Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Vulnerability

1/19/2018
09:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Spectre Can Obfuscate Tracking Tools, Too

As the security community learns more about the Spectre vulnerability, clever coders are already finding other exploits. Here's looking at the first of many.

Those doggone programmers. Give them a massive bug and they figure out a way to make it work for them.

Now, if you don't have a programming or geek bone in your body then what follows may seem to be completely impenetrable. You may leave and go sit down with some cocoa without taunts. This isn't for everyone.

OK kids, Mom and Dad out of the room? Let's start.

Serge Guelton was the guy to first figure this out regarding the Spectre vulnerability, and I draw heavily on his blog for the code that illustrates this technique. In fact, to avoid any possible mis-attribution, as well as changes to that code that may occur in the future, I would encourage everyone to check the blog for the actual code that is involved in this. (See New Intel Vulnerability Hits Almost Everyone.)

(Source: Pixabay)
(Source: Pixabay)

Spectre, at the most basic, allows the reading of a memory location on a vulnerable CPU without actually referencing or accessing that location in a programming sense. It can do this on any location, whether protected or not, and that is what is causing all the problems. (See Security Warning: Intel Inside.)

The function that Guelton came up with extends the proof of concept code.

It will first perform a copy from src -- the original program code -- to mem -- the temporary copy that you are making -- to make sure the address is not located on the stack. It will then go on to use the Spectre vulnerability to make a "shadow" copy from mem to dest, where the programmer can manipulate it.

Guelton's function shadow_memcpy uses a global hidden state -- which is the memory cache -- in order to transfer data from one buffer to another one. This hidden state is invisible to tracking tools, and with this technique there is no data dependency existing between src and dest.

The first sneaky trick that can be done with it is an opaque predicate. Data is injected by shadow_memcpy into the predicate Boolean function, but calls to it will always return true -- no matter what data is injected.

This will also work for storing a function pointer, rather than some value. This extends the utility of shadow_memcpy to wrap all sorts of function calls in its protection.

Tracing tools will usually track the use of any register that has been marked as being a symbolic value. They then will try to reconstruct the instructions in a backwards manner. But use of shadow_memcpy will stop this from happening, blocking the tracking tool.

So, what you have, effectively, is a way to hide what you are doing from most tracking tools.

Now, shadow_memcpy may fail in use. It's a timing attack, and multithreaded applications may throw that timing off. Not only that, someone may analyze the treated code by hand and find a pattern that they can recognize. So, this method is not infallible.

However, we are seeing how a bug or flaw can be used by clever programmers to affect others parts of the system or infrastructure. Such cleverness can only be more prevalent as time goes on and we learn more about how vasbt the Spectre vulnerability is.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22953
PUBLISHED: 2021-09-23
A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"
CVE-2021-22016
PUBLISHED: 2021-09-23
The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link.
CVE-2021-22017
PUBLISHED: 2021-09-23
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
CVE-2021-22018
PUBLISHED: 2021-09-23
The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files.
CVE-2021-22019
PUBLISHED: 2021-09-23
The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition.