Although CPU bugs are not something new in the security industry, nobody has come out with any proof-of-concept exploits and as it stands, there are no known malware that take advantage of these bugs, although some malware writers have actually used CPU bugs for targeted attacks. It is just a matter of time before we start seeing these sort of attacks used in more devastating ways over the Internet. Intel has provided workarounds to major BIOS vendors for some of these bugs, but who knows which vendor actually uses them? End-users are in the dark as to how to check if they are secure or not. Intel doesn’t provide any test program for this and the worst thing is - some bugs are still not fixed. In other words, Intel has no workaround for it.
it’s possible to make an attack via JavaScript code or just TCP/IP packets storms against Intel based machine. Some of the bugs that will be shown are exploitable via common instruction sequences and by knowing the mechanics behind certain JIT Java-compilers, attackers can force the compiler to do what they want (for example: short nested loops lead to system crashes on many CPUs). CPU bugs have actually contributed in damaging our hard drives without our knowledge.
‘Hack In The Box Security ConfĂ©rence 2008’
No comments:
Post a Comment