More Intel leaks.. this one is not good though

[NumLock21]

3 minutes ago, leadeater said:

Pff use a better tool, always hated AI Suite. Maybe version 3 is better, but 1 and 2 were awful.

I have version 4 and it's the best. Version 5 is stupid with their in way bubble popup design, it does have a new clean up feature.

[NumLock21]

Looks like that cumulative update patch didn't do much?

 

 

Quote

 

The output of this PowerShell script will resemble the following. Enabled protections appear in the output as “True.”

PS C:\> Get-SpeculationControlSettings Speculation control settings for CVE-2017-5715 [branch target injection] Hardware support for branch target injection mitigation is present: True Windows OS support for branch target injection mitigation is present: True Windows OS support for branch target injection mitigation is enabled: True Speculation control settings for CVE-2017-5754 [rogue data cache load] Hardware requires kernel VA shadowing: True Windows OS support for kernel VA shadow is present: True Windows OS support for kernel VA shadow is enabled: True Windows OS support for PCID optimization is enabled: True

 

 

[leadeater]

Just now, NumLock21 said:

I have version 4 and it's the best. Version 5 is stupid with their in way bubble popup design, it does have a new clean up feature.

Oh god, there's a 4 and 5? I'm so out of date .

[79wjd]

3 minutes ago, leadeater said:

but still fine.

At least until last week

[Taf the Ghost]

5 minutes ago, NumLock21 said:

Looks like that cumulative update patch didn't do much?

 

The big BIOS updates are coming next, and those should see even bigger performance hits.

[leadeater]

4 minutes ago, djdwosk97 said:

At least until last week

Shh, I haven't patched so "I'm fine" 

[Notional]

8 minutes ago, NumLock21 said:

I have version 4 and it's the best. Version 5 is stupid with their in way bubble popup design, it does have a new clean up feature.

There is only AI suite 3. Even Intel's z370 uses Suite 3.

[NumLock21]

Just now, Taf the Ghost said:

The big BIOS updates are coming next, and those should see even bigger performance hits.

So to fully patch it, it needs a bios update? I thought this verifying was just to see if that updated being installed was working or not. I doubt my HP will have a new bios update anytime soon.

[leadeater]

1 minute ago, NumLock21 said:

So to fully patch it, it needs a bios update? I thought this verifying was just to see if that updated being installed was working or not. I doubt my HP will have a new bios update anytime soon.

Nope this is only the first update too, and there is likely to be more than one firmware update as well. Rough times ahead.

[Taf the Ghost]

Just now, NumLock21 said:

So to fully patch it, it needs a bios update? I thought this verifying was just to see if that updated being installed was working or not. I doubt my HP will have a new bios update anytime soon.

I don't have too many details, but some of the linked to chatter among people testing it has pointed to a lot more types of updates to go. BIOS updates will be needed for Intel CPUs, which is why this is going to be messy. (It also appears that protection strategies differ by uArch version. Though I think this is more about Spectre 2 rather than Meltdown.)

[Notional]

Ok, quick update on AI suite: Asus has released a beta for it (use at own discretion):

 

https://rog.asus.com/forum/showthread.php?98800-AI-Suite-3-Beta-Version-3-00-10-user-test-report-thread

 

Should work on even old boards like Z87.

[jagdtigger]

2 minutes ago, leadeater said:

You can tell that to my 4930k because it's old as hell now too, but still fine.

Its not that old. My 4670k is faster than a 8400 in terms of single core speed(179 vs 168)... And its not that far in multi core actually, 691 vs 869

https://www.dropbox.com/s/urtredmpdjiz1ow/Capture.PNG?dl=0

[NumLock21]

8 minutes ago, leadeater said:

Nope this is only the first update too, and there is likely to be more than one firmware update as well. Rough times ahead.

 

8 minutes ago, Taf the Ghost said:

I don't have too many details, but some of the linked to chatter among people testing it has pointed to a lot more types of updates to go. BIOS updates will be needed for Intel CPUs, which is why this is going to be messy. (It also appears that protection strategies differ by uArch version. Though I think this is more about Spectre 2 rather than Meltdown.)

Then what's with Microsoft releasing this verifying if your system is protected or not, when it's a series of patches and bios updates. This causes confusion cause some will think by installing whatever that KB patch number was, then they're all good to go, and yet it turns out that's not the case.

 

 

[Taf the Ghost]

5 minutes ago, NumLock21 said:

 

Then what's with Microsoft releasing this verifying if your system is protected or not, when it's a series of patches and bios updates. This causes confusion cause some will think by installing whatever that KB patch number was, then they're all good to go, and yet it turns out that's not the case.

 

 

https://twitter.com/BitsAndChipsEng/status/949693463766945792

 

I can't find the discussion I was seeing yesterday (link of a link of a link), but this is for future issues around Spectre. AMD should be less effected, but we'll see how Microsoft implements the fixes. Plus, we need to remember this isn't the full release of information. That comes next week.

[leadeater]

8 minutes ago, NumLock21 said:

Then what's with Microsoft releasing this verifying if your system is protected or not, when it's a series of patches and bios updates. This causes confusion cause some will think by installing whatever that KB patch number was, then they're all good to go, and yet it turns out that's not the case.

Because Microsoft themselves never said the released update would fix everything and explicitly noted in the KB articles that firmware updates would be required. The PowerShell cmdlet was provided so people could double check if they have applied everything correctly and how and in what way they are protected. The tool can also be used by server administrators to customize the level of protection versus the performance because you might need to turn some of it off and isolate systems in other ways to maintain performance.

 

Blame the confusion on bad reporting.

[NumLock21]

3 minutes ago, Taf the Ghost said:

https://twitter.com/BitsAndChipsEng/status/949693463766945792

 

I can't find the discussion I was seeing yesterday (link of a link of a link), but this is for future issues around Spectre. AMD should be less effected, but we'll see how Microsoft implements the fixes. Plus, we need to remember this isn't the full release of information. That comes next week.

January 9th isn't it.

[Taf the Ghost]

3 minutes ago, NumLock21 said:

January 9th isn't it.

What I've seen, so next Tuesday. I'm actually pretty curious what is left to be announced.

[NumLock21]

10 minutes ago, Taf the Ghost said:

What I've seen, so next Tuesday. I'm actually pretty curious what is left to be announced.

They said these finding wasn't suppose to be announced until Jan 9th due to NDA, but they decided to release it early anyway.

[KopeAcetic]

N/A

 

Sorry please delete post if possible, was not posted in correct area/format.

[Stefan Payne]

Can it get any worse?!

OF course it can!

Seems like Intel knew about it since 2012, proven:

 

Well...

[mr moose]

21 minutes ago, Stefan Payne said:

 

 

Well...

That would be a deep hole with water in the bottom.

 

As far as I know this exploit has been postulated several times from before then even.  That's why so many people have been looking to prove the bug is exploitable.  

[Zodiark1593]

1 hour ago, Stefan Payne said:

Can it get any worse?!

OF course it can!

Seems like Intel knew about it since 2012, proven:

 

Well...

That is a rather generalized slide on the potential security implications of the features being implemented to improve performance, and not necessarily just the several vulnerabilities that have come up recently.

 

It is fair to say that Intel was aware of the potential trade-offs in favor of performance(which you could villify them for if you so desire). However, there is no proof whatsoever that they were aware of these specific vulnerabilities (referring to "Meltdown" and both "Spectres"), or had even managed to compromise their own processor using aforementioned vulnerabilities. 

 

Considering there is a lot going on in keeping multiple pipelines full as much as possible, there is a very high probability of further vulnerabilities (in modern high-performance CPUs) either undiscovered or yet to be disclosed to the public. The ending of the Spectre white paper was particularly concerning in suggesting that the industry quest for performance may have come to the detriment of security. I don't think we've seen the end of this mess with Meltdown and even Spectre.

 

To further provide enlightenment, I should add that ARM had already confirmed the Cortex A75 is vulnerable to Meltdown, alongside the Spectre vulnerabilities. Apple had also provided patches to mitigate against Meltdown in both Mac OS, and iOS, suggesting their custom CPU design may also be affected by Meltdown. Their saving graces being Apple already applied the patches quietly, and Cortex A75 designs are yet to be in the wild. I can provide sources (again) if you ask nicely.

[Tam3n]

9 hours ago, Notional said:

I need it to control my fans. Doing that in EUFI is worse than Intel's CPU security.

Lol, I also uninstalled the update. I need the AI suite 2 to control my fans on my X79, or I will go insane.

[Stefan Payne]

Oh well, seems like I was wrong and there was something prior. Like 5 Years prior...

BSD Mailing List/Bug Tracker...

https://marc.info/?l=openbsd-misc&m=118296441702631&w=2

 

Quote

As I said before, hiding in this list are 20-30 bugs that cannot be worked around by operating systems, and will be potentially exploitable. I would bet a lot of money that at least 2-3 of them are.[/quote]

 

1 hour ago, Tam3n said:

Lol, I also uninstalled the update. I need the AI suite 2 to control my fans on my X79, or I will go insane.

Oh nice.

So every Hacker can read your passwords now...

 

[Bit_Guardian]

8 minutes ago, Stefan Payne said:

Oh well, seems like I was wrong and there was something prior. Like 5 Years prior...

BSD Mailing List/Bug Tracker...

https://marc.info/?l=openbsd-misc&m=118296441702631&w=2

 

Oh for crying out loud would you go away? Of course security research is ongoing for multiple years and theories in their first steps don't bear fruits nor gain credibility for half a decade. This is no different to the fields of quantum physics and Set/Graph Theory. It takes the most brilliant teams nearly a decade to produce results. Fewer and fewer Masters of Research and Ph.Ds are graduating nowadays because the lead time has necessarily increased on genuine research work of the calibre needed to move beyond what we have today.

 

For all the caterwauling, the world would do well to remember Intel got this far on raw iterations of the Core architecture. If you seriously think Intel doesn't have tech ready to yank off the shelf in a new ground-up architecture 7 years later, you're absolutely fooling yourselves. Tons of radical, convention-breaking thought goes into modern solutions in hardware and software, and not one of the giants has gone through the ages unscathed by security problems at the hardware level.

 

Intel will live on just fine, led by some of the very best engineers in the industry. To say otherwise with their diverse portfolio and raw cash reserves capable of correcting any core flaw with a few years' time is outright foolish.