Major Intel CPU vulnerability
-
@zachary715 said in Major Intel CPU vulnerability:
I just would have thought some of these providers were large enough to justify disclosure
There is an easy guide for where to draw the line - anyone who purchased an Intel CPU was big enough to have gotten the flaw, and therefore had a right to know the instant Intel found out. Intel has an ethical, and hopefully legal, obligation to have informed their customers that they were (and are) at risk. Knowing that there was this risk and intionally hiding it should have major legal ramifications, beyond the financial ones.
There might be a time where it is okay to find a security hole and try to patch it. But once you are telling SOME customers, and not others, you've crossed a serious line.
For example, what if one of the big customers that they told was the NSA or the Russian or Chinese government, or some hacker group, a malware vendor, or anyone who has employees that aren't 100% trusted? These are big vendors with hundreds of thousands of employees to which this was disclosed. And we know that it was leaked to the public. That means that the bad guys knew before it went public.
I think that people are overlooking how insanely bad and anti-secure it is to pick a few giant companies to tell, but not others. It's not just that Intel likes those few and doesn't like the others. It's that Intel actively disclosed to a few companies how they could hack all of Intel's other customers.
Intel forced all of us to trust not only Intel (whom I no longer trust) but anyone that Intel trusted without telling us that they were selling out our security secrets.
-
Think of it another way, imagine if Intel made door locks. They discover that there is a way to unlock the doors without the key. They then call a bunch of your competitors and tell them about how your doors can be bypassed without you knowing.
That's exactly what Intel did. They sold the security secrets of the many, to a few partners with the deepest pockets. As far as I'm concerned, people should be going to jail over this.
-
@storageninja said in Major Intel CPU vulnerability:
It takes 3 seconds to look at his stock trades and see the pattern, and another 5 minutes to see that he filed paperwork for this plan back in 2015
At the end of Q4 he sells his awards. Nothing to see here fake news from the internet mob who's too lazy to learn basic finance skills.
You sure about those details?
-
Pretty cut and dry insider trading, I wonder how much of hiding this flaw from the public was solely to hide the insider trading?
" To avoid charges of trading on insider knowledge, executives often put in place plans that automatically sell a portion of their stock holdings or exercise some of their options on a predetermined schedule, typically referred to as Rule 10b5-1(c) trading plans. According to an SEC filing, the holdings that Krzanich sold in November — 245,743 shares of stock he owned outright and 644,135 shares he got from exercising his options — were divested under just such a trading plan.
But Krzanich put that plan in place only on October 30, according to the filing. "
-
@scottalanmiller said in Major Intel CPU vulnerability:
@storageninja said in Major Intel CPU vulnerability:
It takes 3 seconds to look at his stock trades and see the pattern, and another 5 minutes to see that he filed paperwork for this plan back in 2015
At the end of Q4 he sells his awards. Nothing to see here fake news from the internet mob who's too lazy to learn basic finance skills.
You sure about those details?
It very well may not be the case... I mean, 5 minutes and 3 seconds of research is barely anything.
-
Of course, Intel is the same vendor that sells the majority of the world's FakeRAID. So what do we really expect?
-
-
@scottalanmiller said in Major Intel CPU vulnerability:
Pretty cut and dry insider trading, I wonder how much of hiding this flaw from the public was solely to hide the insider trading?
" To avoid charges of trading on insider knowledge, executives often put in place plans that automatically sell a portion of their stock holdings or exercise some of their options on a predetermined schedule, typically referred to as Rule 10b5-1(c) trading plans. According to an SEC filing, the holdings that Krzanich sold in November — 245,743 shares of stock he owned outright and 644,135 shares he got from exercising his options — were divested under just such a trading plan.
But Krzanich put that plan in place only on October 30, according to the filing. "
The plan was created in 2015 per Bloomberg.
You can also see the history of transactions here.Since the plan was set up, Krzanich has had a common trading pattern. In February, he gets his equity payout under Intel’s performance-based incentive plan. For fiscal years 2015, 2016 and 2017, he received 89,581, 87,061 and 278,868 shares, respectively. Then in the last quarter of each of those years, he makes sales that are proportionate to the awards he got. In the last quarter of 2015, he sold 70,000 and in 2016 he sold more than 50,000. And this year, the sale was much larger in light of the large payout he got in February.
Looks like he traded on 11/29.
Market Close was at $43.95 that day. Market Close today is $44.74 today. I expect Intel shares to go up as people realize public clouds need to buy 20% more compute this quarter (and it's too late to qualify to move those workloads to ARM/AMD systems, nor can AMD/GF handle an order that large).While I know insider trading doesn't require you actually make money off of it, I'd argue he missed out on gains by not waiting to sell until now. Intel is clearly fine, and while this is painful for a lot of people who have to go do patching, the market isn't punishing Intel in any serious way.
Note: the stock has doubled under Brian as CEO. This design decision was made in 1995 (well technically earlier given how long it takes to get something out the door).
Equifax is different in that their trades were NOT scheduled. Those yahoos are going to jail or to pay a token fine and promise not to do it again.
Also, EqualFax has only recovered 1/2 of its losses from the breach.Full SEC yadayadayada disclaimer, I hold no Intel, but am considering a long position in the near future.
-
Do we have to patch for this?
I can see cloud/providers patching of course, as its shared infrastructure. However, we run everything on our own completely owned hardware, in the office. The host/VMs running on our local servers are our hosts and VMs.
We run a risk that if somebody gains access to a VM or a host that they can do a range of unwanted things, however, with access they could do many things, not just this attack, and we would have far bigger problems...
So, is it worth patching for this on 'private' servers and potentially losing 30% of performance, or leave unpatched...
I will of course patch as i'd feel like an idiot for not patching should something happen; just curious as to whether leaving this patch off is valid in any way...
What do ya'll think? I'm currently live migrating a load of VMs off of one of our T630s to apply the patch and do some testing.
-
@dashrender said in Major Intel CPU vulnerability:
@jimmy9008 said in Major Intel CPU vulnerability:
Does anybody know if Dell have released firmware for T630 server for the hardware? I cant seem to find that info on Dells site...
-its ok, think I've found it, and its this... Update
Damn, on the bleeding edge on that one.
I looked for some HP things yesterday - nada.
I'm guessing by the end of January, we'll start seeing more firmware updates.
Now the question is, how far back are the vendors going to go?
I've applied the patch. Now Microsoft shows protection enabled for 'rogue data cache load', but shows as 'False' for 'branch target injection'.
I'm guessing that Dell will be sending out another update for their systems to address that. Anybody able to confirm?
I have opened a call with Dell Support to verify.
-
@jimmy9008 said in Major Intel CPU vulnerability:
@dashrender said in Major Intel CPU vulnerability:
@jimmy9008 said in Major Intel CPU vulnerability:
Does anybody know if Dell have released firmware for T630 server for the hardware? I cant seem to find that info on Dells site...
-its ok, think I've found it, and its this... Update
Damn, on the bleeding edge on that one.
I looked for some HP things yesterday - nada.
I'm guessing by the end of January, we'll start seeing more firmware updates.
Now the question is, how far back are the vendors going to go?
I've applied the patch. Now Microsoft shows protection enabled for 'rogue data cache load', but shows as 'False' for 'branch target injection'.
I'm guessing that Dell will be sending out another update for their systems to address that. Anybody able to confirm?
I have opened a call with Dell Support to verify.
I restarted around 4 times, then ran 'Install-Module SpeculationControl' again and it worked.
-
@jimmy9008 You absolutely need to be patching, for the very reasons you've mentioned questioning whether patching is worth it for private industries.
-
In addition to OS patches, I assume we ought to be looking for BIOS updates as well, which, with many of our ancient desktops, there will probably be none.
-
-
In a cloud hosting scenario, VPS...
If the host is patched, and guest1 VM is patched, but guest2 VM is not patched... are there still meltdown or spectre vulnerabilities for guest1?
How exactly does this work?
-
@eddiejennings said in Major Intel CPU vulnerability:
In addition to OS patches, I assume we ought to be looking for BIOS updates as well, which, with many of our ancient desktops, there will probably be none.
I don't expect any for my 3 year old laptops, let alone my 5-7 year old desktops.
-
@dashrender said in Major Intel CPU vulnerability:
@eddiejennings said in Major Intel CPU vulnerability:
In addition to OS patches, I assume we ought to be looking for BIOS updates as well, which, with many of our ancient desktops, there will probably be none.
I don't expect any for my 3 year old laptops, let alone my 5-7 year old desktops.
The question then is whether or not the OS patching will be sufficient.
-
@eddiejennings said in Major Intel CPU vulnerability:
@dashrender said in Major Intel CPU vulnerability:
@eddiejennings said in Major Intel CPU vulnerability:
In addition to OS patches, I assume we ought to be looking for BIOS updates as well, which, with many of our ancient desktops, there will probably be none.
I don't expect any for my 3 year old laptops, let alone my 5-7 year old desktops.
The question then is whether or not the OS patching will be sufficient.
While these are some pretty nasty vulnerabilities, I don't currently consider them that horrible. As I understand it (and I leave TONS of room to learn new things about these) you can only be affected if you run untrusted code on your system. Assuming that webpages can't take advantage, this amounts to the same level of issue as a typical virus.
Assuming hardware vendors don't produce updates for hardware more than say 3 years old - how many here are going to be replacing their machines/devices (don't forget your android phones are affected too - last I heard)?
-
@eddiejennings said in Major Intel CPU vulnerability:
@dashrender said in Major Intel CPU vulnerability:
@eddiejennings said in Major Intel CPU vulnerability:
In addition to OS patches, I assume we ought to be looking for BIOS updates as well, which, with many of our ancient desktops, there will probably be none.
I don't expect any for my 3 year old laptops, let alone my 5-7 year old desktops.
The question then is whether or not the OS patching will be sufficient.
Depends if it is Intel based or from a more security-minded vendor.
-
@dashrender said in Major Intel CPU vulnerability:
@eddiejennings said in Major Intel CPU vulnerability:
@dashrender said in Major Intel CPU vulnerability:
@eddiejennings said in Major Intel CPU vulnerability:
In addition to OS patches, I assume we ought to be looking for BIOS updates as well, which, with many of our ancient desktops, there will probably be none.
I don't expect any for my 3 year old laptops, let alone my 5-7 year old desktops.
The question then is whether or not the OS patching will be sufficient.
While these are some pretty nasty vulnerabilities, I don't currently consider them that horrible. As I understand it (and I leave TONS of room to learn new things about these) you can only be affected if you run untrusted code on your system. Assuming that webpages can't take advantage, this amounts to the same level of issue as a typical virus.
Assuming hardware vendors don't produce updates for hardware more than say 3 years old - how many here are going to be replacing their machines/devices (don't forget your android phones are affected too - last I heard)?
In a desktop or laptop case, the risk is tiny compared to the big fear of shared computing environments.
