Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- This is a great starting point to go looking for PSP / SMM backdoors.by nullc
- I spaghettify my memory every time I write C code.by raver1975
- The big question is whether this can break out of KVM and whether it can be microrode patched / patched in any other way.
And whether it's really real in the first place.
by devttyeu - One hopes that a hypervisor would not expose hardware control registers directly in the first place, except ones deliberately designed for virtualization support.
Otherwise, the guest is running effectively at the same privilege level as the hypervisor (that's useful sometimes, but probably not intended in most applications).
by summa_tech - This hack is 99% giving people the control over their own computers they should already have had. Guy is a Robin Hood.by quotemstr
- 1) Don't give your guests access to the DCT control registers.
2) On 15h - no obvious way. I don't know the other families.
3) Yes -- this can be verified easily. Pick up the AMD 15h BKDG, look up BankSwizzleMode. It's documented. The one oversight is that this bit is not under the Dram Controller's lock bit.
by vsrinivas - Im confused seeing all the negative 'he used AI in writeups'. This guy released 5 new open source projects last week, including white papers and gave 3 unique talks (2 blackhat, 1 defcon). NONE of those conferences require whitepapers or open sourcing tools, he chose to do that because he gives a shit.
In an ideal world would he have used up all of his free time to write white papers by hand, sure. But instead he used AI to help him go faster (who among us can honestly say were not using in our daily lives??)
As someone whos been a HUGE fan of his work for a long time let me add some positivty to this thread. I'm SOOO thankful that hes still spending his free time doing incredible research, releasing functional documented open source, and bothering to release white papers. When so many researchers I see today slap a cheeky logo on a shitty blog post and call it awesome.
- I really hate to be that guy, but man, as someone who was and is a big Christopher Domas fan (and is way dumber than him, I mean, this stuff is seriously over my head)... it's been really disappointing to see him LLM'ing all the READMEs recently. They used to be a joy to read through, but now the Claudeisms made it such a slog I could barely get through a few paragraphs. I'm glad he's using the new tools to get even more cool stuff done, but I wish he'd have gone for a human writeup at the end.by ipdashc
- I find vague gestures like this almost more annoying than the idea of someone using AI to write.
> the Claudeisms
This is hand-waving. Please be more specific.
> made it such a slog
On the flip-side, I didn't find it a slog at all. What if you're wrong?
- > I really hate to be that guy,
Then don't be that guy.
> But...
Oh, ok.
Hackernews, dang and the other mod are constantly telling people, wE'rE dOIng sOMetHinG dIffeReNt hERe
Yeah, complaining about fucking ai instead of discussing the topic.
I don't give a fuck about how whatever it is you perceive as "claudisms" makes you feel.
The author is deeply technical, and the writeup as presented is easy to follow.
If you couldn't follow it and you are technical, then you have a form ai psychosis: the kind that makes you so hyper-viliglent to seeing something that might have been produced in a way that you don't like that it blanks out your brain.
by potsandpans - Maybe this is to keep script kiddies away?
Like.. having no readme or a super technical one doesn't work anymore in the age of LLMs, but having one that hurts to read might?
Because people trying to get an LLM to translate it just get more LLM output. So you actually _have_ to put in manual effort to rip out what the fuck it wants to tell you.
That would be clever.
by hypfer - uncanny feeling when I could tell from the first sentence it was Claude
“Poke the DRAM controller and an address can be made to land wherever you want in memory.”
I’d love to know why this specific sentence structure feels like Claude.
by cowlby - Disappointing indeed. Us security folk have already earned a poor reputation for ineffective technical communication, and LLMs are even worse, not better. This is especially disappointing in this case because we know xoreaxeaxeax is one of the few who are actually capable of effectively communicating beautifully cursed low-level hackery, but is now choosing to outsource the most impactful part of his work (since most people will only read the abstract, I mean, README) to an LLM. I'll still take new projects with sloppy READMEs over the previous years of radio silence, but I really wish xoreaxeaxeax would recognize the value in spending the time to write a single page of text in his own voice.
- I came to the comments to complain about how unreadable it was, saw that it was the movfuscator guy, went back to check if I somehow made a mistake but no, if anything that writeup is one of the egregious ones I've seen recently. What a shame, I really liked his talks.by deepburner
- This is only applicable if you already have root (in order to get beyond that), right? It doesn't expose new risk of local privilege escalation?by zahlman
- Yep, I believe soby odo1242
- This is more about getting at the code that device manufacturers attempt to hide from the end user. Platform keys, secure enclaves, etc...by jandrese
- Reaching into ring -2 or the TPM allows privilege escalations past traditional "root permissions" and lets attackers defeat the sort of tamper protection that's designed to make escalations to local root manageable. Wipe-resistant malware, falsified cryptographic attestations, all sorts of fun.by creshal
- The researcher behind this is obviously highly knowledgeable in reverse engineering CPUs to the tune it reminds me of the dwarves digging in Moria...
But why on earth do they have to use AI to write their writeups?!
by mschuster91 - Omg yes, I found this borderline unreadable. So dense with clever phrases that say almost nothing. I came here to this thread to see if it was just me; I'm glad it wasn't!by bananaboy
- I got suspicious but decided it wasn’t AI. The “Foo is the bar.” sentence construct is coherent with the overall “through the looking glass” tenor.by dcrazy
- Seriously. Got tired of reading the same idea over and over reworded endlessly.by russdill
- So on an affected system, ring 0 root has access to pretty much everything that was hidden in negative ring territory. The page is pretty quiet about what other processor families might be similar beyond this specific AMD16h (an older AMD low-power family)?by dzdt
- As long as you know the controller's translation registers, it's applicable? Not tested on later one's merely because the information wasn't readily available it seems.
> Developed and tested on AMD Family 16h CPUs, the last generation whose datasheets document the DRAM controller's translation registers — and show that they can't be locked. 17h and beyond simply leave this information out.
- from the GH page: > Developed and tested on AMD Family 16h CPUs, the last generation whose datasheets document the DRAM controller's translation registers — and show that they can't be locked. 17h and beyond simply leave this information out.by m1el
- OK, so this works on AMD Jaguar according to the README. That's a architecture from 2013. There's notes about Zen 3 having a different base address for the memory controller registers, but that's it. What newer CPUs does attack actually work on?by gmueckl
- That information is intentionally left out
- Zen has completely different memory controller IP (UMC), that's configured at boot by AGESA/PSP. I doubt this exploit applies to modern Zen CPUs, however AMD are the only ones who could really confirm this.by devttyeu
- CPU designers have been aware of this attack vector for a while, so many (maybe all) have controls to lock these registers. They are written and locked by vendor firmware before it hands off to the operating system.
You would have first break the firmware or locks before an attack like this on a modern CPU
by zerohp - This is all great to get full unfettered access to your own system, as life should be.
I’m sure Xbox and PlayStation security groups are a little nervous right now though. Getting ring-0 on those machines is near impossible, but once you do then everything else becomes wide open
by WhiteDawn