Language Selection

English French German Italian Portuguese Spanish

Security: Currencies, Marcus Hutchins, and Hardware Bugs

Filed under
Security
  • Hot New Cryptocurrency Trend: Mining Malware That Could Fry Your Phone
  • PyCryptoMiner Attacks Linux Machines And Turns Them Into Monero-mining Bots
  • Marcus Hutchins' lawyers seek information around arrest

    Lawyers acting for British security researcher Marcus Hutchins have filed a motion seeking additional information on a number of aspects surrounding his arrest in order to prepare for a trial that is expected to take place this year.

  • AMD Did NOT Disable Branch Prediction With A Zen Microcode Update

    With the plethora of software security updates coming out over the past few days in the wake of the Meltdown and Spectre disclosure, released by SUSE was a Family 17h "Zen" CPU microcode update that we have yet to see elsewhere... It claims to disables branch prediction, but I've confirmed with AMD that is not actually the case.

    AMD did post a processor security notice where they noted their hardware was not vulnerable to variant threee / rogue data cache load, for the "branch target injection" variant that there was "near zero risk" for exploiting, and with the bounds check bypass it would be resolved by software/OS updates.

  • Spectre and Meltdown Attacks Against Microprocessors

    "Throw it away and buy a new one" is ridiculous security advice, but it's what US-CERT recommends. It is also unworkable. The problem is that there isn't anything to buy that isn't vulnerable. Pretty much every major processor made in the past 20 years is vulnerable to some flavor of these vulnerabilities. Patching against Meltdown can degrade performance by almost a third. And there's no patch for Spectre; the microprocessors have to be redesigned to prevent the attack, and that will take years. (Here's a running list of who's patched what.)

  • OpenBSD & FreeBSD Are Still Formulating Kernel Plans To Address Meltdown+Spectre

    On Friday DragonFlyBSD's Matthew Dillon already landed his DragonFly kernel fixes for the Meltdown vulnerability affecting Intel CPUs. But what about the other BSDs?

    As outlined in that article yesterday, DragonFlyBSD founder Matthew Dillon quickly worked through better kernel/user separation with their code to address the Intel CPU bug. Similar to Linux, the DragonFlyBSD fix should cause minimal to small CPU performance impact for most workloads while system call heavy / interrupt-heavy workloads (like I/O and databases) could see more significant drops.

  • Retpoline v5 Published For Fending Off Spectre Branch Target Injection

    David Woodhouse of Amazon has sent out the latest quickly-revising patches for introducing the "Retpoline" functionality to the Linux kernel for mitigating the Spectre "variant 2" attack.

    Retpoline v5 is the latest as of Saturday morning as the ongoing effort for avoiding speculative indirect calls within the Linux kernel for preventing a branch target injection style attack. These 200+ lines of kernel code paired with the GCC Retpoline patches are able to address vulnerable indirect branches in the Linux kernel.

    The Retpoline approach is said to only have up to a ~1.5% performance hit when patched... I hope this weekend to get around to trying these kernel and GCC patches on some of my systems for looking at the performance impact in our commonly benchmarked workloads. The Retpoline work is separate from the KPTI page table isolation work for addressing the Intel CPU Meltdown issue.

  • Intel hit with three class-action lawsuits over chip flaws
  • Meltdown, aka "Dear Intel, you suck"

    We have received *no* non-public information. I've seen posts elsewhere by other *BSD people implying that they receive little or no prior warning, so I have no reason to believe this was specific to OpenBSD and/or our philosophy. Personally, I do find it....amusing? that public announcements were moved up after the issue was deduced from development discussions and commits to a different open source OS project. Aren't we all glad that this was under embargo and strongly believe in the future value of embargoes?

  • Hack-proof Quantum Data Encryption

More in Tux Machines

Qt 5.9.7 Released

Qt 5.9.7 is released today. As a patch release Qt 5.9.7 does not add any new functionality, but provides important bug fixes and other improvements. Compared to Qt 5.9.6, the new Qt 5.9.7 contains almost 60 bug fixes. In total there are around 180 changes in Qt 5.9.7 compared to Qt 5.9.6. For details of the most important changes, please check the Change files of Qt 5.9.7. Qt 5.9.7 can be updated to using the maintenance tool of the online installer. For new installations, please download latest online installer from Qt Account portal or from qt.io Download page. Offline packages are available for commercial users in the Qt Account portal and at the qt.io Download page for open-source users. Read more

Great News! Linus Torvalds is Back in Charge of Linux

Linus Torvalds is back in charge of Linux Kernel development. It remains to be seen whether he has improved his behavior and become a gentler person or not. Read more

Android Leftovers

Tiny NanoPi Duo2 SBC offers camera connector

FriendlyElec has launched a tiny, under $20 “NanoPi Duo2” board that updates the original Duo with an Allwinner H3, Bluetooth, a camera connector, and an optional 2G carrier board. FriendlyElec has spun out a modest upgrade to last year’s $13 (previously $8) NanoPi Duo. Like the Duo, the COM-like, $19.50 NanoPi Duo2 includes two 16-pin GPIO headers with breadboard pins in a dual-in-line layout. Read more