Episode 357: The Return of Spectre

TechSNAP

New variants, bad patches, busted microcode and devastated performance. It’s a TechSNAP Meltdown and Spectre check up.

Plus Tesla gets hit by Monero Cryptojacking, and a dating site that matches people based on their bad passwords…. So we gave it a go!

Sponsored By:

• iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!
• Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com
• Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean

Links:

• People Are Actually Using a Joke Dating Site That Matches People Based on Their Passwords — This website answers the question no one ever asked: what if you dated someone who used the same password?
• Flight Sim Company Embeds Malware to Steal Pirates' Passwords — Flight sim company FlightSimLabs has found itself in trouble after installing malware onto users' machines as an anti-piracy measure. Code embedded in its A320-X module contained a mechanism for detecting 'pirate' serial numbers distributed on The Pirate Bay, which then triggered a process through which the company stole usernames and passwords from users' web browsers.
• Lessons from the Cryptojacking Attack at Tesla — In cases involving the WannaMine malware, a tool called Mimikatz is used to pull credentials from a computer’s memory to infect other computers on the network. The malware then uses the infected computers’ compute to mine a cryptocurrency called Monero quietly in the background.
• Chef InSpec 2.0 — InSpec is a free open source tool that enables development teams to express security and compliance rules as code. Version 1.0 was about ensuring that applications were set up properly. The new version extends this capability to the cloud where companies are running the applications, allowing teams to test and write rules for compliance with cloud security policy. It supports AWS and Azure and comes with 30 common configurations out of the box including Docker, IIS, NGINX and PostgreSQL.
• meltdownspectre-patches summary on Github — Summary of the patch status for Meltdown / Spectre.
• Spectre & Meltdown Checker for Linux — A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
• FreeBSD Finally Gets Mitigated For Spectre & Meltdown — It's taken a few more weeks longer than most of the Linux distributions to be re-worked for Spectre/Meltdown mitigation as well as DragonFlyBSD, but with FreeBSD Revision 329462 it appears their initial fixes are in place.
• SpeculativeExecutionVulnerabilities - FreeBSD Wiki
• Red Hat Checker
• Debian Checker
• Microsoft's free analytics service sniffs out Meltdown, Spectre patch status — Windows Analytics can now scan enterprise PCs running Windows 10, Windows 8.1 and Windows 7 and report on whether they're prepped to fend off attacks based on the Meltdown and Spectre vulnerabilities.
• KPTI/KAISER Meltdown Initial Performance Regressions — In this post I'll look at the Linux kernel page table isolation (KPTI) patches that workaround Meltdown: what overheads to expect, and ways to tune them. Much of my testing was on Linux 4.14.11 and 4.14.12 a month ago, before we deployed in production. Some older kernels have the KAISER patches for Meltdown, and so far the performance overheads look similar. These results aren't final, since more changes are still being developed, such as for Spectre.
• New Spectre, Meltdown variants leave victims open to side-channel attacks — MeltdownPrime and SpectrePrime, found by Princeton and NVIDIA researchers, may require significant hardware changes to be mitigated.
• Question: How to Lock Down Firefox Addons
• Locking preferences - MozillaZine Knowledge Base
• CCK2 Firefox Lockdown Tool
• Question: Namespaces and sandboxing
• Linux Sandboxing
• Firejail