There is a serious security flaw in billions of Intel CPUs that can let attackers steal confidential data like passwords and encryption keys. Firmware updates can fix it, but at a potential significant performance loss.

Oh no.

  • Eager Eagle@lemmy.worldEnglish
    1·
    2 years ago

    Downfall, Inception, Meltdown, Spectre, I hate to see new vulnerabilities, but their naming choices are solid.

  • hark@lemmy.worldEnglish
    0·
    2 years ago

    Install backdoors and sell that info to governments and companies, then years later reveal the issue to justify downgrading performance of older CPUs to encourage people to upgrade.

  • TimeMuncher2@kbin.social
    0·
    2 years ago

    According to him, billions of Intel processors are affected, which are used in private user computers as well as in cloud servers.
    Update: Intel’s Downfall was closely followed by AMD’s Inception, a newfound security hole affecting all Ryzen and Epyc processors.

    so both desktop and server chips are affected on both cpu manufacturers products. can’t take any measures if your password is online on some server.

    • June@lemm.eeEnglish
      0·
      2 years ago

      From what I’m reading, Inception is a pretty minor vulnerability, especially compared to downfall.

    • TWeaK@lemm.eeEnglish
      0·
      2 years ago

      I was going to say, AMD had a flaw of similar severity. And they won’t have a fix for a few months for most affected CPUs, and that fix will likely incur a loss in performance.

      Basically it sounds like both of these flaws are due to the security chip. I can’t help but feel like these flaws are by design. /tinfoil

  • Veedem@lemmy.worldEnglish
    0·
    2 years ago

    Yikes the performance hit is scary but if you’re running a server, what option do you have?

    • linearchaos@lemmy.worldEnglish
      0·
      2 years ago

      Recall billions of processors?

      I hate Intel as much as the next person, but I don’t want them to disappear overnight generating a unimaginably large processor shortage.

      • Skates@feddit.nlEnglish
        0·
        2 years ago

        Then subsidize them for the recall, and take a percentage of their profits every year until it’s paid back. How is it OK to pass on a manufacturer defect to all consumers?

        • linearchaos@lemmy.worldEnglish
          0·
          2 years ago

          I’m not saying that it’s not a shit sandwich. I am saying that if Intel shut down right now we’d be pretty fucked. It would be far more likely for them to shut down production and walk away, start selling off patents and equipment. The strain it would put on arm to pick up the gauntlet would probably mean you’re not going to see a new cell phone, television or new car for the next few years.

          What the hell are they going to do for a recall anyway? Are you going to have them go back 5 years and try to recreate every model of CPU between then and now? None of those motherboards are going to support new things.

          You get your five or $600 back on your CPU which ends up being $50 by the time it comes out of arbitration, now you need not only a new CPU but a new motherboard.

          It’s like wrecking your 15-year-old beater car, insurance company gives you $150 and says go find yourself a new car.

          edit: Look, Intel is worth 150 billion. if they paid $50 per processor for a couple billion refunds, they’d just go bankrupt. They’re going to run for years subsidized making 0 profit and losing all their talent. It wasn’t their intent to screw it up, but here we are. There’s a patch that makes slow processors slower honestly, that’s the end of their responsibility other than to help people get it installed.

        • linearchaos@lemmy.worldEnglish
          0·
          2 years ago

          We have a lot of that going on, but blame won’t fix the outcome. Can’t pass any laws to fix it, the government is run by the politicians.

  • scottywh@lemmy.worldEnglish
    0·
    2 years ago

    /tinfoilhat

    I admittedly stopped reading halfway through but I feel like these newest vulnerabilities being discovered are probably just fucking government back doors the manufacturers have been forced to include.

    /tinfoilhat

    • luciferofastora@discuss.onlineEnglish
      0·
      2 years ago

      I can’t comment on the general trend, but this specific one seems a bit too circumstantial to be of use for a serious spying effort. You’d have to have the spyware running parallel to the apps usong passwords you want to steal in a specific way.

      The risk exists, which is bad enough for stochastic reasons (eventually, someone will get lucky and manage to grab something sensitive, and since the potential damage from that is incalculable, the impact axis alone drives this into firm "you need to get that fix out asap), but probably irrelevant in terms of consistency, which would be what you’d need to actually monitor anyone.

      If you manage to grab enough info to crack some financial access data, you can steal money. If you can take over some legit online account or obtain some email-password combo, you can sell it. But if you want to monitor what people are doing in otherwise private systems, you need some way to either check on demand or log their actions and periodically send them to your server.

      It would be far more reliable to have injection backdoors to allow you access by virtue of forcing a credential check to come up valid than to hope for the lucky grab of credentials the user might change at an arbitrary moment in time.

    • deranger@lemmy.worldEnglish
      0·
      2 years ago

      Check out the documentary Zero Days (2016) if you haven’t already. That’s not really a tinfoil hat take these days IMO.

      • scottywh@lemmy.worldEnglish
        0·
        2 years ago

        Just means they have to intentionally create new ones to be eventually found for the next generation.

  • dual_sport_dork 🐧🗡️@lemmy.worldEnglish
    0·
    2 years ago

    Ha-ha. My chip’s too old to be affected. I don’t see my architecture on the list.

    I knew putting off upgrading for around a decade would pay off. (Windows Update tells me my PC is not “ready” for Windows 11 due to its hardware, either. Oh no, whatever shall I do.)

    • atticus88th@lemmy.worldEnglish
      0·
      2 years ago

      Dont the older chips suffer from a greater performance drop from spectre and meltdown vulnerabilities?

    • ArcaneSlime@lemmy.dbzer0.comEnglish
      0·
      2 years ago

      This inspires confidence with my 2010 ass toshiba sattelite with an i5 and 8gb DDR3. I need to look and see if mine is too old lol.

  • HexesofVexes@lemmy.worldEnglish
    0·
    2 years ago

    Guess it’s time for another FPS hit…

    While the article says it won’t impact most applications, I suspect it’s closer to saying “won’t impact most applications as much”.

    • ram@feddit.nl
      English
      0·
      2 years ago

      Guess it’s time for another FPS hit…

      Is it August already? Man, time flies.

    • StarDreamer@lemmy.blahaj.zone
      English
      0·
      2 years ago

      I would say you’ll be fine. Most games don’t compile with avx-2 anyways since it’ll crash if you run it on something that doesn’t have them (which is a lot of CPUs) and AVX-512 is straight up only available on Xeons, Epyc and zen 4. Nobody is going to use that for consumer software.

      The only game I can think of using AVX is a Skyrim mod for realistic physics, where the author provided binaries for AVX-2/AVX-512. So it won’t affect most compiled applications much since you need to compile with it first (which almost nobody does).

  • iHUNTcriminals@lemm.eeEnglish
    0·
    2 years ago

    Jokes on them. I’m already watched by criminals and am used to companies throttling products.

    • Gsus4@feddit.nlEnglish
      0·
      2 years ago

      Good supplier for an offline supercluster 😄 I’ll let my grant manager know.