code (instructions), while the actual pointer-detector implementations you're pondering, are implemented in logic gates, so there may well be an "is pointer" flag-bit or register or something else physical which can be checked to see if the 64-bit value is a pointer. I realize that's not the same as "looks like" a pointer, but my point is that this is occurring in hardware, not software.

just want to give a quick shout out to my man *LowLevelLearning* for such a great explanation about side channel hacks

Shout out to dude from Discord. Awesome job

Glad this is uploaded because missed the stream today, hopefully there was no attendance

the M1 chip is just asking its AI cores trained on exabytes of pointer addresses to distinguish between what is a pointer address and what is not

A side-channel attack is basically an emergent vector.

@ThePrimeTime When you have him on to comment about what that term means, it can help A LOT if you read him sentences with that term from the article, and ask him to put those specifically into context. In the context of THESE specific sentences, what do they mean when they use X term? This is usually easier and more useful than trying to hash out a good broad general example /Definition. Broad explanations have incredible advantages but require background knowledge to understand. Whereas explaining just the current context is quicker and simple enough that everyone can follow along.

18:20 think I just witnessed the birth of a new meme

Shared device contexts also apply to browser windows. That is, if you have multiple tabs open, and one of them is hammering cache, it can sniff your encryption information via JS. This can happen not only via malicious sites but also ads. I'd link the research paper but.. yeah. KZread spam filters and all that.

Sounds like the same issues the apple has previously in their t2 security chips. They were also not able to be patched.

Looks like a pointer? Maybe it's checks if it looks like a valid memory address which code could point to?

The way Mac's encrypt the drives is done via hardware keys. Im going to assume none of that stuff is really exposed to the OS.

@emptydata-xf7ps

Ай бұрын

Depending on the architecture, the keys could be read with an oscilloscope as it passes over the motherboard. This is how Xbox was hacked back in the day. I would assume it’s something different but hardware keys are no safer than software keys. If it’s stored in memory anywhere it’s vulnerable somehow.

@robsnook4512

Ай бұрын

@@emptydata-xf7psI just store mine inside the laptops body chassis on a post it note

@riley1636

Ай бұрын

irrc this doesn't impact the T1 or T2 chips but unsure what the usage of that is with respect to how they interact with the cpu or other processes.

As an adult I have a crazy subs sticker, a remilia sticker and a drawing I made myself stickered all on the side. Only kids wouldn't sticker their computer that's for sure!

Exactly bro!!!!!!!!

Apple owes everyone a refund. and maybe some damages.

idc if someone physically has my laptop, I'll consider it compromised. vulnerability discovered or not discovered.

@nb6175

Ай бұрын

Really!? If you run full disk encryption you simply would consider your data p0wned if someone has your laptop? What is the point of full disk encryption then? Why even bother?

@arabiancandybar

Ай бұрын

@@nb6175 Why are you so upset about full disk encryption all of a sudden?

@inventorofmachines

Ай бұрын

Ya i dont use full disk encryption. I guess if someone is willing to desolder my ssd and do electronics black magic with it, ill consider that they just have all my stuff anyway, regardless of if this vulnerability existed or not.

@LusidDreaming

Ай бұрын

Yea, but there are a lot of people with very sensitive data on their laptop where it does matter. It wouldn't necessarily be catastrophic to me (annoying nonetheless), but I could imagine people in intelligence, defense and financial sectors would probably be more paranoid about something like that.

@segueoyuri

Ай бұрын

I missed the part where the article mentioned it was a physical exploit. It doesn't seem to be. It actually says any software can get this access and it doesn't even need sudo access. I don't think Apple would compromise regular user performance because some people would desolder SSDs from macbooks (which is very annoying and time consuming btw) and apply a very specific exploit that can take 10 hours to get something.

End-to-end encryption.

@16:17 so they 'cast' the value to a pointer, then steal l the value of that pointer? So they can then backtrace to what the 'pointer' would have been (since they're after its VALUE). That's actually pretty genius. Requires a whole bunch of RAM-dumps though whilst you're trying to insert your interrupt into the right place whilst you get the value(s) you're looking for (such as secret keys)

@TheFrankvHoof

Ай бұрын

@24:19 ah. So Augury just straight up leaks those 'pointers' 😂. Yeah that explains how the M1 specifically is f*cked by this.

company wide skissues are CRAZY

Actually is not skill issue on the chip itself. Its on who implement the criptografic algortihm. The CPU can give you diffrent speed depending on what you encrypt/decrypt. its hard to make the time constant across multiple blocks, cause speed is needed to mass encryption. Basically what do you want? Super speed on encryption, or slower speed but constant time?

Simple: you read from your own memory but the adress depends on a hidden forbidden byte from not allowed memory. Then the read into your own memory doesn't actally happen but then you actually read your own memory and one block of memory will be read way faster.

Thanks Linus

Reminder that Ainz actually cast Sharknado. The Overlord author is whimsical.