November 2023 - cypherpunks - lists.cpunks.org

Re: Special Offer: Complimentary In-Person Pass for Bloomberg Crypto Summit
by Gunnar Larson 16 Nov '23

16 Nov '23

Marie: Just following up on the Bloomberg Crypto Summit access. I am trying to meet a Thanksgiving deadline for a project. Thank you, Gunnar Gunnar Larson xNY.io - Bank.org 917-580-8053 On Fri, Nov 10, 2023, 6:02 PM Gunnar Larson <g(a)xny.io> wrote: > Dear Marie: > > Can I still access a recording to the Bloomberg Crypto Summit? > > Thank you, > > Gunnar > > On Thu, Jul 7, 2022, 1:59 PM Sylvestre, Marie <msylvestre1(a)bloomberg.com> > wrote: > >> Dear Gunnar, >> >> >> >> Thank you for registering to join the *Bloomberg Crypto Summit’s >> <https://events.bloomberglive.com/bloomberg-crypto-summit-new-york-2022/page…>* >> virtual program. >> >> As an executive leader, we would like to offer you a special >> complimentary pass to join the summit’s in-person program in New York. >> Limited complimentary seats are available for the summit’s in-person >> sessions. >> >> *Click here >> <https://events.bloomberglive.com/bloomberg-crypto-summit-new-york-2022/page…>* >> to sign up for a complimentary in-person pass with *promo code* >> *COMP. *Note:* *In-person participation is by invitation. Invitations >> are not transferable.* >> >> *Date &Time* >> Tuesday, July 19, 2022 >> 8:00 AM – 4:00 PM EDT >> >> 8:00 AM – 9:00 AM | *Registration & Networking Breakfast* >> 9:00 AM – 11:45 AM | *Morning Session* >> 12:00 PM – 1:00 PM | *Networking Lunch* >> 1:00 PM – 3:00 PM | *Afternoon Session* >> 3:00 PM – 4:00 PM |*Networking Reception* >> >> >> * Location *Appella >> 450 East 29th Street, 2nd Floor >> New York, NY 10016 >> >> *Click here >> <https://events.bloomberglive.com/bloomberg-crypto-summit-new-york-2022/page…>* >> to sign up for an in-person pass to join us in New York. >> >> If the links above do not work, please copy and paste the following into >> your browser: >> >> https://events.bloomberglive.com/bloomberg-crypto-summit-new-york-2022/page… >> >> >> Kind regards, >> >> Marie Sylvestre >> Bloomberg >> msylvestre1(a)bloomberg.com >> >> >> >

1 0

Women Are Leading the Fight to Stop Climate Change
by Gunnar Larson 16 Nov '23

16 Nov '23

Women Are Leading the Fight to Stop Climate Change https://www.bloomberg.com/news/features/2023-11-16/world-efforts-to-stop-cl… Over the past few years, international climate policy has been shaped largely by a close-knit group of politicians in the twilight of their careers. Now leaders from beyond the traditional US-Europe-China power center—some new to the international stage, others already veterans—are emerging. And women are at the forefront.

1 0

Peter Thiel Is Still Hoping That Donald Trump Just Fades Away
by Gunnar Larson 16 Nov '23

16 Nov '23

Gunnar Donald Arthur Peter Larson ---- Peter Thiel Is Still Hoping That Donald Trump Just Fades Away https://www.bloomberg.com/news/articles/2023-11-16/peter-thiel-is-still-hop… At the end of 2016, Donald Trump and the venture capitalist Peter Thiel sat down to a meeting with a group of the most powerful figures in the tech industry. With Apple (AAPL)’s Tim Cook, Tesla (TSLA)’s Elon Musk, Google (GOOGL)’s Larry Page and Amazon.com (AMZN)’s Jeff Bezos looking on, the president-elect thanked Thiel for his early support. Trump then attempted a sort of handshake. Grabbing Thiel’s hand and lightly patting it, he raised it above the table in a gesture that seemed somewhere between tenderness and triumph.

1 0

Cryptocurrency: Bidenomics FRAUD LIES THEFT and WAR
by grarpamp 16 Nov '23

16 Nov '23

https://twitter.com/DylanLeClair_/status/1724367807909933504 The gaslighting is off the charts. “Simply. Not. True.” This is hillarious. It's the only reason why we have inflation. Goverment over spending. Forcing the FED to over printing and now we have the inflation of a life time 😅🤝

1 0

Cryptocurrency: Action - Comment Period, Shut FINCEN Down, Build and Use Privacy Coins
by grarpamp 16 Nov '23

16 Nov '23

FINCEN Labels All Crypto Users, All Privacy, As Patriot Act Terrorist Criminality, Vows Shutdown and to Arrest Coderpunks https://stacker.news/items/305287/r/BITC0IN https://www.regulations.gov/commenton/FINCEN-2023-0016-0001 https://www.regulations.gov/document/FINCEN-2023-0016-0001 by Fiach_Dubh - announcement /₿egin inspiring cut scene Remember Remember, The 5th of November… Please forgive the pomp as I step up to this virtual soapbox for a little 5th of November chat. You’re sitting at home, looking for something to do while you wait for your favorite TV show to come on this evening. You've got time to kill. Why not give FINCEN and the Treasury Department a good Yellin-g for their presumptive assertion over your right to transact privately. (You have less than 78 days from the time of this post, to make a comment. Anyone can comment, and comment privately. Current comment count stands at 768.) Better still, why not use that time to learn Bitcoin privacy best practices? That’s right anon, today, you’ve been activated, called up for general mobilization in the fight for the sovereign individual. Some of you may remember the last time we went through this 3 years ago. Trump & Mnuchin tried to pull a fast one on us as they were exiting stage right, but failed. Well the Biden admin is trying to do the same thing again, spear headed by Yellen and the Treasury Department/FINCEN. Welcome to the eternal struggle. The powers that be have taken it upon themselves to acquire one more inch of your-selves. Do not give them your silent consent. Proposed FINCEN regulations surrounding Bitcoin privacy tools will not have the effect regulators desire. They will only serve to further drive the concerning activities further underground, where they will achieve full actualization beyond their control. Long term, they embolden the very concerns they hope to suppress. Furthermore, I do not respect their sub-textual assertion of sovereignty over our right to financial privacy. Without economic freedom you cannot have political freedom. By attempting to capture this economic freedom in a surveillance blackbox at FINCEN, they will only galvanize a force against their public offices. Representatives Who Have Volunteered to be on Our Shit List: Treasury Department's General Phone Number: (202) 622-2000 Janet Yellen’s Twitter: https://twitter.com/SecYellen US Treasury Twitter: https://twitter.com/USTreasury Take your right to transact, to transact privately, explicitly, without apology and with righteous authority. You are not consumers or the governed. You are The Citizenry. Act in good faith, be worthy of your freedoms. What you can do: There are four activities that are worthy of your attention today. Choose just one, and then do a second one if you have the time, and comment with which one you did. The first is less meaningful than the second, third and fourth. Submit a comment to the treasury department regarding their misguided attempt at regulating/suppressing Bitcoin privacy enhancing transactions. These rules only serve to ban their fiat institutions from participating in this ecosystem. Anyone can comment, and comment anonymously. Some example templates of comments submitted include: https://twitter.com/FractalEncrypt/status/1719440960281575907 https://twitter.com/skwp/status/1719025440663261376 https://gist.github.com/skwp/16c668bbb96e17f9176d6d4d39cc79fd Or, consider submitting a copy of the Cypherpunk Manifesto for the record. Also, Read It: https://www.activism.net/cypherpunk/manifesto.html The more meaningful act you can do is learn how to use Bitcoin privacy tools. Do a coinjoin and/or payjoin today with joinmarket! Do a payjoin transaction today with a friend! Learn about the benefits and trade offs of privacy enhancing Bitcoin tools like paynym’s, atomic swaps, lightning, and coin selection practices. Buy and sell your Bitcoin KYC free, Peer to Peer. Also, lobby Bitcoin wallet developers to fully support payjoins, coin selection, and other privacy tools. If you want to go a step farther, you could use a combination of these tools and have the coins sent to a SATSCARD or Opendime. This could then be swapped with a friend or group of friends in person for an equivalent amount of Bitcoin for an in person, offchain, ghost coinjoin. There are now countless Bitcoin conferences and local meetups happening all over the world. It would be great if these events coordinated such privacy enhancing activities. Example physical in-person coinjoin event. The third thing you can do is fund open source developers who work on maintaining and improving privacy enhancing tools today. There will be crowdfunders out there on this issue. But more than likely these will raise money for lawyers and lobbyists, who will only talk to senators and congressmen in Washington. This is a horrible use of funds. Rather, Please, directly support developers who are working on the tools we use today for onchain and offchain Bitcoin privacy. A decent list of Bitcoin developers and their Bitcoin donation addresses can be found at https://bitcoindevlist.com (Be sure to support the ones working on Bitcoin Privacy Tools) If you want to send sats via the lightning network to a general fund for this purpose, you can use this page that I maintain to donate sats. I will be sending all collected funds to Bitcoin privacy tool maintainers and developers. But be warned, this platform (geyser) takes a 2% cut, and I could rug pull this donation page at any time. If you don’t want to trust me, then verify by donating directly to developers, not third party middlemen like geyser or myself. Learn the benefits of running a Bitcoin node. Run one, not just for your privacy, but your overall Bitcoin sovereignty. It’s very easy to run a node. You install a program (usually bitcoin core) and let it run. That’s it. This can be done on windows, linux and mac. Go a step further by verifying the binaries of the bitcoin node program you download. Go a step further by building Bitcoin Core from source. Go a step further by running the node over tor or i2p. Go a step further by running a BIP324 node (which will be available in the next release of Bitcoin Core). Thank you for reading and participating in this civil protest. Whether it’s making a comment to FINCEN, phoning your representative, using Bitcoin privacy tools, or just learning about your options to run a Bitcoin node, any of these small steps are ones in the right direction. Any one of these small acts matters. You don't have to do all of them. Just one. Take your pick. Thank You. Onward. https://bitcoinprivacy.me/ https://www.reddit.com/r/Bitcoin/comments/kjr08s/fincen_regulation_megathre… https://mises.org/library/theres-no-political-freedom-without-economic-free… https://www.warren.senate.gov/imo/media/doc/2023.10.17%20Letter%20to%20Trea… https://twitter.com/SecYellen https://twitter.com/USTreasury https://twitter.com/FractalEncrypt/status/1719440960281575907 https://twitter.com/skwp/status/1719025440663261376 https://gist.github.com/skwp/16c668bbb96e17f9176d6d4d39cc79fd https://www.activism.net/cypherpunk/manifesto.html https://www.youtube.com/watch?v=FbyjG2upGO8 https://www.youtube.com/watch?v=9COdlsh4inY https://en.bitcoin.it/wiki/CoinJoin https://en.bitcoin.it/wiki/PayJoin https://en.bitcoin.it/wiki/PayJoin_adoption https://bitcointalk.org/index.php?topic=5433032.0 https://en.bitcoin.it/wiki/Atomic_swap https://lightningprivacy.com/en/introduction https://bitcoin.design/guide/how-it-works/coin-selection/ https://bitcoiner.guide/nokyconly/ https://twitter.com/BITCOINALLCAPS/status/1720519789452374298 https://medium.com/@Fiach_dubh/off-chain-bitcoin-swaps-with-the-satscard-94… https://bitcoindevlist.com/ https://geyser.fund/project/supportbitcoinprivacydevs https://blog.lopp.net/securing-your-financial-sovereignty/ https://bitcoincore.org/ https://www.youtube.com/watch?v=U0I-ImS_r8o https://dev-notes.eu/2020/10/Build-Bitcoin-Core-in-Ubuntu/ https://www.youtube.com/watch?v=goTkOt8Rr1Q https://github.com/bitcoin-core/bitcoin-devwiki/wiki/26.0-Release-Notes-Dra… https://old.reddit.com/r/Bitcoin/comments/kjr08s/fincen_regulation_megathre… https://old.reddit.com/r/Bitcoin/comments/17o3v8v/fincen_megathread_do_not_… https://twitter.com/SenWarren United States Senator 309 Hart Senate Office Building Washington DC 20510 (202) 224-4543 https://twitter.com/RogerMarshallMD United States Senator 479A Russell Senate Office Building Washington DC 20510 (202) 224-4774 https://twitter.com/SenJohnKennedy United States Senator John, Kennedy United States Senator (202) 224-4623 Sherrod Brown United States Senator (202) 224-2315 Jeanne Shaheen United States Senator (202) 224-2841 Chris Van Hollen United States Senator (202) 224-4654 Ben Ray Luján United States Senator (202) 224-6621 Joe Manchin III United States Senator (202) 224-3954 John Fetterman United States Senator (202) 224-4254 Jack Reed United States Senator (202) 224-4642 Michael F. Bennet United States Senator (202) 224-5852 Tina Smith United States Senator (202) 224-5641 Sheldon Whitehouse United States Senator (202) 224-2921 Mark R. Warner United States Senator (202) 224-2023 Jon Tester United States Senator (202) 224-2644 Tim Kaine United States Senator (202) 224-4024 Margaret Wood Hassan United States Senator (202) 224-3324 John Hickenlooper United States Senator (202) 224-5941 Angus S. King, Jr. United States Senator (202) 224-5344 Raphael Warnock United States Senator (202) 224-3643 Christopher A. Coons United States Senator (202) 224-5042 Catherine Cortez Masto United States Senator (202) 224-3542 Sheldon Whitehouse United States Senator (202) 224-2921 Gary C. Peters United States Senator (202) 224-6221 Mark Kelly United States Senator (202) 224-2235 Cory A. Booker United States Senator (202) 224-3224 Benjamin L. Cardin United States Senator (202) 224-4524 Richard Blumenthal United States Senator (202) 224-2823 Christopher S. Murphy United States Senator (202) 224-4041 Amy Klobuchar United States Senator (202) 224-3244 Emanuel Cleaver, II Member of Congress (202) 225-4535 Dan Goldman Member of Congress (202) 225-7944 Steven Horsford Member of Congress (202) 225-9894 Marcy Kaptur Member of Congress (202) 225-4146 Chris Pappas Member of Congress (202) 225-5456 Katie Porter Member of Congress (202) 225-5611 Eric Swalwell Member of Congress (202) 225-5065 Juan Vargas Member of Congress (202) 225-8045 Brad Sherman Member of Congress Ranking Member (202) 225-5911 Mikie Sherrill Member of Congress (202) 225-5034 Chris Deluzio Member of Congress (202) 225-2301 Val Hoyle Member of Congress (202) 225-6416 Ann McLane Kuster Member of Congress (202) 225-5206 Jared Moskowitz Member of Congress (202) 225-3001 Jamie Raskin Member of Congress (202) 225-5341 Raja Krishnamoorthi Member of Congress (202) 225-3711 James P. McGovern Member of Congress (202) 225-6101 Elissa Slotkin Member of Congress (202) 225-4872 Chrissy Houlahan Member of Congress (202) 225-4315 Raúl M. Grijalva Member of Congress (202) 225-2435 Bill Foster Member of Congress (202) 225-3515 Colin Z. Allred Member of Congress (202) 225-2231 Sara Jacobs Member of Congress (202) 225-2040 Troy Carter Member of Congress (202) 225-6636 Mike Levin Member of Congress (202) 225-3906 David Scott Member of Congress (202) 225-2939 Seth Moulton Member of Congress (202) 225-8020 Becca Balint Member of Congress (202) 225-4115 Jason Crow Member of Congress (202) 225-7882 Morgan McGarvey Member of Congress (202) 225-5401 Jan Schakowsky Member of Congress (202) 225-2111 Barbara Lee Member of Congress (202) 225-2661 Lori Trahan Member of Congress (202) 225-3411 Haley M. Stevens Member of Congress (202) 225-8171 Jake Auchincloss Member of Congress (202) 225-5931 Norma J. Torres Member of Congress (202) 225-4361 Nydia M. Velázquez Member of Congress (202) 225-2361 Jill Tokuda Member of Congress (202) 225-4906 Sheila Cherfilus-McCormick Member of Congress (202) 225-1313 Sylvia R. Garcia Member of Congress (202) 225-8203 Al Green Member of Congress (202) 225-2811 Joyce Beatty Member of Congress (202) 225-4324 Stephen F. Lynch Member of Congress (202) 225-8273 David J. Trone Member of Congress (202) 225-2721 Madeleine Dean Member of Congress (202) 225-4731 Pramila Jayapal Member of Congress (202) 225-3106 Lauren Underwood Member of Congress (202) 225-2976 Veronica Escobar Member of Congress (202) 225-4831 Salud Carbajal Member of Congress (202) 225-3601 Greg Stanton Member of Congress (202) 225-9888 Nikema Williams Member of Congress (202) 225-3801 Dean Phillips Member of Congress (202) 225-2871 Debbie Wasserman Schultz Member of Congress (202) 225-7931 Donald G. Davis Member of Congress (202) 225-3101 Abigail Davis Spanberger Member of Congress (202) 225-2815 Jerrold Nadler Member of Congress (202) 225-5635 Eleanor Holmes Norton Member of Congress (202) 225-8050 Steve Cohen Member of Congress (202) 225-3265 Frederica S. Wilson Member of Congress (202) 225-4506 Adam B. Schiff Member of Congress (202) 225-4176 Linda T. Sánchez Member of Congress (202) 225-6676 Jennifer L. McClellan Member of Congress (202) 225-6365 Henry C. "Hank" Johnson, Jr. Member of Congress (202) 225-1605 Kevin Mullin Member of Congress (202) 225-3531 Mark Pocan Member of Congress (202) 225-2906 Luis Correa Member of Congress (202) 225-2965 Mike Quigley Member of Congress (202) 225-4061 D Lois Frankel Member of Congress (202) 225-9890 D Deborah K. Ross Member of Congress (202) 225-3032 D Jim Himes Member of Congress (202) 225-5541 D Joe Courtney Member of Congress (202) 225-2076 D Ruben Gallego Member of Congress (202) 225-4065 D Josh Gottheimer Member of Congress (202) 225-4465 D Lisa Blunt Rochester Member of Congress (202) 225-4165 D Shri Thanedar Member of Congress (202) 225-5802

1 2

Cryptocurrency: ChatBTC - Crypto AI For Dummies
by grarpamp 16 Nov '23

16 Nov '23

https://chat.bitcoinsearch.xyz/ Bull market is coming. Aunt Karen awakens from hibernation. She asks you 101 questions about #bitcoin But this time you have a way out. Introducing... ChatBTC. The AI that guides Aunt Karen down the rabbit hole, freeing up your precious time. https://twitter.com/TheOrangeMart

1 0

83 Highlights to New York State Executive Law, Article 15 HUMAN RIGHTS LAW
by Gunnar Larson 16 Nov '23

16 Nov '23

83 Highlights to New York State Executive Law, Article 15 HUMAN RIGHTS LAW: https://drive.google.com/file/d/1pGXpOcskWOZqqzQcVyLg4yBcQC2UcY2Q/view?usp=… § 290. Purposes of article. 1. This article shall be known as the "Human Rights Law". 2. It shall be deemed an exercise of the police power of the state for the protection of the public welfare, health and peace of the people of this state, and in fulfillment of the provisions of the constitution of this state concerning civil rights. 3. The legislature hereby finds and declares that the state has the responsibility to act to assure that every individual within this state is afforded an equal opportunity to enjoy a full and productive life and that the failure to provide such equal opportunity, whether because of discrimination, prejudice, intolerance or inadequate education, training, housing or health care not only threatens the rights and proper privileges of its inhabitants but menaces the institutions and foundation of a free democratic state and threatens the peace, order, health, safety and general welfare of the state and its inhabitants. A division in the executive department is hereby created to encourage programs designed to insure that every individual shall have an equal opportunity to participate fully in the economic, cultural and intellectual life of the state; to encourage and promote the development and execution by all persons within the state of such state programs; to eliminate and prevent discrimination in employment, in places of public accommodation, resort or amusement, in educational institutions, in public services, in housing accommodations, in commercial space and in credit transactions and to take other actions against discrimination as herein provided; and the division established hereunder is hereby given general jurisdiction and power for such purposes. 298-a. Application of article to certain acts committed outside the state of New York. 1. The provisions of this article shall apply as hereinafter provided to an act committed outside this state against a resident of this state or against a corporation organized under the laws of this state or authorized to do business in this state, if such act would constitute an unlawful discriminatory practice if committed within this state. 2. If a resident person or domestic corporation violates any provision of this article by virtue of the provisions of this section, this article shall apply to such person or corporation in the same manner and to the same extent as such provisions would have applied had such act been committed within this state except that the penal provisions of such article shall not be applicable. 3. If a non-resident person or foreign corporation violates any provision of this article by virtue of the provisions of this section, such person or corporation shall be prohibited from transacting any business within this state...

1 0

Israel Latest: UN Security Council Backs Call for Gaza Truce
by Gunnar Larson 16 Nov '23

16 Nov '23

Israel Latest: UN Security Council Backs Call for Gaza Truce https://www.bloomberg.com/news/articles/2023-11-15/israel-latest-troops-ent… The United Nations Security Council approved a resolution calling for humanitarian pauses in the fighting in Gaza and the release of all hostages held by Hamas, after four similar measures were blocked since the war began.

1 0

AnandTech: Kioxia's CD8P SSD Unveiled: Up to 30.72 TB, PCI 5.0 x4 Interface
by jim bell 15 Nov '23

15 Nov '23

30 terabytes. A million times larger than the biggest I ever sold, in 1992. 31 years ago. Inventor of the SSD, 1980. 43 years ago. Jim Bell, SemiDisk Systemshttps://www.anandtech.com/show/19998/kioxias-cd8p-ssd-unveiled-up-to…

2 2

Hacks: Reptar - Intel Fucks Itself, And You, Again
by grarpamp 15 Nov '23

15 Nov '23

Under the cover of 10's of Billions of gates on die... Half the "bugs" are intentional "features" aka: exploits. The rest are fuckups. Intel is building USA fabs to "secure" its compute, lol. #OpenFabs #OpenHW https://lock.cmpxchg8b.com/reptar.html Reptar Tavis Ormandy Introduction Discovery Solution Notes We have a CPU mystery! We found a way to cause some processors to enter a glitch state where the normal rules don’t apply, but what does that mean…? If you’re interested what can go wrong inside modern CPUs, read on! Introduction If you’ve ever written any x86 assembly at all, you’ve probably used rep movsb. It’s the idiomatic way of moving memory around on x86. You set the source, destination, direction and the count - then just let the processor handle all the details! lea rdi, [rel dst] lea rsi, [rel src] std mov rcx, 32 rep movsb The actual instruction here is movsb, the rep is simply a prefix that changes how the instruction works. In this case, it indicates that you want this operation repeated multiple times. There are lots of other prefixes too, but they don’t all apply to every instruction. Prefix Decoding An interesting feature of x86 is that the instruction decoding is generally quite relaxed. If you use a prefix that doesn’t make sense or conflicts with other prefixes nothing much will happen, it will usually just be ignored. This fact is sometimes useful; compilers can use redundant prefixes to pad a single instruction to a desirable alignment boundary. Take a look at this snippet, this is exactly the same code as above, just a bunch of useless or redundant prefixes have been added: rep lea rdi, [rel dst] cs lea rsi, [rel src] gs gs gs std repnz mov rcx, 32 rep rep rep rep movsb Perhaps the most interesting prefixes are rex, vex and evex, all of which change how subsequent instructions are decoded. Let’s take a look at how they work. The REX prefix The i386 only had 8 general purpose registers, so you could specify which register you want to use in just 3 bits (because 2^3 is 8). The way that instructions were encoded took advantage of this fact, and reserved just enough bits to specify any of those registers. Simple 2-byte instructions that use modr/m might be encoded like this, for example mov eax, ebx. This is an 8-bit opcode, 2 bit addressing mode (labeled m), and 3 bits each for the source (s) and destination (d). Well, this is a problem, because x86-64 added 8 additional general purpose registers. We now have sixteen possible registers..that’s 2^4, so we’re going to need another bit! 😆 The solution to this is the rex prefix, which gives us some spare bits that the next instruction can borrow. When we’re talking about rex, we usually write it like this: rex.rxb rex is a single-byte prefix, the first four bits are mandatory and the remaining four bits called b, x, r and w are all optional. If you see rex.rb that means only the r and b bits are set, all the others are unset. These optional bits give us room to encode more general purpose registers in the following instruction. The rex prefix can lend the next instruction extra bits to use for operands, so now we can encode all 16 possible general purpose registers! Now we’re fine until someone adds another register! 😂 Encoding Rules So now we know that rex increases the available space for encoding operands, and that useless or redundant prefixes are usually ignored on x86. So… what should this instruction do? rex.rxb rep movsb The movsb instruction doesn’t have any operands - they’re all implicit - so any rex bits are meaningless, right? If you guessed that the processor will just silently ignore the rex prefix, you would be correct! Well… except on machines that support a new feature called fast short repeat move! We discovered that a bug with redundant rex prefixes could interact with this feature in an unexpected way and introduce a serious vulnerability, oops 🙂 Fast Short Repeat Move FSRM is a new feature introduced in Ice Lake that fixes some of the shortcomings of ERMS. Hopefully that clears up any confusion. 😆 Just kidding, let’s quickly look at ERMS. The hard part of moving strings around efficiently is getting all the buffers aligned so you can use the widest possible stores available. You could do this in software, but if we do it in microcode then the processor can just transparently make your existing code faster for you. This requires some expensive setup, but once that’s done you get vastly improved throughput. This feature is known as enhanced repeat move/store, ERMS. If you have a processor with ERMS support, simple rep movsb operations can sometimes perform comparably with more complicated hand-tuned vector move operations. However, there is a problem with ERMS. That initial setup is so expensive that it just isn’t worth it for very short strings. This is what FSRM is designed to solve, it handles the case of only moving 128 bytes or less and makes that faster too! I’m not aware of any documentation that explains exactly how FSRM works, but you can check if you have a processor that supports it by looking at the flags line in /proc/cpuinfo: flags : fpu vme de pse tsc msr pae mce cx8 [...] fsrm Some of the processors that have this feature include: Ice Lake Rocket Lake Tiger Lake Raptor Lake Alder Lake Sapphire Rapids Note: This list may not be comprehensive, please see Intel advisory INTEL-SA-00950 for a complete list. Discovery I’ve written previously about a processor validation technique called Oracle Serialization that we’ve been using. The idea is to generate two forms of the same randomly generated program and verify their final state is identical. You can read more about Oracle Serialization in my previous writeup. In August, our validation pipeline produced an interesting assertion. It had found a case where adding redundant rex.r prefixes to an FSRM optimized rep movs operation seemed to cause unpredictable results. We observed some very strange behavior while testing. For example, branches to unexpected locations, unconditional branches being ignored and the processor no longer accurately recording the instruction pointer in xsave or call instuctions. Oddly, when trying to understand what was happening we would see a debugger reporting impossible states! This already seemed like it could be indicative of a serious problem, but within a few days of experimenting we found that when multiple cores were triggering the same bug, the processor would begin to report machine check exceptions and halt. We verified this worked even inside an unprivileged guest VM, so this already has serious security implications for cloud providers. Naturally, we reported this to Intel as soon as we confirmed this was a security issue. Reproduce We’re publishing all of our research today to our security research repository. If you want to reproduce the vulnerability you can use our icebreak tool, I’ve also made a local mirror available here. $ ./icebreak -h usage: ./icebreak [OPTIONS] -c N,M Run repro threads on core N and M. -d N Sleep N usecs between repro attempts. -H N Spawn a hammer thread on core N. icebreak: you must at least specify a core pair with -c! (see -h for help) The testcase enters what should be an infinite loop, and unaffected systems should see no output at all. On affected systems, a . is printed on each successful reproduction. $ ./icebreak -c 0,4 starting repro on cores 0 and 4 ......................................................................... ......................................................................... ......................................................................... ......................................................................... ......................................................................... In general, if the cores are SMT siblings then you may observe random branches and if they’re SMP siblings from the same package then you may observe machine checks. If you do not specify two different cores, then you might need to use a hammer thread to trigger a reproduction. Analysis We know something strange is happening, but how microcode works in modern systems is a closely guarded secret. We can only theorize about the root cause based on observations. μops The CPU is split in two major components, the frontend and the backend. The frontend is responsible for fetching instructions, decoding them and generating μops to send to the backend for execution. The backend executes instructions out of order, and uses a unit called the ROB, reorder buffer, to store and organize results. We believe this bug causes the frontend to miscalculate the size of the movsb instruction, causing subsequent entries in the ROB to be associated with incorrect addresses. When this happens, the CPU enters a confused state that causes the instruction pointer to be miscalculated. The machine can eventually recover from this state, perhaps with incorrect intermediate results, but becoming internally consistent again. However, if we cause multiple SMT or SMP cores to enter the state simultaneously, we can cause enough microarchitectural state corruption to force a machine check. Questions I’m sure some readers will have questions about what is possible in this unexpected “glitch” state. Well, so do we! We know that we can corrupt the system state badly enough to cause machine check errors, and we’ve also observed threads interfere with execution of processes scheduled on SMT siblings. However, we simply don’t know if we can control the corruption precisely enough to achieve privilege escalation. I suspect that it is possible, but we don’t have any way to debug μop execution! If you’re interested in studying this, then we would love to get your input! Credit This bug was independently discovered by multiple research teams within Google, including the silifuzz team and Google Information Security Engineering. The bug was analyzed by Tavis Ormandy, Josh Eads, Eduardo Vela Nava, Alexandra Sandulescu and Daniel Moghimi. Solution Intel have published updated microcode for all affected processors. Your operating system or BIOS vendor may already have an update available! Workaround If you can’t update for some reason, you could disable fast strings via the IA32_MISC_ENABLE model specific register. This will cause a significant performance penalty, and should not be used unless absolutely necessary. Notes If you’re interested in more CPU bugs, we publish everything we find! Not all the bugs we discover have security consequences, but they’re usually worth reading! For example, did you know that sometimes movlps just doesn’t work? or that registers can sometimes roll back to previous values? HOME • ABOUT • CONTACT

1 0