March 2021 - cypherpunks - lists.cpunks.org

Exploits: AMD - TakeAWay, Intel - CSME
by grarpamp 09 Mar '21

09 Mar '21

https://mlq.me/download/takeaway.pdf https://www.amd.com/en/corporate/product-security https://thehackernews.com/2020/03/intel-csme-vulnerability.html https://thehackernews.com/2020/03/amd-processors-vulnerability.html 1.5+ YEARS, lol at responsible disclosure (irresponsible suppression) 9 Years of AMD Processors Vulnerable to 2 New Side-Channel Attacks March 09, 2020 Ravie Lakshmanan amd processor vulnerability AMD processors from as early as 2011 to 2019 carry previously undisclosed vulnerabilities that open them to two new different side-channel attacks, according to a freshly published research. Known as "Take A Way," the new potential attack vectors leverage the L1 data (L1D) cache way predictor in AMD's Bulldozer microarchitecture to leak sensitive data from the processors and compromise the security by recovering the secret key used during encryption. The research was published by a group of academics from the Graz University of Technology and Research Institute of Computer Science and Random Systems (IRISA), who responsibly disclosed the vulnerabilities to AMD back in August 2019. "We are aware of a new white paper that claims potential security exploits in AMD CPUs, whereby a malicious actor could manipulate a cache-related feature to potentially transmit user data in an unintended way," AMD said in an advisory posted on its website over the weekend. "The researchers then pair this data path with known and mitigated software or speculative execution side-channel vulnerabilities. AMD believes these are not new speculation-based attacks." While the notification doesn't go into specifics about mitigating the attack, Vedad Hadžić, one of the key researchers on the paper, said the vulnerability is still open to active exploitation. With Intel coming under scrutiny for a string of flaws in its CPUs — from Meltdown, Spectre, ZombieLoad to the recent unpatchable CSME firmware flaw — the research is a reminder that no processor architecture is fully secure. It's worth noting that some of the co-authors listed in the study were also behind uncovering the Meltdown, Spectre, and ZombieLoad vulnerabilities. Collide+Probe and Load+Reload Attacks Like the Intel Spectre attack, the pair of exploits — dubbed Collide+Probe and Load+Reload — manipulate the aforementioned L1D cache predictor in order to access data that should otherwise be secure and inaccessible. "With Collide+Probe, an attacker can monitor a victim's memory accesses without knowledge of physical addresses or shared memory when time-sharing a logical core," the researchers outlined. "With Load+Reload, we exploit the way predictor to obtain highly-accurate memory-access traces of victims on the same physical core." L1D cache way predictor is an optimization mechanism that aims to reduce the power consumption associated with accessing cached data in memory: "The predictor computes a μTag using an undocumented hash function on the virtual address. This μTag is used to look up the L1D cache way in a prediction table. Hence, the CPU has to compare the cache tag in only one way instead of all possible ways, reducing the power consumption." The newly discovered cache attacks work by reverse-engineering this hashing function to track memory accesses from an L1D cache. While Collide+Probe exploits μTag collisions in AMD's L1D cache way predictor, Load+Reload takes advantage of the way predictor's handling of aliased addresses in the memory. In other words, the two attack techniques can be employed to exfiltrate sensitive data from another process, sharing the same memory as the attacker or a process that's running on a different logical core of the CPU. To demonstrate the impact of the side-channel attacks, the researchers established a cache-based covert channel that exfiltrated data from a process running on the AMD CPU to another stealthy process, achieving a maximum transmission rate of 588.9kB/s using 80 channels in parallel on the AMD Ryzen Threadripper 1920X processor. With AMD's EPYC processors being embraced by popular cloud platforms such as Amazon, Google, and Microsoft, the fact that these attacks can be carried out in a cloud setting poses significant concerns. Furthermore, the security researchers were able to successfully stage a Collide+Probe attack on some common browsers, namely Chrome and Firefox, by bypassing address space layout randomization (ASLR) in browsers, thereby reducing the entropy, and retrieving address information. ASLR is a security implementation that's used to randomize and mask the exact locations of code and key data areas inside a CPU's memory. Put another way, it hinders a potential attacker from guessing target addresses and jumping to specific sections in the memory. "In Firefox, we are able to reduce the entropy by 15 bits with a success rate of 98% and an average run time of 2.33 s (σ=0.03s, n=1000)," the researchers noted. "With Chrome, we can correctly reduce the bits with a success rate of 86.1% and an average run time of 2.90s (σ=0.25s, n=1000)." Subsequently, the researchers used the same Collide+Probe attack to leak kernel memory data and even recover the encryption key from a T-table implementation that stores intermediate results of cryptographic operations using the AES cipher. Mitigating the Attack The good news is that the twin attacks can be mitigated through a variety of hardware-only, hardware and software changes, and software-only solutions — including designing the processor in a way that allows for dynamically disabling the way predictor temporarily and clearing the state of the way predictor when switching between kernel mode and user mode. This is not the first time AMD processors have been found to be vulnerable to CPU attacks, including Spectre, forcing the company to release a slew of patches. It remains to be seen if AMD will fix the flaws highlighted in the new research. We've reached out to AMD for comment and will update the story if we hear back. "

1 0

Cryptocurrency: FedCoin - #1 Shitcoin
by grarpamp 09 Mar '21

09 Mar '21

" Fedcoin: A Central Bank Digital Currency The Fedcoin has bipartisan support. Jay Powell, appointed as Federal Reserve Chairman by President Trump, said in October that the Federal Reserve is conducting research into issuing a digital currency, on its own and also in partnership with other central banks and the Bank for International Settlements. Janet Yellen, appointed as Fed Chair by President Obama, said last week, “It makes sense for central banks to be looking at issuing sovereign digital currencies.” They give different stated reasons. Powell is more conservative, and his focus is on addressing the potential competitive threat of bitcoin and digital currencies from countries such as China. However, if he really wanted to make the dollar more competitive against the yuan, then he would just abuse the Fed’s credit less. Yellen nods to a progressive idea, saying that a Fedcoin, “could help address hurdles to financial inclusion in the U.S. among low-income households.” However, if she really wanted the “unbankables” to be able to open accounts, then she would just repeal anti money laundering and other regulations that penalize a bank for crimes committed by its clients. Both Powell’s and Yellen’s statements are disingenuous. A Fedcoin is coming, because it’s necessary. Allow us to explain the two real reasons. The first is sinister. The second is more pernicious. Why Fedcoin? Two Real Reasons The first reason is the pathological fall of interest rates over the last four decades. Interest in the US dollar has not gone negative yet, though it has in the Swiss franc, the euro, the pound, and the yen. Interest will continue to fall. When the rate goes negative enough, the banks will not be able to hold the line on paying zero interest in deposit accounts. They will be forced to pass through their pain to depositors. This will provide the first incentive to withdraw cash from the banks—thus pulling out capital—since the 1930’s. The paper dollar bill has zero yield. People will prefer zero to negative yield. Free is better than paying to hold your money. The central banks have three ways to try to fight this. One, they could try to impose losses on dollar bills. They could create an algorithm that deducts from the face value, based on serial number. If they roll this out to point-of-sale devices, then every merchant will know the legal tender value of your cash. That “twenty” could actually be worth $19.93. But this seems impractical and confusing. Two, they can demonetize cash. People are given until a certain date to turn in their cash for a credit to their bank accounts. After that, the paper will have no legal tender value. But, as Yellen noted, many people are kept out of the banking system. Or, three, they could issue a Fedcoin and force everyone to trade their paper cash for Fedcoins. Fedcoin would be nothing like bitcoin. Fedcoin would be programmed to erode at a rate to match the Fed’s negative interest rates. Thus, it would not provide a haven to anyone seeking to hold cash to avoid the erosion of bank balances. They will have you totally trapped. This is an extension of the same idea behind banning gold in 1933. The people were disenfranchised, unable to opt out of the government’s debt. The most conservative saver was forced to hold government bonds, rather than gold. Indeed, after that, the definition of risk-free asset is the government bond. After 1975, you can hold gold. But now, it’s not a dollar balance. It has dollar price volatility. Hence, it’s unsuitable for many conservative savers (and financial institutions). If you have a billion dollars of cash, and a liability to pay a billion dollars in two months, then you cannot take the risk on gold. As we write this, the price of gold has dropped $244 dollars since the start of 2021, or about 13% in about two months. An individual may be able to escape the system by buying gold (or bitcoin), however the dollars are trapped in the system. The seller of the gold (or bitcoin) is the new owner of those dollars. And faces the same awful choice of the tiger or the tiger. The Fedcoin will be designed to further tighten the noose. Even cash will become entirely electronic, and subject to slow confiscation. Not by inflation. But by negative interest rates that reduce the account balance. " ... and by inflation, tax theft, bail-ins, bail-outs, war bonds, govt paychecks, debt, etc.

1 0

CNBC: SpaceX wants to connect its Starlink satellite internet network to moving vehicles
by jim bell 09 Mar '21

09 Mar '21

CNBC: SpaceX wants to connect its Starlink satellite internet network to moving vehicles. https://www.cnbc.com/2021/03/08/spacex-wants-to-connect-starlink-satellite-…

2 3

vtdigger.org: Lawmakers skeptical of Starlink solution for broadband problems
by jim bell 09 Mar '21

09 Mar '21

vtdigger.org: Lawmakers skeptical of Starlink solution for broadband problems. https://vtdigger.org/2021/03/07/lawmakers-skeptical-of-starlink-solution-fo…

1 0

Satoshi speculum
by professor rat 08 Mar '21

08 Mar '21

“Whoever Satoshi was, they were very much ‘standing on the shoulders of giants’ – Bitcoin was the culmination of decades of accumulated research and discourse within the Cypherpunk community… https://dailyhodl.com/2021/03/07/new-theory-claims-cryptographer-len-sassam…

4 3

Engadget: Intel is working with DARPA on advanced cloud encryption
by jim bell 08 Mar '21

08 Mar '21

Engadget: Intel is working with DARPA on advanced cloud encryption. https://www.engadget.com/intel-darpa-fully-homomorphic-encryption-security-…

1 0

COINS that might interest cypherpunks
by professor rat 08 Mar '21

08 Mar '21

https://dailyhodl.com/2021/03/08/popular-crypto-trader-explores-three-obscu… “PirateChain is a currency, a unit of exchange in the same way as Bitcoin is or Monero (XMR) is. However, it is the most secure and the most private of all the privacy coins. More private than Monero… [There’s] no option for transparency. Every single peer-to-peer transaction is invisible… Once [a transaction] goes to your wallet, nobody knows how much is in your wallet, whether you sent any out, to where to who you send me ARRR coins nobody else will know. There’s no data on the blockchain to analyze, nothing.” Crypto Rich notes that the head developer at Monero has given the nod to PirateChain, which currently holds a $61 million market cap.

2 1

Influencing oligarchy's crazy community bag
by grarpamp 08 Mar '21

08 Mar '21

> So how do we influence the oligarchy while they surveil us? Historically, revolutionaries would simply drag them out into the street and murder them when things became unfree, untenable, etc. Today the top hier are rapidly installing... distancing, global sensor and self protection systems... capable of detecting discrete and aggregate preliminary moves against them, even mind / market moves, and are beginning to terminate such moves with precision accuracy. You have precious little time left.

3 2

Revolutions famously eat their own
by professor rat 08 Mar '21

08 Mar '21

OKCoin Bans Bitcoin Cash, BSV Citing ‘Misinformation War’ https://decrypt.co/58270/okcoin-bitcoin-cash-sv-craig-wright-misinformation… This is similar to the work I'm doing here banning Nazi's like Batshit Crazy and Zendy Harkness. Good riddance to bad rubbish.

3 2

Revolutions famously eat their own
by professor rat 08 Mar '21

08 Mar '21

"... OKCoin are being censors politics etc, move to a better exchange..." Collectively people get censored all the time - as anti-social criminals...like ' cypherpunk professors ' , Julian Assmange and Pastor Craig. Also its ' Assassination Politics ", not " Assassination Grarpamps ". Anarchists are under zero obligation to recognize the free-speech rights of any known fascists...such as those two Nazi scumbags Harkness and Stasi. When they get physically cancelled ( Deadpools are out one each. 200$ each ) we'll know we're getting somewhere. As Mong said more than once... " When cypherpunks are called terrorists we will have done our job " Chickenshit bitchs leave.

1 0