@thebestie // Karnov Group 2018
Coolest thing ever to happen to CPU nerds
Best logos associated with a crisis
Affect pretty much everyone
Worst computer vulnerabilities possibly ever
Slide 3
Slide 3 text
@thebestie // Karnov Group 2018
Allows unprivileged programs to read the entire systems memory
Meltdown
‘Melts’ existing memory isolation boundaries
Virtual Machines are not safe!
AWS, Google Cloud and Azure
Slide 4
Slide 4 text
@thebestie // Karnov Group 2018
More limited in scope
Spectre
More complicated, tricky to do, difficult to prevent
JavaScript proof of concept can read your entire browser’s memory
Slide 5
Slide 5 text
@thebestie // Karnov Group 2018
Spectre
Malicious JavaScript can steal all
the information in my browser!
Slide 6
Slide 6 text
@thebestie // Karnov Group 2018
What’s at risk?
Spectre
Your cookies and active sessions
Entire Gmail inbox
Social media accounts
PayPal
Banks
Slide 7
Slide 7 text
@thebestie // Karnov Group 2018
Update your operating system
What can I do?
Update your browsers
Turn on ‘Strict site isolation’ in Chrome
Close some tabs and log out
Slide 8
Slide 8 text
Cool story.
@thebestie // Karnov Group 2018
How does it work?
Slide 9
Slide 9 text
1 x = get_some_legal_data();
2 y = get_some_illegal_data();
3 do_something_with_value(y);
@thebestie // Karnov Group 2018
This is slow, while the CPU waits it executes 2
Slide 10
Slide 10 text
1 x = get_some_legal_data();
2 y = get_some_illegal_data();
3 do_something_with_value(y);
@thebestie // Karnov Group 2018
This is illegal but the CPU doesn’t know it yet
Slide 11
Slide 11 text
1 x = get_some_legal_data();
2 y = get_some_illegal_data();
3 do_something_with_value(y);
@thebestie // Karnov Group 2018
This is where the magic happens
Slide 12
Slide 12 text
@thebestie // Karnov Group 2018
0 1 2 3 4 5 6 7 9 10
This is an array I made earlier, I can read/write
Slide 13
Slide 13 text
@thebestie // Karnov Group 2018
0 1 2 3 4 5 6 7 9 10
1
1 x = get_some_legal_data();
2 y = get_some_illegal_data();
3 my_array[y] = 1;
Looks like y was 7
Slide 14
Slide 14 text
@thebestie // Karnov Group 2018
0 1 2 3 4 5 6 7 9 10
But that was illegal
An exception was raised
State is rolled back
Slide 15
Slide 15 text
@thebestie // Karnov Group 2018
0 1 2 3 4 5 6 7 9 10
Something was left over . . .
When iterating something strange happens
Slide 16
Slide 16 text
@thebestie // Karnov Group 2018
0 1 2 3 4 5 6 7 9 10
Something was left over . . .
When iterating something strange happens
Slide 17
Slide 17 text
@thebestie // Karnov Group 2018
0 1 2 3 4 5 6 7 9 10
Something was left over . . .
When iterating something strange happens
Slide 18
Slide 18 text
@thebestie // Karnov Group 2018
0 1 2 3 4 5 6 7 9 10
The CPU has cached the value of 7
The data is returned much faster
Slide 19
Slide 19 text
@thebestie // Karnov Group 2018
Repeat 1.048.576 times
You now have 1 MB of data