Jump to content

MIT researchers say memory splitting breakthrough could prevent another Meltdown or Spectre


NelsonG

Recommended Posts

Virtually every modern computer processor was thrown under the bus earlier this year when researchers found a fundamental design weakness in Intel, AMD and ARM chips, making it possible to steal sensitive data from the computer’s memory.

The Meltdown and Spectre vulnerabilities — which date back to 1995 — punched holes in the walls that keeps apps from accessing other parts of the system’s memory that it doesn’t have permission to read. That meant a skilled attacker could figure out where sensitive data was stored, like passwords and encryption keys. While the companies mitigated some of the flaws, they acknowledged that their long term plan would require a core redesign in how their computer processors work.

Now, a team of MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) researchers say they have found a way to prevent a similar range of flaws like Meltdown and Spectre in the future.

When an app needs to store something in memory, it asks the processor where to put it. But searching for that memory is slow, so processors use a trick known as “speculative execution” to run several sets of tasks at the same time while it finds the right memory slot. But attackers can exploit the same technique to allow an app to read parts of the memory that it shouldn’t be allowed to read.

MIT’s CSAIL says their technique would split up memory so that the data not stored in the same place — in what the team calls “secure way partitioning.”

They call it called DAWG — or “Dynamically Allocated Way Guard” — which, admittedly might sound ridiculous, but it’s meant to work as a counterpoint to Intel’s Cache Allocation Technology, or CAT. According to their work, DAWG works similarly to CAT and doesn’t require many changes to the device’s operating system — making it potentially as easy to install on an affected computer as Meltdown’s microcode fix.

According to Vladimir Kiriansky, one of the research paper’s authors, the new technique “establishes clear boundaries for where sharing should and should not happen, so that programs with sensitive information can keep that data reasonably secure.”

Not only could the technology help to protect regular computers, but also also vulnerable cloud infrastructures.

Although DAWG can’t prevent against every speculative attack, the researchers are now working to improve their technology to prevent against more — if not all attacks.

But if their technology is picked up by Intel or any other chip maker, the researchers say techniques like DAWG could “restore our confidence in public cloud infrastructure, and hardware and software co-design will help minimize performance overheads.”

Techcrunch?d=2mJPEYqXBVI Techcrunch?d=7Q72WNTAKBA Techcrunch?d=yIl2AUoC8zA Techcrunch?i=EVFwOt6a4Xs:HtutmsOTl6c:-BT Techcrunch?i=EVFwOt6a4Xs:HtutmsOTl6c:D7D Techcrunch?d=qj6IDK7rITs
EVFwOt6a4Xs

View the full article

Link to comment
Share on other sites

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Our picks

    • Wait, Burning Man is going online-only? What does that even look like?
      You could have been forgiven for missing the announcement that actual physical Burning Man has been canceled for this year, if not next. Firstly, the nonprofit Burning Man organization, known affectionately to insiders as the Borg, posted it after 5 p.m. PT Friday. That, even in the COVID-19 era, is the traditional time to push out news when you don't want much media attention. 
      But secondly, you may have missed its cancellation because the Borg is being careful not to use the C-word. The announcement was neutrally titled "The Burning Man Multiverse in 2020." Even as it offers refunds to early ticket buyers, considers layoffs and other belt-tightening measures, and can't even commit to a physical event in 2021, the Borg is making lemonade by focusing on an online-only version of Black Rock City this coming August.    Read more...
      More about Burning Man, Tech, Web Culture, and Live EventsView the full article
      • 0 replies
    • Post in What Are You Listening To?
      Post in What Are You Listening To?
    • Post in What Are You Listening To?
      Post in What Are You Listening To?
    • Post in What Are You Listening To?
      Post in What Are You Listening To?
    • Post in What Are You Listening To?
      Post in What Are You Listening To?
×
×
  • Create New...