Connect with us

Published

2 months ago

on

THIS MEMORY-DEPENDENT PREFETCHER HAS TEETH — Unpatchable vulnerability in Apple chip leaks secret encryption keys Fixing newly discovered side channel will likely take a major toll on performance.

Dan Goodin – Mar 21, 2024 2:40 pm UTC EnlargeAurich Lawson | Apple reader comments 162

A newly discovered vulnerability baked into Apples M-series of chips allows attackers to extract secret keys from Macs when they perform widely used cryptographic operations, academic researchers have revealed in a paper published Thursday.

The flawa side channel allowing end-to-end key extractions when Apple chips run implementations of widely used cryptographic protocolscant be patched directly because it stems from the microarchitectural design of the silicon itself. Instead, it can only be mitigated by building defenses into third-party cryptographic software that could drastically degrade M-series performance when executing cryptographic operations, particularly on the earlier M1 and M2 generations. The vulnerability can be exploited when the targeted cryptographic operation and the malicious application with normal user system privileges run on the same CPU cluster. Beware of hardware optimizations

The threat resides in the chips data memory-dependent prefetcher, a hardware optimization that predicts the memory addresses of data that running code is likely to access in the near future. By loading the contents into the CPU cache before its actually needed, the DMP, as the feature is abbreviated, reduces latency between the main memory and the CPU, a common bottleneck in modern computing. DMPs are a relatively new phenomenon found only in M-series chips and Intel’s 13th-generation Raptor Lake microarchitecture, although older forms of prefetchers have been common for years.

Security experts have long known that classical prefetchers open a side channel that malicious processes can probe to obtain secret key material from cryptographic operations. This vulnerability is the result of the prefetchers making predictions based on previous access patterns, which can create changes in state that attackers can exploit to leak information. In response, cryptographic engineers have devised constant-time programming, an approach that ensures that all operations take the same amount of time to complete, regardless of their operands. It does this by keeping code free of secret-dependent memory accesses or structures.

The breakthrough of the new research is that it exposes a previously overlooked behavior of DMPs in Apple silicon: Sometimes they confuse memory content, such as key material, with the pointer value that is used to load other data. As a result, the DMP often reads the data and attempts to treat it as an address to perform memory access. This dereferencing of pointersmeaning the reading of data and leaking it through a side channelis a flagrant violation of the constant-time paradigm. Advertisement

The team of researchers consists of: Boru Chen, University of Illinois Urbana-Champaign Yingchen Wang, University of Texas at Austin Pradyumna Shome, Georgia Institute of Technology Christopher W. Fletcher, University of California, Berkeley David Kohlbrenner, University of Washington Riccardo Paccagnella, Carnegie Mellon University Daniel Genkin, Georgia Institute of Technology

In an email, they explained: Prefetchers usually look at addresses of accessed data (ignoring values of accessed data) and try to guess future addresses that might be useful. The DMP is different in this sense as in addition to addresses it also uses the data values in order to make predictions (predict addresses to go to and prefetch). In particular, if a data value looks like a pointer, it will be treated as an address (where in fact it’s actually not!) and the data from this address will be brought to the cache. The arrival of this address into the cache is visible, leaking over cache side channels.

Our attack exploits this fact. We cannot leak encryption keys directly, but what we can do is manipulate intermediate data inside the encryption algorithm to look like a pointer via a chosen input attack. The DMP then sees that the data value looks like an address, and brings the data from this address into the cache, which leaks the address. We dont care about the data value being prefetched, but the fact that the intermediate data looked like an address is visible via a cache channel and is sufficient to reveal the secret key over time.

In Thursdays paper, the team explained it slightly differently:

Our key insight is that while the DMP only dereferences pointers, an attacker can craft program inputs so that when those inputs mix with cryptographic secrets, the resulting intermediate state can be engineered to look like a pointer if and only if the secret satisfies an attacker-chosen predicate. For example, imagine that a program has secret s, takes x as input, and computes and then stores y = s ? x to its program memory. The attacker can craft different x and infer partial (or even complete) information about s by observing whether the DMP is able to dereference y. We first use this observation to break the guarantees of a standard constant-time swap primitive recommended for use in cryptographic implementations. We then show how to break complete cryptographic implementations designed to be secure against chosen-input attacks. Page: 1 2 3 Next → reader comments 162 Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Advertisement Promoted Comments AusPeter Requires running a malicious application locally.

Reminder to avoid running applications youve downloaded from anywhere but trusted sources.And when the hackers attack your trusted sources?

Which reminded me of Reflections on Trusting Trust by Ken Thompson. March 21, 2024 at 3:28 pm Rene Gollent An exploit like this needs local access. If the bad baby eating hackers crawling on every corner of the internets already have local access you’re screwed anyway.I’d be careful making assumptions like this ; the same was true of exploits like Spectre until people managed to get it efficiently running in Javascript in a browser (which did not take very long after the spectre paper was released). Don’t assume that because the initial PoC is time consuming and requires a bunch of access that it won’t be refined into something much less demanding in short order. March 21, 2024 at 3:38 pm purecarot Its a very difficult exploit thats unlikely to affect you.It will affect him if Apple deploys a fix that affects CPU performance. March 21, 2024 at 4:47 pm Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars

Related Topics:
Continue Reading

Sports

A complete timeline of Colorado’s tumultuous offseason

Published

2 hours ago

on

May 22, 2024

By

A complete timeline of Colorado's tumultuous offseason

  • Kyle Bonagura, ESPN Staff WriterMay 22, 2024, 07:00 AM ET

    Close

    • Covers the Pac-12.
    • Joined ESPN in 2014.
    • Attended Washington State University.

Moments after Colorado‘s once-promising season sputtered to a close with a 23-17 loss at Utah in November, coach Deion Sanders took about a minute to reflect on some of the positives his team showed in the game. Even with his son, star quarterback Shedeur Sanders, sidelined with an injury, he said the Buffs played well. But he also wasted no time turning the page. After a last-place Pac-12 finish in his debut season at Colorado, it made no sense to dwell on the team’s on-field performance.

“It’s time to start projecting and start thinking about the tomorrow already,” Sanders said.

With that, Sanders got back to doing what he has proven effective at: generating hype.

“We already know what’s going to transpire, you’re gonna be pleased with what’s coming. I promise you that,” Sanders said. “But everything you see that we have a lack thereof — a deficit — we’re gonna fill that need.”

As he did when he arrived, Sanders made it clear Colorado was, again, going to seek help in the transfer portal in the pursuit of one clear goal.

“We want to win now.”

Here’s a look at some of the most noteworthy moments of Colorado’s offseason as Coach Prime’s tenure remains one of the most captivating stories in all of sports.

Dec. 5: Sanders arrived to Colorado in late 2022 as a bona fide celebrity — one of the greatest athletes in American history — taking the reins at a downtrodden program. He leaned heavily into making Colorado as visible as possible. Everything, it seemed, was on camera.

But after a whole year of that constant visibility, it seemed to become a dynamic that wasn’t always positive, he told People Magazine.

“You always wish that you had a little more privacy,” he said, “but the same thing that makes you shine will show your blemishes.

“So you’ve got to take the good with the bad. You can’t just want everyone there when the hype machine is rolling, you have to understand there’s another side to this.”

Dec. 20: As Deion alluded to in the Utah press conference, Colorado had glaring holes it needed to fill and almost immediately took steps to shore up a porous offensive line that allowed Shedeur to become one of the most sacked quarterbacks in the country. Colorado welcomed 20 new players in the early transfer window, including six offensive lineman: OT Kahlil Benson, Indiana; OG Justin Mayers, UTEP; C Yakiri Walker, UConn; OG Tyler Johnson, Houston; OT Phillip Houston, FIU; including a big grab in five-star HS recruit OT Jordan Seaton.

In an interview with the Associated Press, Sanders said, “All these kids have been starters. They’re not backups. They weren’t lower-level players. They were starters in Power 5. And they know darn well they’ve got a first-round pick — maybe the first kid in the whole draft — that they’re protecting. That means something to them.”

Dec. 30: Shortly after getting through the early signing day, staff changes started. Defensive coordinator Charles Kelly left the program to serve as the co-defensive coordinator at Auburn, his alma mater. Kelly’s departure meant that both of Sanders’ initial coordinators would not be back for a second season. OC Sean Lewis, who was stripped of playcalling duties during the season, was hired as San Diego State‘s head coach.

Jan. 16: A little more than a year after Coach Prime delivered the famous line at his team meeting — “I’m bringing my luggage with me, and it’s Louis” — some of that proverbial luggage (his sons, Shilo and Shedeur) walked in an actual Louis Vuitton fashion show during Paris Men’s Fashion Week.

Jan. 27: Not even two weeks later, a video was published by Well Off Media — the YouTube channel operated by the oldest Sanders son, Deion Jr. — with a headline: DEION SANDERS’ SONS ARE BUYING HIM A NEW HOME IN COLORADO. It shows the family touring an exquisite property roughly 18 miles from Folsom Field, outside of nearby Golden, Colorado.

Four months later, however, that property is still listed for sale by the listing agent.

Feb. 3: Professor Prime? At least for a day. Sanders served as a guest lecturer to talk about the football program’s social media strategy, among other topics, alongside Sanders Jr. — known better as Bucky — for a class called Prime Time: Public Performance and Leadership.

Feb. 9: Former Cincinnati Bengals secondary coach Robert Livingston was hired as the defensive coordinator and Pat Shurmur, who took over playcalling duties from Lewis, was confirmed as the permanent OC. Colorado also announced Phil Loadholt as the OL coach and Jason Phillips as the receivers coach.

Feb. 20: Smack in the middle of a recruiting dead period, Sanders was announced as an owner of the sports nutrition company REDCON1.

In a press release announcing the deal, the company said, “Coach Prime will drive REDCON1’s expansion directly, especially within the sports nutrition and performance beverage sectors. His creativity and expertise are derived from his personal experiences and success in sports, which will play a pivotal role in continued product innovation and enhancing the brand’s visibility.”

March 12: Sanders’ second book — “Elevate and Dominate: 21 Ways to Win On and Off the Field,” written with Don Yaeger — was released as an instant New York Times bestseller. It was accompanied by a four-stop book tour.

April 1: Months after Sanders said it was going to happen, Hall of Fame defensive lineman Warren Sapp joined the program as a graduate assistant. Athletic director Rick George signed off on the hire, which drew criticism in light of Sapp’s past that saw him get fired by the NFL Network following his arrest for assaulting and soliciting a prostitute during Super Bowl weekend in 2015.

“Warren Sapp successfully completed all of the necessary steps required of anyone who is employed at CU Boulder, including a background check,” Colorado said in a statement. “Furthermore, athletic director Rick George personally met with Warren to clearly articulate the department’s standards and expectations, to which he acknowledged and agreed.”

April 10: Well Off Media took fans behind the scenes as Shedeur attended an in-person lecture for the first time.

During the video he jokingly said, “You know how long it’s been since I’ve been to an in-person class? Like five years.”

April 16: When the spring transfer portal window opened, several prominent players announced they would be leaving Colorado, including former five-star recruit Cormani McClain, lead rusher Dylan Edwards and two other backs, Alton McCaskill and Sy’veon Wilkerson.

April 20: On his YouTube channel, McClain took a pointed shot at the Colorado program.

“Some people just gotta take a step back from things sometimes, certain people, you know,” McClain said. “I feel like I just don’t want to play for clicks. I actually want to be involved with a great leading program that’s going to develop players.”

He would later transfer to Florida.

April 27: Colorado fans set a high bar when they sold out Folsom Field for the 2023 spring game and while this year’s version wasn’t quite the spectacle, it still drew a respectable crowd of 28,424 despite inclement weather. The game was part of a day that later featured a Lil Wayne concert.

May 1: After a story in The Athletic was published that detailed how former Buffaloes players fared after many were run off following the arrival of Sanders, a series of back-and-forth trash talk ensued, including tweets from Shedeur and Deion.

The coach took aim at one relatively anonymous FCS player from Austin Peay.

He later told Thee Pregame Show, “I gotta do better on that and not ride with it, but I was bored. I was bored, and I didn’t say nothing hurtful. I don’t attack people.”

May 8: As Shedeur preps for an important final season of college football in which he’s in the conversation to be one of the first quarterbacks taken in next spring’s NFL draft, he also found time to drop his first song, “Perfect Timing.”

May 16: Two-way star Travis Hunter was revealed as one of the three cover stars, alongside Michigan‘s Donovan Edwards and Texas‘ Quinn Ewers, for the rebirth of EA Sports College Football 25.

May 20: The Coach Prime effect continues to pay off for Colorado’s ticket department. For the second straight year, the Buffs have sold out their season tickets, something the school had not done since 1996. And prior to 2023, the school had never sold out its season tickets before August.

Continue Reading

Politics

Nigeria reforms blockchain policy committee with fresh experts

Published

2 hours ago

on

May 22, 2024

By

Nigeria reforms blockchain policy committee with fresh experts

Inuwa said the committee’s strategic reconstitution would bring together a fresh wave of experienced professionals and leading minds in blockchain.

Continue Reading

US

Oregon: Woman crushed by grand piano shows ‘amazing spirit’ after being told she will never walk again

Published

2 hours ago

on

May 22, 2024

By

Oregon: Woman crushed by grand piano shows 'amazing spirit' after being told she will never walk again

A woman has been left unable to walk after a piano slipped and dropped on her while she was helping a friend move the instrument.

Danielle Drummond, 28, who had recently relocated from Cleveland, Ohio, to Oregon for a fresh start, is now hoping for a scientific breakthrough after the ordeal left her needing both a wheelchair and a carer.

She told Cleveland-based broadcaster 19 News she had tried to stabilise the piano when offering to help last month, but her friend lost her grip.

“She dropped like a whole upright grand piano on me, and it severed my spinal cord,” Ms Drummond said.

“Now, I’m paralysed from the waist down.”

Ms Drummond has no family in Eugene, the city in Oregon where she lives, and also needs to find a permanent home, having been living in a van with her dog, Lotus.

Danielle Drummond. Pic: GoFundMe
Image:
Danielle Drummond. Pic: GoFundMe

Compounding her problems, she does not know how she would begin to move back to her family in Cleveland and transfer all her belongings and medical equipment.

Her sister has set up a fundraising page to “support future medical needs”, with the aim of raising $10,000 (£7,850).

“Our family thanks you for all your support, consideration, thoughts, love and prayers,” her sister Rosie Hayne wrote, describing Ms Drummond as “strong”, “wise”, and “down to earth”.

In an update on the GoFundMe page, Ms Hayne added: “She wants to make it clear that she is not expecting to ever walk again.

“She has accepted the reality of her situation. But she has an amazing spirit and an overall positive outlook, focusing on what she can do.”

Ms Drummond told 19 News she hopes people going through similar circumstances “don’t give up”.

Follow Sky News on WhatsApp
Follow Sky News on WhatsApp

Keep up with all the latest news from the UK and around the world by following Sky News

Tap here

Read more:
Elvis Presley’s granddaughter Riley Keough fights auction of Graceland
‘Roof ninja’ woman found living inside shop sign said it was ‘old safe spot’

Meanwhile, her wish remains for a new development in treatment.

“It definitely is a game change for me,” she said. “I try to stay hopeful.”

Continue Reading

Trending