A defenseless heart

Intel processors found vulnerability: anyone can enter your house and drag anything from it at a speed of 2000 bytes/s

On January 3, when there were still reports of the highest Christmas trees and the most beautiful gifts in New Year's news feeds, the Project Zero blog appeared that the vulnerabilities of Specter and MeltDown were discovered. About the Project Zero group is only known that this is the Google unit, looking for vulnerabilities in strangers, not Google products. Vulnerability in the programs are daily, vulnerabilities are in browsers, instant messengers, operating systems, “patches”, or patches, and this is a routine. But here it was about the fact that the holes in the processors were discovered.

The heart of the system, the source of her life is what a processor is. No wonder it is called "stone". On this stone there is all high-tech, the whole computer world. And not only computer. The reliability and power of the processor is based on modern human civilization of boundless contacts and free information flows. The processor in high-tech is primary as a stone of Even-Ha Shtiya, on which the Lord created our world. OS, programs, protocols, interfaces live only because the processor works under them, in the depths of the computer. There is nothing without him.

The collective genius of thousands of engineers is compressed in a small silicon rectangle, a genius, every day and hour, an incorporating solutions that allow to accelerate the operation of the processor and computer. One of these decisions was the leading work of the processor that does not wait for the user's solutions, but predicts them, throwing the data that the user can request in certain areas of his memory. If the processor did not guess and the data was not needed, then the rolling back occurs, the instructions are canceled, the processor proceeds to the implementation of the correct instructions. Here, in this mechanism that processor manufacturers have been using for many years, and a hole has opened.

The data requested by the processor, as it turned out, are not always reset. They remain in the processor cache. Mel Tdown's vulnerability allows you to access the computer memory, including the memory of the processor nucleus. Spectre vulnerability opens up access to applications. This is the shortest, most simple and even primitive description of the situation, which is most fully presented on 32 pages of two engineering and scientific articles written by computer guru of the highest category, working at the universities of Pennsylvania, Maryland, Adelaides, Crutz, as well as in Rambus and Cyberus companies. Project Zero refers to these articles, which are clearly not easy to read; To show all the knowledgeable and especially ignorant, what kind of nightmare we are talking about, Michael Schwartz from the University of Technological University made a video.

This is a demonstration of the Meltdown attack, as a result of which Schwartz steals a password with two mouse clicks. It takes 13 seconds.

So, we surrounded ourselves with walls, forged armor, erected barriers, built gearboxes, and some maniacs, like me, even manually sorted out the Firefox browser file to close all the holes in it - and now it turns out that all this is nonsense and wasted, because below the browser, under the programs, under the OS, gaps and rocks through, through the programs, through the programs, through Which anyone can pull out anything from the computer.

This is a disaster, but here we have not even begun to describe its scale and consequences. Because it’s hard to imagine them. A hole in the heart of the system! We all suddenly, overnight, became naked. We can be robbed at any time. How else to explain this? A small door in the back wall, through which anyone can enter your house and drag anything from it at a speed of 2000 bytes per second. At such a speed, the MeltDown prototype works, created in the laboratory. Low speed, but it will be enough to pick up all your passwords and your entire personal correspondence.

This is a nightmare and a collapse. There are vulnerabilities in all Intel processors released since 1995, with the exception of Intel Itanium and Intel Atom, released before 2013. AMD processors are subject only to spectre vulnerabilities. Under the blow, everything, absolutely all computers: desktop, laptops, netbooks, tablets, but also smartphones, because they are ARM processors, and they are also subject to attacks through MeltDown and Specter. Billions of devices that we stand on the tables that we hold in our hands and wear in the pockets with which we go to bed to read before bedtime, and which we look, barely waking up to find out the news and time - all of them are flawed, in all of them there is a hole through which they can look - or is it already looking? - the eye is spy and fumbles the hand in a rubber glove.

The fact is that in the case of Meltdown and Spectre, we cannot know that we are following us and rob us. You are sitting at the computer, corresponding in the chat, and at this time, someone faceless fumbled under your keyboard. But you will never know this, because there are no traces in the log-fiyle.

The virtual machines that we were so proud of, putting them on our computers, turn out to be a soap bubble, because the sweet couple of reptiles Meltdown and Spectre make it possible to penetrate from one virtual machine to another, as well as into the host machine.

With every hour, the list of companies that issue statements about the disaster is increasing. Intel, AMD, ARM, Microsoft, Google, Apple, Amazon, VMware, Ubuntu, Mozilla and so on - they all warn and offer a hurryly made patches. But not a single patch closes the holes completely. There is no saving solution.

And now everything looks different, not the way it looked four days ago, on the last day of last year. Now, strange people who asked, why do you need a race for clock frequencies, which leads to the weight of the software, which, in turn, again leads to the processor race, look differently? After all, the old pentium and Windows XP are enough for life and work, not to mention Core 2 and Ubuntu. But if we all remained on old, decades of regular computers, then how could the economy of continuous sales and uncontrolled consumption exist? Now the overgrown, bearded, ridiculous fat man who called not to use Intel processors looks more likely looks more than Core 2, because they have a deliberately made hole that cannot be closed. Yes, but what can we use it then, dear guru Stolman? Where to get a processor without a hole?

There is a Chinese Longson processor, but there are no guarantees that it does not have a rear door for a spy and open core open for the shmon.

At a frantic pace, working on New Year's holidays, engineers create patches, but the problem is that the processor has to patch up, and this is akin to heart operations.

There is no solution, the exit was not found. Parse reduce the performance of the processor by 30%. The latest, yesterday, the purchased iron thus turns in the jealous of five years ago.

What is the point then in the new computers, which are triumphantly triumphantly shining with the numbers of amazing clock frequency, come from the assembly line and stand in stores? All of them, already released, and those that will be produced are holey machines.

Leaky computers. Leaky processors. Flying life. The holey world.