NetCAT attacks Xeons

[porina]

 

Quote

In late 2011, Intel introduced a performance enhancement to its line of server processors that allowed network cards and other peripherals to connect directly to a CPU's last-level cache, rather than following the standard (and significantly longer) path through the server's main memory. By avoiding system memory, Intel's DDIO—short for Data-Direct I/O—increased input/output bandwidth and reduced latency and power consumption.

 

Now, researchers are warning that, in certain scenarios, attackers can abuse DDIO to obtain keystrokes and possibly other types of sensitive data that flow through the memory of vulnerable servers. The most serious form of attack can take place in data centers and cloud environments that have both DDIO and remote direct memory access enabled to allow servers to exchange data. A server leased by a malicious hacker could abuse the vulnerability to attack other customers. To prove their point, the researchers devised an attack that allows a server to steal keystrokes typed into the protected SSH (or secure shell session) established between another server and an application server.

https://arstechnica.com/information-technology/2019/09/weakness-in-intel-chips-lets-researchers-steal-encrypted-ssh-keystrokes/

 

Another day, another Intel security vulnerability... A feature implemented to allow increased system performance by allowing more direct access to the CPU from peripherals could also be used to access other data. The impact seems limited, in that you have to have a system which uses this direct access method. A home user with a Xeon CPU system would seem unlikely to be affected by this although the vulnerability would still be there.

 

Quote

This issue has a low CVSS base score of 2.6. In scenarios where Intel DDIO and RDMA are enabled, strong security controls on a secured network are required, as a malicious actor would need to have read/write RDMA access on a target machine using Intel DDIO to use this exploit. In the complex scenarios where Intel DDIO and RDMA are typically used, such as massively parallel computing clusters, malicious actors typically don't have direct access from untrusted networks.

https://software.intel.com/security-software-guidance/insights/more-information-netcat

 

Intel's page suggest the features are typically used in scenarios where there are wider controls in place. Personally, I hadn't even heard of DDIO, and although I have heard of RDMA I didn't know what it was. Question to those in large corporate roles, how widely used are these features?

 

Quote

Why the name NetCAT instead of something more frightening?
We do not believe in fear-mongering with our research. NetCAT stands for Network Cache ATtack. “netcat” is also a famous utility that hackers and system administrators use to send information over the network. cat is the UNIX tool to read the contents a file, netcat is supposed to do the same over the network. NetCAT is a pun on being able to read data from the network without cooperation from the other machine on the network. If that is not enough pun already, DDIO makes use of the Cache Allocation Technology (CAT) internally. Finally, who doesn’t like cats?

https://www.vusec.net/projects/netcat/

 

Cats and the internet are still a thing then...

 

[CTR640]

Cats are adorable, I don't see anyting wrong those fluffy animals attacking an evil and lazy company.

[TVwazhere]

This is why I'm a dog person, because they dont bother hacking my Computer. 

 

 /s

[Suppersupport]

nnnnnnnnnnoooooooooooooooooooooooo! the lazy one might get off it's but!

Spoiler

/s. I am 25% sure intel is trying there bestest.

 

[RejZoR]

2 hours ago, CTR640 said:

Cats are adorable, I don't see anyting wrong those fluffy animals attacking an evil and lazy company.

But these aren't ordinary cats. These are NetCATS!

[Fnige]

9 hours ago, RejZoR said:

But these aren't ordinary cats. These are NetCATS!

Now instead of knocking things in real life, its on the internet now!!!1

[5x5]

Lazy-people version (cause I also prefer to listen rather than reading)

 

[Drak3]

On 9/11/2019 at 8:55 AM, TVwazhere said:

This is why I'm a dog person, because they dont bother hacking my Computer. 

 

 /s

 

On 9/11/2019 at 11:45 AM, RejZoR said:

But these aren't ordinary cats. These are NetCATS!

 

On 9/11/2019 at 9:09 PM, SlimyPython said:

Now instead of knocking things in real life, its on the internet now!!!1

[5x5]

https://www.bleepingcomputer.com/news/security/new-netcat-attack-can-leak-sensitive-data-from-intel-cpus/

 

 

So. Althought intel are slightly downplaying what can end up happening, the attack seems relatively easy to deploy and, given intel have known about it for two months, I assume either another firmware patch is imminent, or DDIO is going to have a major revision or end up removed in the next refresh. Not a good look for Intel though

[Gegger]

meow

 

but i'm not surprised for some reason

[FezBoy]

Cat.

[Guest]

Xeon more like Xeoff now lololol

[5x5]

6 hours ago, floofer said:

Xeon more like Xeoff now lololol

I guess at least mainstream users are unaffected this time.

[Fnige]

I honestly feel sorry for intel

 

First, You start seeing Vulnerability after vulnerability where it only affected intel CPUs. Then 3rd gen ryzen came... ouch and then Zombieload now NetCAT

Havent heard of Foreshadow but it comes somewhere around here

 

Intel will probably come back once they catch up on lithography and That Super Mega Company (TSMC) hasn't made 7nm as dense as Intels is predicted to be.

-----------------------------------------------------------------------------------------------------------------------

Also I wonder if the reason that the Ghz is lower is since its like a smaller gap or something?

[Fnige]

8 hours ago, floofer said:

Xeon more like Xeoff now lololol

Xeow

 

Xeon x Meow

[5x5]

1 hour ago, SlimyPython said:

I honestly feel sorry for intel

 

First, You start seeing Vulnerability after vulnerability where it only affected intel CPUs. Then 3rd gen ryzen came... ouch and then Zombieload now NetCAT

Havent heard of Foreshadow but it comes somewhere around here

 

Intel will probably come back once they catch up on lithography and That Super Mega Company (TSMC) hasn't made 7nm as dense as Intels is predicted to be.

-----------------------------------------------------------------------------------------------------------------------

Also I wonder if the reason that the Ghz is lower is since its like a smaller gap or something?

We can only speculate - so far we have no word on Intel's 7nm since it's slated for 2021 meaning it's nowhere near finished. Hopefully clocks are better than their 10nm process since 10nm mobile is getting creamed by their own 14nm parts which is....yeah.

 

Also, the amount of vulnerabilities are starting to get scary - I'm starting to think corporate clients may end up filing a lawsuit (though that would make little sense unless there is proof Intel purposefully left them in) - but yeah, considering the amount of things that have to be disabled for the CPU to be "secure" on professional products like Xeons, I'm left wondering if Marketing will be adjusted to not talk about DDIO or Hyper-Threading at all

[Fnige]

11 hours ago, 5x5 said:

We can only speculate - so far we have no word on Intel's 7nm since it's slated for 2021 meaning it's nowhere near finished. Hopefully clocks are better than their 10nm process since 10nm mobile is getting creamed by their own 14nm parts which is....yeah.

 

Also, the amount of vulnerabilities are starting to get scary - I'm starting to think corporate clients may end up filing a lawsuit (though that would make little sense unless there is proof Intel purposefully left them in) - but yeah, considering the amount of things that have to be disabled for the CPU to be "secure" on professional products like Xeons, I'm left wondering if Marketing will be adjusted to not talk about DDIO or Hyper-Threading at all

Maybe. Just hear me out, Intel is trying their best to fully make a new architecture which is actually way more focused in security while still preforming just as well as their last ones

[5x5]

6 minutes ago, SlimyPython said:

Maybe. Just hear me out, Intel is trying their best to fully make a new architecture which is actually way more focused in security while still preforming just as well as their last ones

Hopefully they are. Cause the current core I architecture is starting to look like Swiss cheese

[Fnige]

10 hours ago, 5x5 said:

Hopefully they are. Cause the current core I architecture is starting to look like Swiss cheese

Its actually that old french cheese that some are crazy over

[Suppersupport]

finally one vulnerability my laptop doesn't get murdered indefinitly by.