News for hackers. Stuff that matters.
Re:Intel Issues Updates to Protect Systems from Security Exp... by chairmanwow on Thursday January 04, 2018 @01:37PM (#16072813)
I'm not sure that calling it faulty is exactly fair. I feel like the attack is actually pretty brilliant, and has been non-obviously "vulnerable" for years.
Re:Intel Issues Updates to Protect Systems from Security Exp... by emn13 on Thursday January 04, 2018 @01:57PM (#16072994)
The attack is pretty brilliant; but it's also not quite novel. Cache-timing attacks aren't new; certainly CPU suppliers should have known the general issues at hand for... at least a decade? See e.g. Colin Percival's somewhat related attack on hyperthreading way back in 2005: http://www.daemonology.net/papers/htt.pdf

Actually exploiting the information leakage isn't easy; and its compounded by the secrecy surrounding cpu internals. So I think they definitely deserve some blame here. Yes, the PoC is new. But the attack surface was widely known more than a decade ago, and they chose to punt the issue onto software; a solution that was unlikely to really hold water.

Re:Intel Issues Updates to Protect Systems from Security Exp... by contrarian_ on Thursday January 04, 2018 @02:05PM (#16073077)
2006: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190...

From the abstract:

> Information leakage through covert channels and side channels is becoming a serious problem, especially when these are enhanced by modern processor architecture features. We show how processor architecture features such as simultaneous multithreading, control speculation and shared caches can inadvertently accelerate such covert channels or enable new covert channels and side channels.

Re:Intel Issues Updates to Protect Systems from Security Exp... by emn13 on Thursday January 04, 2018 @02:09PM (#16073112)
Hey, there you go! I kind of doubt Intel really didn't know about this risk.

They were cutting corners; that deserves some opprobrium - especially given their market-dominating position over this timespan.

Re:Intel Issues Updates to Protect Systems from Security Exp... by jonknee on Thursday January 04, 2018 @01:50PM (#16072933)
The same can be said for many security vulnerabilities, but that doesn't make them any less faulty. Shellshock exploited a bug that had been in Bash for 25 years (!), but being non-obvious isn't a free pass.

I am not angry at Intel and in general think they do a good job, but trying to dodge blame here comes off sounding pathetic.

Re:Intel Issues Updates to Protect Systems from Security Exp... by betterunix2 on Thursday January 04, 2018 @01:42PM (#16072864)
It would be like Takata claiming their airbags are not a problem because all airbags can kill infants. There is a problem that uniquely affects one manufacturer's product line, and another problem that affects many manufacturers. Intel has been shipping chips that are uniquely and more severely affected by these attacks for many years now. They were ignorant, sure, but they did have a uniquely vulnerable design.