Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Vulnerability

1/19/2018
09:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Spectre Can Obfuscate Tracking Tools, Too

As the security community learns more about the Spectre vulnerability, clever coders are already finding other exploits. Here's looking at the first of many.

Those doggone programmers. Give them a massive bug and they figure out a way to make it work for them.

Now, if you don't have a programming or geek bone in your body then what follows may seem to be completely impenetrable. You may leave and go sit down with some cocoa without taunts. This isn't for everyone.

OK kids, Mom and Dad out of the room? Let's start.

Serge Guelton was the guy to first figure this out regarding the Spectre vulnerability, and I draw heavily on his blog for the code that illustrates this technique. In fact, to avoid any possible mis-attribution, as well as changes to that code that may occur in the future, I would encourage everyone to check the blog for the actual code that is involved in this. (See New Intel Vulnerability Hits Almost Everyone.)

(Source: Pixabay)
(Source: Pixabay)

Spectre, at the most basic, allows the reading of a memory location on a vulnerable CPU without actually referencing or accessing that location in a programming sense. It can do this on any location, whether protected or not, and that is what is causing all the problems. (See Security Warning: Intel Inside.)

The function that Guelton came up with extends the proof of concept code.

It will first perform a copy from src -- the original program code -- to mem -- the temporary copy that you are making -- to make sure the address is not located on the stack. It will then go on to use the Spectre vulnerability to make a "shadow" copy from mem to dest, where the programmer can manipulate it.

Guelton's function shadow_memcpy uses a global hidden state -- which is the memory cache -- in order to transfer data from one buffer to another one. This hidden state is invisible to tracking tools, and with this technique there is no data dependency existing between src and dest.

The first sneaky trick that can be done with it is an opaque predicate. Data is injected by shadow_memcpy into the predicate Boolean function, but calls to it will always return true -- no matter what data is injected.

This will also work for storing a function pointer, rather than some value. This extends the utility of shadow_memcpy to wrap all sorts of function calls in its protection.

Tracing tools will usually track the use of any register that has been marked as being a symbolic value. They then will try to reconstruct the instructions in a backwards manner. But use of shadow_memcpy will stop this from happening, blocking the tracking tool.

So, what you have, effectively, is a way to hide what you are doing from most tracking tools.

Now, shadow_memcpy may fail in use. It's a timing attack, and multithreaded applications may throw that timing off. Not only that, someone may analyze the treated code by hand and find a pattern that they can recognize. So, this method is not infallible.

However, we are seeing how a bug or flaw can be used by clever programmers to affect others parts of the system or infrastructure. Such cleverness can only be more prevalent as time goes on and we learn more about how vasbt the Spectre vulnerability is.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21742
PUBLISHED: 2021-09-25
There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.
CVE-2020-20508
PUBLISHED: 2021-09-24
Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field.
CVE-2020-20514
PUBLISHED: 2021-09-24
A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.
CVE-2016-6555
PUBLISHED: 2021-09-24
OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in ver...
CVE-2016-6556
PUBLISHED: 2021-09-24
OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This iss...