Glad i didn't upgrade for QC lol.
Wonder if GPU's are fucked too.

It's funny the gov said to replace your cpu asap, but then backed away from that and said update your os.
Pretty sure if it's hardware exploit , software can't truly curtail it. someone will find a way around it.

You didn't upgrade since 1995?

i meant more like... spending all that money to buy new gear that would need to be replaced because it to is vulnerable.

It's hardware vulnerability. It can't be patched.
Whatever software updates come are only temporary.

AFAIK there are two exploits that were discovered:
1 - Spectre (can be fixed without any performance penalty).
2- Meltdown (fixing implies a performance hit between 5-50% depending on the product and application).

The vulnerability that affects AMD and some ARM products (spectre 1) can only be exploited with physical access to the machine and using a modified linux kernel.

Intel's vulnerabilities (spectre 1/2 + meltdown) are hardware based and cannot be fixed using either microcode update of firmware updates, only a band aid solution using a software patch at the OS level. Pretty much all Intel cpu's since 1995 have this. Matter of fact this bug is known to intel and google since mid last year, since then Intel rushed to release the Skylake-X and Coffee Lake platforms, the latest, before these exploits became public. Also Intel's CEO sold as much stock as he could before this bomb dropped.

Performance hit on things like gaming and everyday home should be minimal, however for data centers and HPC ouch...

Update your browser (Firefox Quantum 57 + NoScript) and OS to the latest patches and you should be ok. If you use chrome, the fix for this issues will take a while to arrive, probably at the end of January.

EDIT: Benchmarks pre and post bios + windows patch. As expected in some tasks the differences are significant.

https://www.reddit.com/r/pcmasterrace/comment..._and_bios/

there were talks b the US gov a few years back about security holes in the cpu's they use and the ability to possibly hijack them. I think they've known a bit longer. They were talking about making their own chips instead of foreign or outsourced companies.

CIA can over ride your car and crash it. Airplanes can be hijacked.
I'm sure they've known. Maybe all the deep state tools released last year.
Initially auctioned. No one bought anything. They released a bunch, kept a bunch.
I'd assume these exploits were probably part of the sold package.

So now there's someone out there with NSA grade tool sets.
Would explain why they've come forward with this info instead of just keeping quiet.
Could have been put there on purpose.

Apparently some anti virus tools used these flaws xD The plot is thickens.

maybe this?
https://threatpost.com/boundhook-attack-explo...re/128517/
Seems like a different exploit.
So far 3:
Spectre family of exploits (current bs )
the above link...
and this one.
https://www.theregister.co.uk/2017/05/01/inte...erability/

maybe all these exploits are connected and work in conjunction as some ultimate backdoor action
total cpu take over.

Like this https://www.washingtonpost.com/news/innovatio...b6902e2d53

Control over:
every drone
aircraft carrier
fighter jets
commercial jets.....

Pretty much anything with a chip. Weaponized toasters.

In the future people will upload viruses to sex robots so the rips people dicks off.
"we have a dick epidemic!"
"Or rather, dickless...."

this is a good summary thanks

also intel ceo sold $24m shares before it went public loloololololololool

Yes, should make him eligible for prosecution for breaking inside stock trading laws?

too big to fail (c) emerica

Just like Larry Silverstein.

Apple also affected by both exploits: https://www.reddit.com/r/hardware/comments/7o...d_spectre/

This will likely hurt intels sales on the server market. This together with AMDs new line of server chips.

have templeOS ready when they do the full crackdown

Even if it was vulnerable it's completely safe
no networking needed to talk to jesus

buhaha

Spectre is just an Intel PR trick to make people like op list AMD alongside ARM and Intel in forum topics. (It's real but not in the same league and easily fixable with no drawbacks). They even tried to enable the meltdown prevention that degrades performance so much in Linux kernel for AMD processors too.

Good thing I use win7 without updates on my hentai machine!

btw just letting you guys know the OS patches released for this problem is just a mitigation, the attack will be possible even after that, just harder.

True fix will require a hardware change, afaik no chip with the fix is yet out in market. The Intel fix is probably going to arrive with icelake.

AMD is good for at least 2 out of the 3 attacks, one of them is still possible but that one is largely defeated by the software patch.

If you are interested in details about this please read these links.

1. A easy layman's explanation of how the 3rd attack (meltdown) works
https://cyber.wtf/2017/07/28/negative-result-...user-mode/

this guy invented one of the attacks while he was not himself successful in using it, later people were successful with a few tweaks, you may have heard of some hacker dude called brainsmoke...he used a version of this attack.

2. Google's official link for all 3 exploits (warning long and tedious and you probably wont understand much of it unless you are pretty well versed in these things)

https://googleprojectzero.blogspot.com/

https://youtu.be/I5mRwzVvFGE

awesome youtube channel. the old english guy is the best
https://youtu.be/VPw9vPN-3ac

Just like terrorism, these flaws were know well before the growth of the internet, now you hear about terrorism wherever you go, on every news blog, every social media outlet and every popular news channel.

From a basic user level, these things won't matter at all. Now from a network security/government level damn son. They should have fixed this shit 10 years ago.

Can't wait for the next world war, but instead of guns and death, it'll be skynet style wars.

*disconnects LAN and Wifi connection*

Meltdown could affect intel user quite hard? Having all your passwords stolen is a bummer :(

Your passwords could only be stolen with incredibly well coded exploits, having vulnerable cpu architecture can only be really abused if the system is running 24/7 which in most cases servers do. With patches to Meltdown and spectre they'll be fixing the link between cpu memory and actual RAM/ROM.

But there's a lot of speculation on Reddit as to what can be done potentially and yeah, it's pretty scary.

This is probably the biggest tech scare since Y2K.

Imagine someone having my pass to esr...

This, it's not like one saves any actually important pw's

The way I understand it, it's not just saved passwords. It seems that this could be theoretically about every passwort you ever used since 1995.

Also finger-prints, patterns etc. on your mobile devices, also all cryptographic keys (think online banking). More or less everything.

From what I've understood the exploit use the cache to get hold of your password and what not, doesn't need to access ram directly?
That's the "brilliant" thing about these exploits?

Edit: nevermind :) didn't read your post close enough...

Why does it have to be running 24/7?

But the gov. agencies already built backdoors into every intel/amd processor to protect us from this stuff. so we're safe right?
/s

lul

As standard desktop/gaming/whatever users how does this effect us?

For background info I just run win7/win8 with updates completely disabled, and intend to for the next 5 years or so.

Win10 can get bent, and Im not turning on updates to allow MS to retro-fit my win8 with all their BS telemetry crap. IMO if your smart you would have turned updates off about the time windows10 came out, like I did.

I have absolutley no problems doing this so far despite the fact it does leave me open to various vunerabilities, on the other hand who would really bother to hack my pc, and if shit goes wrong I just re-install it anyway. Not found any viruses for last few years.

But now with this meltdown I wonder if I should re-asses my intent to never update, but Im leaning towards not bothering as usual.

Are others in my boat? Not updating and not caring at the same time? And what does metldown mean to us in this situation.

i interested in this as well. how much wil it affect qchamps players

It's exploitable using javascript, so any website you visit can read all your memory including logins and passwords, your emails, message history, etc. This data can be used to attempt either to directly steal money from you (if you use some internet banking or payment service), or use a phishing scheme to fake a very convincing message from a friend or special offer email or whatever, that will lure you into purchasing some product or sending a money transfer to someone.

No one will bother to target specifically you, but hackers will try to gather any information from everyone possible and launch massive attacks against millions of people, so there is a good chance that you will somehow end up in this mass of victims.

I'm still on win7, have no intentions of ever running win10. You know you can get security only patches from MS catalog? The security only patches aren't available through WU anyways, but they contain only security/bug fixes. And there's at least a couple forums I've found (wilders security forum has people that keep up with the patches) that people regularly check new security only updates to make sure MS doesn't slip anything in there (telemetry, etc). I usually wait a few days after updates are released to see if anyone runs into issues. So far, MS has kept their word.

Unless you're just using it strictly for gaming and and browsing that doesn't involve anything sensitive, I wouldn't go unpatched. It's a shame that MS doesn't offer individual fixes anymore, but at least for the time being they're offering a way without all the BS.

wonder if this related. Seems like a lot of physical vulnerabilities.
https://www.theregister.co.uk/2017/05/01/inte...erability/

When someone tries to acces your computer with these exploits, do we know how that works? Is it like small hidden beacons that potential hackers can listen in on? Does the exploit/exploits transmit information themselves?

One more question, does the exploit/viruses get erased from your computer upon a reboot or does it get copied to your drive when rebooting?

I know the perfect answear is "use google" and I have, didn't find any information on this though, guess most information is very rudimentary atm.

Afaik to abuse spectre(1/2) one needs to have physical acess to the machine in question. Meltdown can be abused from any website if you allow Java Scripts to run, meaning that your data such as login details, banking information, e-mail and so on can be compromised and used against you, without you even knowing or leaving any traces behind. This is valid of course if you use an Intel cpu (pretty much everything above Pentium I is affected afaik).

You can always update your OS+BIOS and use the latest Firefox Quantum with the multi account containers + some extension to block scripts.

https://leotindall.com/tutorial/locking-down-firefox/

EDIT: Following the directions on that link above will make it somewhat of a pain to use social media websites and some others. If you add script blocking on the top of that it will be even worse, but worth it.

The web has become impossible to use. Fuck all that useless scripting.

At least it's not flash...

The easiest way to explain it is when you use certain applications, access websites etc, your log in details and credentials will be encrypted several different ways. 128bit/256bit etc.

Without getting in to serious depth;

Your data encrypted will look something like this:

wUwDPglyJu9LOnkBAf4vxSpQgQZltcz7LWwEquhdm5kSQIkQlZtfxtSTsmaw
q6gVH8SimlC3W6TDOhhL2FdgvdIC7sDv7G1Z7pCNzFLp0lgB9ACm8r5RZOBi
N5ske9cBVjlVfgmQ9VpFzSwzLLODhCU7/2THg2iDrW3NGQZfz3SSWviwCe7G
mNIvp5jEkGPCGcla4Fgdp/xuyewPk6NDlBewftLtHJVf
=PAb3

Now from a memory point of view and all the way down to a cpu level, everything will be 1's and 0's which is so much easier to decode. So literally nothing is safe.

Hotfixes and patches will obviously be rolled out, I think everyone is going mental but unless you've personally pissed someone off that is incredibly talented then I'd be worried.

they basically spy on your memory.
it's not a virus. it's an actual hardware based doorway into your memory.
From there whoever it is takes data from your memory and there's ways to determine which bits are a password etc.

It tricks the processor somehow.

Quite interesting explanation.

ah ye nice, I was wondering how it worked but didn't yet have time to read up on it.
This was a nice explanation (first 5 minutes or so could've been removed though ;p)