Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Vulnerability

1/19/2018
09:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Spectre Can Obfuscate Tracking Tools, Too

As the security community learns more about the Spectre vulnerability, clever coders are already finding other exploits. Here's looking at the first of many.

Those doggone programmers. Give them a massive bug and they figure out a way to make it work for them.

Now, if you don't have a programming or geek bone in your body then what follows may seem to be completely impenetrable. You may leave and go sit down with some cocoa without taunts. This isn't for everyone.

OK kids, Mom and Dad out of the room? Let's start.

Serge Guelton was the guy to first figure this out regarding the Spectre vulnerability, and I draw heavily on his blog for the code that illustrates this technique. In fact, to avoid any possible mis-attribution, as well as changes to that code that may occur in the future, I would encourage everyone to check the blog for the actual code that is involved in this. (See New Intel Vulnerability Hits Almost Everyone.)

Spectre, at the most basic, allows the reading of a memory location on a vulnerable CPU without actually referencing or accessing that location in a programming sense. It can do this on any location, whether protected or not, and that is what is causing all the problems. (See Security Warning: Intel Inside.)

The function that Guelton came up with extends the proof of concept code.

It will first perform a copy from src -- the original program code -- to mem -- the temporary copy that you are making -- to make sure the address is not located on the stack. It will then go on to use the Spectre vulnerability to make a "shadow" copy from mem to dest, where the programmer can manipulate it.

Guelton's function shadow_memcpy uses a global hidden state -- which is the memory cache -- in order to transfer data from one buffer to another one. This hidden state is invisible to tracking tools, and with this technique there is no data dependency existing between src and dest.

The first sneaky trick that can be done with it is an opaque predicate. Data is injected by shadow_memcpy into the predicate Boolean function, but calls to it will always return true -- no matter what data is injected.

This will also work for storing a function pointer, rather than some value. This extends the utility of shadow_memcpy to wrap all sorts of function calls in its protection.

Tracing tools will usually track the use of any register that has been marked as being a symbolic value. They then will try to reconstruct the instructions in a backwards manner. But use of shadow_memcpy will stop this from happening, blocking the tracking tool.

So, what you have, effectively, is a way to hide what you are doing from most tracking tools.

Now, shadow_memcpy may fail in use. It's a timing attack, and multithreaded applications may throw that timing off. Not only that, someone may analyze the treated code by hand and find a pattern that they can recognize. So, this method is not infallible.

However, we are seeing how a bug or flaw can be used by clever programmers to affect others parts of the system or infrastructure. Such cleverness can only be more prevalent as time goes on and we learn more about how vasbt the Spectre vulnerability is.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: They said you could use Zoom anywhere.......
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13285
PUBLISHED: 2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issue reference number tooltip.
CVE-2020-16087
PUBLISHED: 2020-08-13
An issue was discovered in Zalo.exe in VNG Zalo Desktop 19.8.1.0. An attacker can run arbitrary commands on a remote Windows machine running the Zalo client by sending the user of the device a crafted file.
CVE-2020-17463
PUBLISHED: 2020-08-13
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVE-2019-16374
PUBLISHED: 2020-08-13
Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters of a username, followed by the * character, to bypass access control.
CVE-2020-13280
PUBLISHED: 2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.