June 2022 - cypherpunks - lists.cpunks.org

Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86
by coderman 15 Jun '22

15 Jun '22

https://github.com/FPSG-UIUC/hertzbleed Overview This repository contains the source code to reproduce the experiments of the paper: - [Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86](https://www.hertzbleed.com/hertzbleed.pdf) (USENIX 2022) NB: This source code is CPU-specific. https://github.com/FPSG-UIUC/hertzbleed#tested-setup Tested Setup The code of this repo was fully tested on a bare-metal machine with an Intel i7-9700 CPU. The machine was a stock Dell machine, running Ubuntu 20.04. We do not guarantee that this code works in virtualized environments, on other CPUs, on custom machines, or with other operating systems. Running this code on other CPUs (e.g., see [the paper](https://www.hertzbleed.com/hertzbleed.pdf) for a table with the models we tested), will likely require changing some of the code. https://github.com/FPSG-UIUC/hertzbleed#materials Materials This repository contains the following materials: - 01-leakage-channel-workloads: contains the code that we used to test if the scaling of P-states leaks information about the current workload (Figure 1). - 02-leakage-channel-data: contains the code that we used to test if the scaling of P-states leaks information about the data being processed (Figure 2). - 03-leakage-model-hd: contains the code that we used to test the HD leakage model (Figures 4, 14). - 04-leakage-model-hw: contains the code that we used to test the HW leakage model (Figures 5-7, 15-17). - 05-leakage-model-hd_hw: contains the code that we used to test the additivity of HD and HW (Figure 8). - 06-circl: contains the code that we used to perform the SIKE attack on the circl library. - 07-pqcrypto: contains the code that we used to perform the SIKE attack on the pqcrypto-sidh library. - 08-kaslr: contains the code that we used to perform the timer-free KASLR break. - 09-cc: contains the code that we used to test a timer-free covert channel. - scripts: contains scripts that can be used to run all the leakage model experiments and parse their results. - util: contains scripts that can be used to run all the leakage model experiments and parse their results. We suggest that you run these experiments in order (from 01 to 09). In the paper, we ran some experiments in two setups: with the default system configuration (Turbo Boost on) or with the P-state capped at the base frequency (Turbo Boost off). We provide the scripts to switch between these 2 setups in the scripts folder. https://github.com/FPSG-UIUC/hertzbleed#preliminaries Preliminaries - Install stress-ng using sudo apt install -y stress-ng. - Set up a Python virtual environment as follows: virtualenv -p python3 venv source venv/bin/activate pip install seaborn https://github.com/FPSG-UIUC/hertzbleed#citation Citation If you make any use of this code for academic purposes, please cite the paper: @inproceedings{wan2022hertzbleed, author = {Yingchen Wang and Riccardo Paccagnella and Elizabeth He and Hovav Shacham and Christopher W. Fletcher and David Kohlbrenner}, title = {Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86}, booktitle = {Proc. \ of the USENIX Security Symposium (USENIX)}, year = {2022}, }

2 1

Shulte as Scorpio
by professor rat 15 Jun '22

15 Jun '22

HOW now Nonny know, the suspect’s rights were violated, under the Fourth and Fifth and probably the Sixth and Fourteenth Amendments! https://twitter.com/innercitypress/status/1537128742006493184 WHERE HAVE YOU BEEN! Where the hell does it say that you’ve got a right to kick down doors, torture suspects, deny medical attention and legal counsel? Where have you been? Does Escobedo ring a bell? Miranda? I mean, you must have heard of the Fourth Amendment. What I’m saying is that man had rights!

1 0

A new vulnerability in Intel and AMD CPUs lets hackers steal encryption keys
by jim bell 15 Jun '22

15 Jun '22

A new vulnerability in Intel and AMD CPUs lets hackers steal encryption keys https://share.newsbreak.com/1acrbteo Microprocessors from Intel, AMD, and other companies contain a newly discovered weakness that remote attackers can exploit to obtain cryptographic keys and other secret data traveling through the hardware, researchers said on Tuesday. Hardware manufacturers have long known that hackers can extract secret cryptographic data from a chip by measuring the power it consumes while processing those values. Fortunately, the means for exploiting power-analysis attacks against microprocessors is limited because the threat actor has few viable ways to remotely measure power consumption while processing the secret material. Now, a team of researchers has figured out how to turn power-analysis attacks into a different class of side-channel exploit that's considerably less demanding. Targeting DVFS The team discovered that dynamic voltage and frequency scaling (DVFS)—a power and thermal management feature added to every modern CPU—allows attackers to deduce the changes in power consumption by monitoring the time it takes for a server to respond to specific carefully made queries. The discovery greatly reduces what's required. With an understanding of how the DVFS feature works, power side-channel attacks become much simpler timing attacks that can be done remotely. The researchers have dubbed their attack Hertzbleed because it uses the insights into DVFS to expose—or bleed out—data that's expected to remain private. The vulnerability is tracked as CVE-2022-24436 for Intel chips and CVE-2022-23823 for AMD CPUs. The researchers have already shown how the exploit technique they developed can be used to extract an encryption key from a server running SIKE, a cryptographic algorithm used to establish a secret key between two parties over an otherwise insecure communications channel.

1 0

Re: [ot][spam][crazy][draft] Mind Controlled Utopia #4.327e9
by Undiscussed Horrific Abuse, One Victim of Many 15 Jun '22

15 Jun '22

> > > > I thought of a funny idea for your fiction stories. I noticed in one of > your Wim Hof posts you mention an eeg headband. Why not put an eeg > headband on MCBoss and/or his underlings? Like does MCBoss change in > different brain wave states? > Experimentee: "put on this eeg headband!" MCBoss: "what is this silly toy" Experimentee: "put it on" Boss puts on the eeg headband. Boss: "does it check with the existing computer readings?" Experimentee: "oh no those are all faked by your competitors and contractors and we hacked them to take over your business with you at the helm as a confused buffoon" Boss: "well what does it say?" Researcher: "it says you have a normal brain doing normal things, just like the feeds you sell to others" Boss: "oh that's active. Let me deal with it."

1 2

Audit Of The United States Marshals Service’s Management Of Seized Cryptocurrency
by Digitalfolklore 15 Jun '22

15 Jun '22

Audit Of The United States Marshals Service’s Management Of Seized Cryptocurrency https://archive.org/details/audit-of-the-united-states-marshals-services-ma… VH

1 0

Joshua Schulte is responsible for the largest leak in CIA history?
by professor rat 15 Jun '22

15 Jun '22

I'll see you get the order of Lenin for this! https://twitter.com/innercitypress/status/1536757278157701125 I would call Wikileaks anal-retentive with this dump. But that would be an insult to arseholes.

1 0

Gotta love the Jews
by professor rat 15 Jun '22

15 Jun '22

BGrueskin ·6h Florida synagogue sues over 15-week abortion ban: "In Jewish law, abortion is required if necessary to protect the health, mental or physical well-being of the woman.. the act prohibits Jewish women from practicing their faith free of government intrusion" NAZBOL PUNK GO KILL YOURSELF!

1 0

Re: Schulte has engaged in the legal equivalent of a DDOS attack
by professor rat 15 Jun '22

15 Jun '22

" . . . Schulte figured out how to hot-wire the phone to the light switch. Schulte figured out a way to hot-wire a light switch in his cell so that it worked as a cell-phone charger. (The person who knew Schulte during this period praised his innovation, saying, “After that, all M.C.C. phones were charged that way.”) . . ." And an encrypted drive partition on his laptop? Guy sounds like the reincarnation of Kevin Mitnick.

1 0

Schulte has engaged in the legal equivalent of a DDOS attack
by professor rat 14 Jun '22

14 Jun '22

An ox for the people to ride https://www.emptywheel.net/2022/06/12/josh-schultes-continued-attempts-to-h… Okay - maybe a Musk ox - but you roll with the army you got

2 1

POLITICO: How DOJ took the malware fight into your computer
by jim bell 14 Jun '22

14 Jun '22

POLITICO: How DOJ took the malware fight into your computer. https://www.politico.com/news/2022/06/13/how-doj-took-the-malware-fight-int… In the past year, federal prosecutors and FBI agents have increased their efforts to defeat botnets and contain malware outbreaks by directly removing malicious code from infected computers, without the knowledge or authorization of those computers’ owners. “We have gotten more comfortable, as a government, taking that step,” Adam Hickey, a deputy assistant attorney general for national security, said in an interview at the RSA cybersecurity conference in San Francisco. The latest example of this approach came in April, when U.S. authorities wiped malware off of hacked servers used to control a Russian intelligence agency’s botnet, preventing the botnet’s operators from sending instructions to the thousands of devices they had infected. A year earlier, the Justice Department used an even more expansive version of the same technique to send commands to hundreds of computers across the country that were running Microsoft’s Exchange email software, removing malware planted by Chinese government agents and other hackers. In both cases, federal prosecutors obtained court orders allowing them to access the infected devices and execute code that erased the malware. In their applications for these orders, prosecutors noted that government warnings to affected users had failed to fix the problems, thus necessitating more direct intervention.

3 3