THANKS FOR WATCHING ❤ Try CodeCrafters today with 40% off! 👉 app.codecrafters.io/join?via=daniel-boctor JOIN THE DISCORD! 👉 discord.gg/WYqqp7DXbm **UPDATE** A few commenters have been asking if spectre was ever used in any real attacks. To my knowledge, the answer is no. Using spectre to pull something off in the real world is incredibly complex and difficult. Kaspersky has a great article outlining the theoretical impacts the bugs could have: www.kaspersky.com/blog/spectre-meltdown-in-practice/43525/ **UPDATE v2** At 12:07, I said that the operating system would notice when trying to access out of bounds data. A few commenters have pointed out that it's the MMU (hardware level) that would raise a fault in response to access violations, not the OS. The OS gets notified afterwards. My apologies for the mistake. Thanks to those who pointed it out! **UPDATE v3** A few people were interested in the audio side channel for fingerprint reconstruction. I'm no expert, but I'll link the source in case any of y'all wanted to take a further look. here's an article that discusses it: www.tomshardware.com/tech-industry/cyber-security/your-fingerprints-can-be-recreated-from-the-sounds-made-when-you-swipe-on-a-touchscreen-researchers-new-side-channel-attack-can-reproduce-partial-fingerprints-to-enable-attacks and here's the underlying paper: www.ndss-symposium.org/wp-content/uploads/2024-618-paper.pdf 👇 Let me know what topics you would like to see next! 👇 Thank you for all of the support, I love all of you
@BillAnt
5 ай бұрын
The Doctor Boctor has done it again. :) Thank you for this great video showing the concepts of these vulnerabilities in an easily understandable format.
@angeltensey
5 ай бұрын
meltdown and spectre are essentially ways to gaslight your computer.
@jasonkhanlar9520
5 ай бұрын
2:30 "process" is mispronunced. maybe human maybe not human generated voice using human live sampling, not sure, either way, the pronunciation is wrong, whether intentional or unintentional
@SailorRob
5 ай бұрын
@@jasonkhanlar9520, it's his real voice, and his accent is common to certain parts of the US and Canada. Separately, I was going to comment that I enjoyed the pace and format of his narration: 1. It's to the point. 2. Quickly gives the relevant information. 3. Clearly said and easy to understand. Despite the northern accent, he gets high marks from me for efficiency.
@simonj.k.pedersen81
5 ай бұрын
Great explanation
@SambinoDev
5 ай бұрын
30 seconds in I thought Frank from Domino's was going to be the one responsible for compromising 80 billion CPUs
@akk2766
5 ай бұрын
I was thinking that too - 🤣. Like the anesthetist who created BFS - en.wikipedia.org/wiki/Con_Kolivas
@dsandoval9396
5 ай бұрын
Same. First couple of minutes I really was thinking Frank must've been a PC savant that came up with that exploit at home. While managing Domino's Pizza store.🤦
@yyyy-uv3po
5 ай бұрын
@@dsandoval9396 Gustavo Fring nerd version
@StefTechSurfer
4 ай бұрын
The perfect cover.
@rossr6616
4 ай бұрын
pepperoni in the clean room!
@dr.robertnick9599
5 ай бұрын
That Pizza order thing is a great way to explain what side channel attacks are.
@DanielBoctor
5 ай бұрын
aha, I was hoping it would be! Glad you thought so 😊
@Krono159
5 ай бұрын
not only a great way, but the best one
@Batwam0
5 ай бұрын
When you explained the attack at 15:10, I realised why you have mentioned the pizza story at the beginning and understood the attack method right a way. It was perfect 👌
@ahndeux
5 ай бұрын
Now if we can only correlate donut and coffee orders to police incidents.
@RikuRicardo
5 ай бұрын
For real! That makes so much sense
@mushroomsamba82
5 ай бұрын
all the pentagon would have to do to avoid the side channel attack is throw a pizza party on a random day every month
@gamagama69
5 ай бұрын
and utilize different places, assuming that groups are placing people in resturants to track this
@consumerextraordinaire8209
5 ай бұрын
bean counters: "hmmm, sounds expensive..."
@tondekoddar7837
5 ай бұрын
Exactly. Also, order taxis, drivers, cancel drivers free time, electricity usage (remember what kind of lights you use makes different waveforms in the nearby network) umm no need to track me, 3-letter Sir, I'm just a newborn from halfway across the world, no the GOOD PART... :)
@DavidTriphon
5 ай бұрын
@@gamagama69you can find average wait times on google. After the Russian Wagner group leader died (or maybe some other recent Russian war event, I might not be remembering correctly), anyone who could use google maps for finding restaurants could see that wait times had spiked throughout the Washington DC area. Thanks to google, the DC pizza index is public globally.
@johnridout6540
5 ай бұрын
That's still not secure. You'd need to throw pizza parties at random intervals irrespective of months.
@exzld
5 ай бұрын
"lets not get ahead of ourselves" that was an unintended pun
@DanielBoctor
5 ай бұрын
I didn't even realize that lol
@raylopez99
5 ай бұрын
I predict this comment will blow up with likes...
@exzld
5 ай бұрын
@@raylopez99nah it will probably just get rolled back...
@pedroandrade8194
5 ай бұрын
@@exzld you might roll back... ill still be a hit
@user-tm7eq3jx4h
5 ай бұрын
xD @@pedroandrade8194
@rog2224
5 ай бұрын
In the 70s, security forces in the UK used a milk bottle metric to predict riots - a dip in returns of empty milk bottles in certain places meant there was going to be serious trouble in the next two-three days.
@chaferweed
5 ай бұрын
Why so?
@Zorro9129
5 ай бұрын
@@chaferweed The bottles could be used for molotov cocktails.
@jtnachos16
4 ай бұрын
@@Zorro9129 Also, the lack of people going about daily chores and staying home/out of sight instead would indicate tensions and concerns amongst the populace. If you've ever hung around a bad neighborhood before, you know when the druggies and other locals suddenly disappear from the streets, you should be disappearing too. You get the same effect in the widlerness too. If the normal noises of the environment suddenly stop, something is wrong.
@dirtydan3029
4 ай бұрын
Im too young to remember milk being in glass bottles
@maid1452
4 ай бұрын
@@jtnachos16 That's a good way to put it.
@Jack-lr3dn
5 ай бұрын
Insane they figured out a way to effectively gaslight a cpu
@iraniansuperhacker4382
5 ай бұрын
Ive been having conversations with people recently about how vulnerable airliners are to electronic attack/hacking and people are generally under the assumption it would literally be impossible to hack an airplane and bring it down. I tried to explain to them attacks or rouge engineers sneaking something into the tool chain they use to build the software. Ive spent more then a few years learning how to program and how computers work, they tell me I watch too many movies and they try to give me some wild half assed technical reason as to why they are right. Im for sure going to use this video as a reference in the future.
@freedustin
5 ай бұрын
Not really. People need to quit thinking computers are smart, they are not. They blindly follow every order that makes it to the CPU.
@ahndeux
5 ай бұрын
@@iraniansuperhacker4382 Wrong and lots of bad information in your post. Its not that software can't be hacked, but most source codes have CRC checks to verify against non-approved changes. Most flight level software has multiple level of checks against malicious code. Its not written by one rogue programmer. There are teams of people and verifications on software code. Can code written incorrectly and compromised? Of course. However, you have no clue to the level of verification is needed in software on critical systems. It's not what you think.
@iraniansuperhacker4382
5 ай бұрын
@@ahndeux Are you a programmer?
@jasonfyk
5 ай бұрын
wrong @@ahndeux
@wernerviehhauser94
5 ай бұрын
Why you should always consider to generate some garbage on the side channels...... even if that means bying free pizza for your facility management at night.
@lordfrz9339
5 ай бұрын
They now make sure to order small batches of pizza from several different venders. And they buy pizza regularly, not just on big days. So even when the amount of pizza spikes, it just seems like a normal order to each pizza place.
@ryelor123
5 ай бұрын
@@lordfrz9339A spy could just see how many pizza deliveries occur visually.
@josephkanowitz6875
5 ай бұрын
ב''ה, but then they'd think Americans still rely on food
@corvusnocturne
5 ай бұрын
wait, people in other countries dont need to eat?@@josephkanowitz6875
@BudgiePanic
5 ай бұрын
I heard they stopped ordering pizza entirely from the guy who originally published it
@petersmythe6462
5 ай бұрын
"accessing main memory is incredibly slow" "Like a five millionth of a second."
@vampir753
5 ай бұрын
Better go and get a coffee in the meantime, this will take a while.
@DanLivings
4 ай бұрын
@@vampir753You could probably drink a couple of trillion caffeine molecules in that time
@charliekahn4205
4 ай бұрын
Your average RISC instruction takes around four clock cycles. If your clock is 1GHz, one cycle is 1ns. That means you can perform 50 instructions in the time it takes to access one byte on an 8-bit bus.
@kevinjohnston8399
4 ай бұрын
@@charliekahn4205 Actually that's not quite correct. Each individual instruction requires four cycles, but after one cycle of one instruction, a new instruction starts its own first cycle. Most of the time there are 4 instructions all in progress at the same time. Each one starts and finishes one cycle after the previous. So in 200ns the CPU can start 200 instructions, and finish 197 of them. (The last 3 are in different stages of "not finished yet", but they all finish in the next 3 cycles.)
@AG3n3ricHuman
4 ай бұрын
@@kevinjohnston8399 Actually that's not quite correct. Modern CPUs are superscalar and can start multiple instructions at once, even in a different order than they are in the running program (which is called "out-of-order" execution).
@milk-dog
5 ай бұрын
The timing of this video could not have been better. The GoFetch exploit on M1 and M2 silicon was just discovered as a side channel attack, and your explanation helped understand it a lot better. Thanks.
@DanielBoctor
5 ай бұрын
I know, it's a crazy coincidence. I started working on this video about a month ago too. Glad you liked it!
@ben_car_8115
5 ай бұрын
@@DanielBoctorI honestly thought this was released because of the exploit when I first clicked on it. Sometimes thing just line up so well
@tondekoddar7837
5 ай бұрын
@@DanielBoctorDo you keep any videos for a while just to wait for a thing to happen ? Crazy good video, ty.
@fredwupkensoppel8949
5 ай бұрын
Yeah I was reading about GoFetch the other day and went "wait, isn't that just Spectre all over again"? If you're designing a CPU, shouldn't "could this lead to the resurgence of the worst microarchitecture-based security flaw ever" be a question that gets occasionally asked?
@AJ3000_
5 ай бұрын
@@DanielBoctornailed it
@pianowhizz
5 ай бұрын
The funny thing was, the speculative execution feature was a known security risk back in the 1990s. It’s not something new.
@Zaraaashiigal
5 ай бұрын
People always find ways to gaslight and exaggerate. It's common on youtube. I wish more people would realize this.
@ChrisM-tn3hx
5 ай бұрын
Most current methods are very similar to those used back in the 80s and 90s. Take SQL injection for example. One of the oldest and still most common forms of attack. Still works.
@Munenushi
4 ай бұрын
@@Zaraaashiigal youtube is becoming like those commercials where a person - for example - would just dump a bowl of popcorn and then someone would dump a bowl of chips and a voice says "HAVING PROBLEMS WITH BOWLS??" and then the ad begins for a 'new bowl' that has arms attached that go on your thighs when you sit down, so that the bowl doesn't spill as easily.... YT is becoming the "before" (where people just dump bowls stupidly) as the title of the videos here, and then when you click on the video and watch it, it becomes the "after" (where the solution of the new bowl type is shown) - all just clickbait to get people to watch... like the "YOU are doing ______ wrong!" trope lol
@MarcosAlexandre-no3qx
4 ай бұрын
I heard about it, but it was not from the companies if i remember right, but the nsa and the cia would know about this exploit and not inform because they could use it to gather information on people of their interest.
@Zaraaashiigal
4 ай бұрын
@@MarcosAlexandre-no3qx You lost me at "The NSA and the CIA".
@VivBrodock
5 ай бұрын
putting out this video a couple days after a side channel attack was found on M1 chips is *_wild_* timing
@SeekingTheLoveThatGodMeans7648
5 ай бұрын
Perhaps the You Tube algorithm also helped by noticing the intersection of topics with a trending thing. This could have been mad obscure, otherwise. At any rate, due to vulnerabilities like this, various speculative executions, due to not wanting to go hog wild due to errors incurred during them if they are wrong, can tap out data that should never have been visible to you. Truly serious security in the face of this sounds like it means never letting anything that could be hostile run on your secure computer at any level. Not even websites. As burglar alarms and burglar proof doors get better, data burglars get more clever.
@leogama3422
5 ай бұрын
he speculativelly recorded it
@DanielBoctor
5 ай бұрын
Underrated comment lol. In all honesty it was a coincidence. These videos take a very long time to make - I actually started working on this about a month ago. I'm just as surprised as you guys are 🤯
@l33tninja1
4 ай бұрын
@@SeekingTheLoveThatGodMeans7648 honostly i dont think we shoild have the internet linked to anything vital like our ships, food production and security. Should be as separated from the web as we can manage and the controls should always be on site only.
@devonwilliams2423
4 ай бұрын
@@DanielBoctorsure bro, can you stay in town one more day? Boeing lawyers have a few more questions Oh and good news! They booked you a nice hotel with an incredible parking lot 🎉
@lbgstzockt8493
5 ай бұрын
The people finding hardware vulnurabilities are genuine gigabrains. How do you even come up with this?
@GiveThemHorns
5 ай бұрын
While I understand and appreciate the seemingly impossible nature of finding an exploit like this, it doesn't require a 'gigabrain'. It's just a matter of having the right knowledge with the right set of skills (which can be learned). A good, and common, example of where this type of thinking is regularly used is with SDETs. SDETs use their knowledge of the system combined with the experience and know-how of performing technical analysis in order to identify potential flaws and test for them.
@raylopez99
5 ай бұрын
@@GiveThemHorns Still, the hackers were gigabrains. I mean even designing a keyboard logger is hard to do. As an amateur coder I tried in C# to design a keyboard logger than was a TSR program and could not (of course C# has a keyboard library but not persistent after you stop using the program). But these low level language hackers could do it and also make the program tiny to avoid detection, as well as having a randomly changing signature to avoid anti-virus. Gigachads indeed.
@IamFrancoisDillinger
5 ай бұрын
Agreed. I took a cloud security course in undergrad and I remember learning about these attacks (though I've forgotten most of it) and reset attacks on TPMs and all I could think was "These people are crazy...just how?" I wish I had the knack for such things.
@Bug_Abuse
5 ай бұрын
For some it's a hobby. I learned to break systems when I was a teenager by exploiting games. You just have to think outside the box. I learned to exploit before I starting coding. It makes more sense as a coder how you can't think of every possible edge case over time.
@GiveThemHorns
5 ай бұрын
@@Bug_AbuseCoders don't think of every possible edge case, not even close.
@DerSolinski
5 ай бұрын
Why is there a expense claim for 200 pizzas labeled "security measure"? To prevent a side channel attack Sir. So this has nothing to do with several complaints about a "obnoxious party" from the locals? Absolutely not, Sir.
@rightwingsafetysquad9872
5 ай бұрын
If we have an obnoxious party every night, the data miners can't figure out which ones mean we're going to war.
@skop6321
5 ай бұрын
@@rightwingsafetysquad9872 oh yea its bigbrain time
@IanBPPK
5 ай бұрын
@@VelocifyerThey do now to obfuscate, initially it was from a very short list of places.
@tutacat
5 ай бұрын
"Don't give your real address" "I. P. Freely"
@bb5242
4 ай бұрын
Just randomly hold Pentagon pizza nights.
@JimAllen-Persona
5 ай бұрын
That’s the Feynman story: when he was going to Los Alamos the army told all the scientists to buy train tickets from different stations for security purposes. So Feynman being Feynman, he went to the Princeton station because no else would be there. When he walks in the station master (who has no idea who he is) tells him all of his stuff they’re shipping there for him should be fine. The army made all the people buy tickets from different locations but shipped all the lab equipment from Princeton.
@octakhan4673
5 ай бұрын
On a similar note: A popular science fiction magazine publisher knew there was something going down in Los Alamos because all his subscriptions suddenly moved to New Mexico!
@zimriel
5 ай бұрын
the movie "Oppenheimer" does pretty well at showing how Oppenheimer hired all his friends who, oopsie! were all communists. Most were simple Trots or just Lefties by that time, but a good deal of Uncle Joe's sympathisers got through.
@mytech6779
4 ай бұрын
@@octakhan4673 It wasn't addressed as Los Alamos at the time, it was only addressable by zipcode or something like that. Even birth certificates just had the zipcode as the place with no city or state or hospital name. Special zipcodes are still used, I once worked for a company that had a building with its own zipcode even though it was within a normal city zipcode.
@mytech6779
4 ай бұрын
@@octakhan4673 Kodak discovered nuclear information super early via side channel, when radioactive contaminents showed up in some raw material creating spots on their fresh film.
@octakhan4673
4 ай бұрын
@@mytech6779 Oh, my mistake. It makes sense the location wouldn't have been publicized anywhere. I believe it was publisher John Campbell who figured out that something was going on over there, based on his subscribers suspiciously moving to New Mexico!
@filker0
5 ай бұрын
There are some CPUs that have speculative execution and branch prediction but don't access memory that is not accessible by the thread. Instead, they note the exception when the address isn't in the active page table and, if the branch isn't taken, raises the exception. These include many power pc flavors.
@rufmeister
5 ай бұрын
Unfortunately, not the M1/M2, it seems.
@filker0
4 ай бұрын
@@rufmeister Not a PPC, ARM followed the Intel memory management model.
@Knyllahsyhn
5 ай бұрын
I already heard about this from an interview with the researchers that found the vulnerability, but you sure did one hell of a job to visualize and break it down. Funnily, code remaining in some part of some memory has been used in higher-level attacks, like the famous Tweezer Attack on the Wii. Crazy how since the early days of computing, more and more layers have been added, leading to similar problems on lower levels.
@kayakMike1000
5 ай бұрын
Its NOT just the OS that detects you're out of bounds. There's hardware called an MMU that sets an exception or interrupt for an access fault. The OS just initializes this when it sets up an adress space. In smaller micrcontroller systems, you MIGHT have a rudimentary MPU, but not a full MMU
@BillAnt
5 ай бұрын
Right, a well designed MMU should not allows leaking of data into the cache on out-of-bounds memory calls. The problem is likely with the CPU's speculative processing then backtracking on failure without clearing the cache.
@kreuner11
5 ай бұрын
@@BillAntyes
@kayakMike1000
5 ай бұрын
@@BillAnt yup, you're correct. I was vomiting up an angry comment when he just said something about the OS emitting a segfault. I just really get wound up when people minimize the hardware.
@__christopher__
5 ай бұрын
@@BillAntif ir would catch the illegal access during speculative execution and simply stop the speculative execution in that case, the indexing with the restricted data would not be executed even speculatively, and thus there would not be any cache change In accessible memory that you might run your timing attack on.
@MRL8770
5 ай бұрын
I believe the confusion might've arosen from the fact that the UNIX-like kernels emit the SEGFAULT signal to a process that caused it (which is in fact irrelevant to memory protection as contrary to what Daniel said, the process can still run and access data after receiving that signal), but as you said, the actual segmentation fault comes directly from the MMU as an interrupt.
@JohnUsp
4 ай бұрын
In Brazil happened that same in the '60s, when suddenly a bakery in a rural area received a huge order of hundreds of breads, they "followed the bread" and discovered the camping of a guerrilla army.
@Amir_404
5 ай бұрын
An important thing to note is that there was *probably* no cases of Spectre leaking data in the wild. It was a new class of possible exploits so experts freaked out because nobody know what could come of it , however(by shear luck) nobody ever found a usable attack using Spectre. The fastest leak found was 60 bits/hour, and it would take a theoretical unrelated exploit to find what memory address had the data you wanted to steal.
@KiraSlith
5 ай бұрын
In an optimal setup with a small cache and RAM pool, it could be used to retrieve otherwise inaccessible/secret encryption keys. Technically it'd be easier to just bung whatever app you're trying to steal keys from into a compromised virtual machine engine (FOSS hypervisors like KVM are easy to exfiltrate data from) or exploit DMA devices (like the ethernet controllers on most motherboards) to dump system memory in pages until you find the desired keys. [Edit: Typos]
@saddish2816
5 ай бұрын
nation states will have known about this before it was made public and would have used it, unless they had better methods of achieving the same thing
@_BangDroid_
5 ай бұрын
@@saddish2816 And which APT groups are we talking about? Considering even now after everyone knows the technical details there are still no valid exploits for vulnerable silicone, your assertion is entirely speculative.
@ABaumstumpf
5 ай бұрын
"The fastest leak found was 60 bits/hour" !?!?! WTF? Why are you lying about this? It was demonstrated to be fast enough for video transmission even.
@Mavendow
5 ай бұрын
@@ABaumstumpf The initial research showed what he says, but you're right, later research did find a far better method. He's not lying, just plain wrong.
@vishipsherrah
5 ай бұрын
I expected you to talk about that shady intel management thing that has unlimited control over cpu and runs mysterious code that only intel knows what it does
@BrandonFifer
5 ай бұрын
The Intel Management Engine?
@shinobuoshino5066
5 ай бұрын
Probably because you're sub-68IQ cretin who has been on 4chan for too long and spent a total of 0 seconds researching how it works, when used as intended, if you knew intended use and actually put your time into tinkering with it, you may or may not have figured out how it works just like many people did who know what it does because reverse engineering even a total black box is trivial.
@DanielBoctor
5 ай бұрын
Can you link to what you're referring to? Could be a topic for a future video 👀 EDIT: seems like it is Intel Management Engine. Going to look into this.
@ryansullivan3085
5 ай бұрын
Ah that's a comforting thing for an Intel CPU user to hear
@TheSensationalMr.Science
5 ай бұрын
from what I could find I heard it runs a modified version of minix to run microcode [CPU code] on the CPU microcontroller. though I don't know if that is true or not... haven't cut open a CPU or tried debugging it their way to get there. though it would be interesting learning more about it, so that we can understand *WHAT* it does, and how like this explanation did. [also he probably can't... KZitem hates links] just search *intel management engine* and you'll find a wiki and the intel page about it... though I don't know about any vulnerabilities using it though. Hope you have a great day & Safe travels!
@glitchy_weasel
5 ай бұрын
The best explanation of this vulnerability hands down! Fantastically done!!
@DanielBoctor
5 ай бұрын
I'm honoured, thank you!
@davidvelasco4423
5 ай бұрын
What would you know about that? You're a furry.
@juliangi8169
5 ай бұрын
This was insanely well explained. Great Video!
@DanielBoctor
5 ай бұрын
Thank you!! Glad you liked it 😊
@SlightlyNasty
5 ай бұрын
Nice explanation! I remember when this broke originally all the news coverage just handwaved over the actual cache extraction part, so I was never clear on how the timing attack actually determined the specific value. That array indexing trick is nifty.
@robertsmith2956
4 ай бұрын
I never got an answer about the Pentium math bug. Which way did it fail? Should I use it to do my taxes?
@macksii
5 ай бұрын
i know nothing about computer vulnerabilities but you made it incredibly digestible to understand. nice work!
@DanielBoctor
5 ай бұрын
Thanks for the kind words! Keep on doing what you're doing 😊
@nobobo2401
4 ай бұрын
This reminds me of modern warfare 2 (original one on 360). If you spam click matchmaking and back out right before it gets to 100% about 10 times then quickly load into a private lobby, it will load a bunch of randoms into your private game. That game was so full of bugs but the most fun COD ever.
@MertonDingle1111
2 ай бұрын
This is one of the best explainer video I've seen. You simplify something very complex, and yet do not skip anything. All within a very short time frame.
@DanielBoctor
2 ай бұрын
thank you for this. I appreciate the support
@MertonDingle1111
2 ай бұрын
@@DanielBoctor You very much deserve it!
@whamer100
5 ай бұрын
this was the first video ive seen that actually showed this exploit in a very easy to digest manner (I'm a computer science major, so I already understood the technical details, but this reinforced it in a way that makes way more sense than I originally had thought)
@DanielBoctor
5 ай бұрын
That's pretty awesome, glad it was able to help! Thanks for the support ❤️
@snorman1911
3 ай бұрын
Look everyone, we got a computer science major over here!
@jacob_90s
5 ай бұрын
You know what's really funny is I remember hearing a lot about this at the time, but it wasn't until just a few days ago that I finally found a video that made it click for me how this worked... and now you come out with this one which does an even better job of explaining it. Also, just to note, I believe that most of the vulnerabilities are not capable of accessing the memory of other processes at all. The biggest concern has been programs like browsers, where code is all running inside the same process, and you have cookies, passwords, credit card numbers, etc which could all potentially be accessed. It seems like for a permanent hardware fix, either they need to evict the data from the cache, or have a separate, speculative cache which is then later committed to the main cache.
@robertsmith2956
4 ай бұрын
speculative memory should be flushed if it is wrong, and locked down till it knows if it was wrong.
@tiredpotato5539
5 ай бұрын
Dude. I love your videos, you choose very interesting topics and explain them BEAUTIFULLY.
@DanielBoctor
5 ай бұрын
Glad you think so! Thank you for the support Tired Potato ❤
@MrMCMaxLP
5 ай бұрын
This was a great video, thanks for explaining the exploit in detail. In my computer architecture class, the professor mentioned these attacks but never actually explained how they worked. I never realized that speculative execution would mess up with the cache!
@ethanlewis1453
3 ай бұрын
@2:20 "they're the worst computer bugs in history" I thought they were showing a bug flying around the computer for effect but it was actually a fruit fly on my own monitor 🤣
@pranaypallavtripathi2460
4 ай бұрын
An extremely complex topic explained in an extremely simple way. True hallmark of an expert. Keep this up. Subscribed 👍
@DanielBoctor
3 ай бұрын
Much appreciated!
@ryangrogan6839
5 ай бұрын
A side channel attack is a way of deriving information simply by observing the function of a system. Usually its info you shouldnt normally beable to derive.
@Speedojesus
5 ай бұрын
We made rocks think with electricity and maths, and look where we are. Industrial society, and so on.
@anythingbenz4005
5 ай бұрын
Government needs to start baking their own in house pizza before someone poisons them all lol
@darkguardian1314
4 ай бұрын
Side channel attack is like gravity or dark matter. You see the effects even though you don't know what's happening. Going to have to do a deep dive to get up to speed.
@chasebrower7816
5 ай бұрын
Feels very rare that a channel makes content this cogent and well organized. Great job!
@DanielBoctor
5 ай бұрын
wow, I'm honoured to receive such a comment. thank you for the support!
@billyj.causeyvideoguy7361
4 ай бұрын
You ever think about the fact that we are only one exploit away from being forced back to the 80s in terms of technology?
@stargazer7644
4 ай бұрын
This is why security is done in layers. It really doesn't matter if you have an exploit to steal memory data if you can't get through the firewall to implement it.
@MaxChaplin
2 ай бұрын
John W. Campbell, who was the editor of Astounding Science Fiction during WW2, claimed that he knew there was a big science project underway in Los Alamos, because many of his regular subscribers moved there suddenly.
@3rdalbum
20 күн бұрын
I already knew what a side channel attack was, but this is the most elegant description of it I've ever heard. Great work!
@darkguardian1314
5 ай бұрын
Nice opening shots of USS Makin Island (LHD-8). She wasn’t in service during Desert Storm. Back then we were riding on Tarawa Class like LHA-3 Belleau Wood. 😊
@DanielBoctor
5 ай бұрын
haha, you got me there! cool to know
@darkguardian1314
4 ай бұрын
@@DanielBoctor This beats CNN effect covering the attack as it happened. Iraq just had to watch CNN for info. We complained about too much information being put out during an active assualt. That continued with the second war with embedded reporters like Geraldo Rivera drawing maps in the sand that got him kicked out of the field. 😆
@geraldfisher7460
5 ай бұрын
The last time I tried programming something was a TV remote 3 decades ago. That being said this was fascinating! Well done.
@DanielBoctor
5 ай бұрын
Thanks!!
@gregs6403
3 ай бұрын
This is so well explained. So many tech channels flounder when they try to explain the actual mechanisms at hand, but you clearly have a truly excellent understanding. Thank you for making this.
@DanielBoctor
3 ай бұрын
thank you for the feedback! I appreciate it. I'm glad you thought so
@bend3rbot
3 ай бұрын
It's just like a bad employer, the extra pizza days suggest bad news for staff bonuses, like a cheesy crust will pay for Christmas.
@tripplefives1402
5 ай бұрын
In the video you said that the operating system prevents your program from accessing memory of other programs, this is not so. The operating system loads in the page table in each core for the current process running on that core (each process is a page table from the CPU hardware point of view, each thread is a stack) every time is does a context switch invoked by the system timer interrupt handler. It's the actual CPU hardware itself that does the privilege check on memory access according to flags set in the page table entries for that address being accessed. If flags don't allow it or if the address is not present then it invokes a page fault interrupt handler from which the OS can spawn a dialog box process and kill process or it can sleep the process and notify the hard drive driver to read in the virtual memory for the missing page entry. So on the event that you access memory you are not allowed to get the CPU will see the flags in the page table and invoke the interupt handler for page faults. The kernel ISR then just populates a log entry with the values stored in registers, puts the bad process to sleep, and quickly exits. The kernel process then sees that log entry and does the work of unloading the stopped process (stopped being just a flag in a data structure that the system timer ISR sees to know not to switch in the page table for the stopped process).
@DanielBoctor
5 ай бұрын
This is very interesting, thanks for pointing it out! I didn't realize this at the time. Thanks for sharing all this info. I went ahead and updated my pinned comment. Thanks again!
@BSOD.Enjoyer
4 ай бұрын
@@DanielBoctor 2:27 can spectre really allow user to access virtual memory from other processes? each process has their own address space if mspaint.exe calls ptr=malloc(1), chrome.exe won't have a virtual address that translates to same physical address as what ptr inside mspaint.exe translates to whatever out of bound array access chrome.exe is doing, it wont access ptr inside mspaint.exe based on your description of spectre, i dont see how reading virtual memory from other process is possible
@bannawitkongkasmut
2 ай бұрын
thank you i just got this randomly recommended and your explanation was easily digestible enough so that i with no understanding in coding was able to enjoy this video
@DanielBoctor
2 ай бұрын
haha, that's awesome!
@jafaremir1403
4 ай бұрын
Mission Impossible’s next film: CPU Gaslight protocol
@Luzum
5 ай бұрын
great vid, gj with the editing and analogies, keep doing what u do
@DanielBoctor
5 ай бұрын
Thanks for the kind words
@scootsmcgoots1
4 ай бұрын
This was fascinating and really well explained. Great video
@Ahsan_Fazal
4 ай бұрын
I’m 100% going to steal the example of pizzas to explain side-channel attacks to junior developers!
@rustycherkas8229
5 ай бұрын
Who remembers when the "Strava" Fitbit maps were revealing the locations "secret" military installations?
@YellowDice
5 ай бұрын
i do like how the headlines for the hot fixes for these were like 20% performance decrease!!!! When in real-time the difference is near unnoticeable.
@Bialy_1
5 ай бұрын
Because 20% performance decrease in real-time is near to unnoticeable...
@Blox117
4 ай бұрын
unnoticeable if all you use your computer for is minecraft, fortnite, and tiktok
@linux2420
5 ай бұрын
Wait, so how can modern CPUs do this securely?
@stargazer7644
4 ай бұрын
you make sure to roll back ALL changes, including flushing the cache
@4u2nvinmtl
3 ай бұрын
The caught Pablo like this as well. He ordered too many taco's for delivery all at once.
@theideaofevil
4 ай бұрын
Computer Scientist and Senior Programmer/Analyst here, you've done a great job covering branch prediction and the problem of thrashing the cache here. Minimizing your bottleneck to main memory is one of my favorite architectural problems and I use it all the time to illustrate architectural principals to juniors.
@narayanbandodker5482
5 ай бұрын
So I guess they "fixed" this bug now using microcode updates on some older CPUs now? Or are there still billions of CPUs that are silently leaking data?
@polinskitom2277
5 ай бұрын
still some leaking data, i.e, i3-2xxx to i5-6xxx are still unpatched to this day, amd put more effort into patching older CPUs than intel, with the only ones being unpatchable are cpus older than 2006
@Ocastia
5 ай бұрын
To be fair Skylake is now over 8 years old so whilst this isn't great I doubt that it matters too much.
@Momi_V
5 ай бұрын
There are workarounds in modern OS-Kernels. They don't fix the underlying issue, but are more careful when switching around between different processes and memory accesses. This mostly works, but has a performance overhead that can be significant (>10%) in some workloads. Some people insist on booting Linux with mitigations=off to get back that bit of extra performance, but make themselves vulnerable to those "fixed" attacks in the process.
@rightwingsafetysquad9872
5 ай бұрын
@@polinskitom2277 Maybe I'm wrong, but if the 7th gen chips were patched, I'd imagine the 6th gen were as well because they're the same architecture. Half-way through the 8th generation hardware fixes were introduced. Unfortunately the only reliable way to determine if a particular 8th gen chip has fixes is to look up the model number. 9th gen and newer should be completely good.
@stefanl5183
4 ай бұрын
It's a theoretical exploit, that would be very impractical to utilize in the real world. The problem is the process executing the exploit may know that it's reading memory outside it's process, but it has no idea of what resides in that memory and whether it's anything valuable or useful.
@TheLexikitty
5 ай бұрын
Fantastic video, instant sub 💞
@DanielBoctor
5 ай бұрын
Glad you liked it! Thanks for the sub
@MartynDerg
4 ай бұрын
the pizza analogy is absolutely flawless, I love it
@jacobparasite
4 ай бұрын
That is the highest quality of communication I’ve seen in any format for a long time - what a fucking achievement - well done
@DanielBoctor
4 ай бұрын
haha, this is one of my favourite comments of all time. I'm honoured. thank you for the support ❤️
@exildur
5 ай бұрын
Absolutely fascinating video, and very well made & explained!
@DanielBoctor
5 ай бұрын
Glad you liked it! Thanks for the comment
@Elesario
5 ай бұрын
Interesting this came out when they've just found there's a side-channel exploit in the M series chips used in apple computers.
@DanielBoctor
5 ай бұрын
I know, it's a crazy coincidence. I started working on this video about a month ago too.
@pixobit5882
5 ай бұрын
@@DanielBoctor I've watched this video a few hours ago an now i've stumbled across a primeagen video about the M series problem, where LowLeveLearning explains exactly the same as you did in this video.
@sehichanders7020
4 ай бұрын
There are only two hard problems in computer science: *Cache invalidation*, naming things, and off-by-one errors.
@markissboi3583
5 ай бұрын
i was done when frank meeks noticed white house ordering 100's pizza Done .
@Xenonuxium
5 ай бұрын
Thanks to you, I finally understood it!
@DanielBoctor
5 ай бұрын
That's awesome to hear! I'm honoured 😊. Thanks for watching
@YeloPartyHat
5 ай бұрын
Wow. Great explanation. I knew about this before but never has it been so well explained
@DanielBoctor
5 ай бұрын
haha, I'm honoured you think so ❤
@icannotbeseen
5 ай бұрын
I worked tech support for a virtualisation company while this was current and I’m feeling the nostalgia 😭
@JazzJackrabbit
4 ай бұрын
The obvious solution to this problem would be to clear the cache automatically once there is an incorrect branch prediction.
@monad_tcp
5 ай бұрын
6:44 The Von Newman bottle-neck is an absurd way to operate. As John Backus said back in the day, the way we made programming languages and hardware is totally insane and backwards, it worked for simpler machines but it was basically a bodge, and he tried to refuse his Turing award, but was talked out of it. That's how wrong our programming languages and hardware is. That was more than 50 years ago, and people keep venerating Unix, C and VonNewman CPU like a cult or church, like perfection, but that's barely a start. We should do better. Well, this field is very young, and there's much to do to have a perfect cathedral.
@drivers99
5 ай бұрын
Interesting! Any good search terms to find out more? I’m interested in building computer architectures and other systems from scratch.
@kreuner11
5 ай бұрын
@@drivers99don't worry about this guy, I'm not sure how the fact it takes a while to read computer memory is related to it's pure architecture. One could make an ISA which is more explicit in what to do in that gap though
@afterthesmash
5 ай бұрын
John von Neumann was perhaps the smartest guy alive in this field at the time he pioneered digital computation at the IAS. His approach unified code and data, which was a big deal. Anyone else could have come along since then and proposed a better method suited to subsequent generations of hardware, including John Backus. It never happened because it's a very hard problem. There are a finite number of pins on the CPU package. That's where the bottleneck originates, not the von Neumann architecture. I studied Backus's proposal for the programming language FP back in the 1980s. There was merit in what he was proposing at the software level, but he never contributed anything useful to hardware architecture other than hot air.
@Dreamer66617
5 ай бұрын
10/10 video subbed. nice visuals direct and clear excplanations
@DanielBoctor
5 ай бұрын
Thanks! Glad you have you apart of the community
@floodtheinbox
4 ай бұрын
There are a lot of videos talking about computing exploits but the way you wrote and described this one is super approachable and made it really easy to understand.
@snorman1911
3 ай бұрын
Super, this is the first time ive actually seen the details explained. Usually, it's a hand wavy "and then they steal the data from the cache."
@IvanToshkov
5 ай бұрын
This is really well explained. Thank you!
@jussiheino
5 ай бұрын
Good stuff, clear explanation
@coladict
5 ай бұрын
These prediction rollbacks not reverting the cache could also explain how we often get defects (usually crashes) on a piece of code, but then when you run it with the debugger turned on (which executes instruction by instruction, without speculations) then it all works fine.
@schwingedeshaehers
5 ай бұрын
the speculation still happens, it is from the CPU hardware, not software.
@afterthesmash
5 ай бұрын
That's far more likely to be an old-fashioned data race at the software level. The hardware insulates the software from _all_ of the logical consequences of speculative execution along a failed path. What it doesn't reverse are the hardware level side-effects on cache timing on subsequent use of the cache. Those differences in cache time could interact with a data race in software, but that's a unicorn dating a sasquatch. It wouldn't be my first hypothesis. It's actually a lie about rolling back. The last phase in the execution pipeline is to commit to real registers. None of these commits are _ever_ allowed to happen until all speculative execution and privilege tests have succeeded upstream. The only register that actually gets rolled back is the program counter, to the point of the last known good commit.
@schwingedeshaehers
5 ай бұрын
@@afterthesmash yeah/some other bug, because of optimizing and undefined behavior
@mechadense
5 ай бұрын
1:50 - Fingerprints from swipe-sounds ?! No way. Need convincing details to believe that.
@DanielBoctor
5 ай бұрын
here's an article that discusses it: www.tomshardware.com/tech-industry/cyber-security/your-fingerprints-can-be-recreated-from-the-sounds-made-when-you-swipe-on-a-touchscreen-researchers-new-side-channel-attack-can-reproduce-partial-fingerprints-to-enable-attacks and here's the underlying paper: www.ndss-symposium.org/wp-content/uploads/2024-618-paper.pdf
@olegmakarikhin
5 ай бұрын
Spectre and meltdown in smartphones? 😮
@dexterantonio3070
5 ай бұрын
How did they try to patch it?
@sub0rLai
5 ай бұрын
it's un-patchable, you need a new CPU without speculative execution and branching. don't even know if they exist atm.
@dexterantonio3070
4 ай бұрын
@@sub0rLai That is not entirely true. I know intel sent out some fix that ended up bumping up some server energy consumption by 40%
@desaster00
Ай бұрын
so basically you're gaslighting a rock into robbing a bank? What a time to be alive
@KenJackson_US
4 ай бұрын
Wow. Imagine being the guys that discovered that Spectre attack code. Reading all that code and figuring out what it was doing and why it worked would be almost as ingenious as the attack itself.
@knghtbrd
5 ай бұрын
To explain Specter and Meltdown, imagine a bus that arrives every 0.35 seconds. That bus runs you over, despite the bus working properly and being driven by a licensed driver. … No? Two of you thought this was funny.
@DanielBoctor
5 ай бұрын
I must be one of the two LOL
@knghtbrd
5 ай бұрын
@@DanielBoctor I was going to further feed the beast with a pun about HOME's We're Finally Landing, but that might be a little too on the nose. Besides, you weren't even eating a slice of pizza while explaining this, sheesh. I'll stop now. 😁 Enjoyed the video!
@HamguyBacon
5 ай бұрын
These are not vulnerabilities or accidents, they are deliberate and demanded by the unintelligence agencies.
@xSaDii
5 ай бұрын
Yeah, sure, i can imagine the dialog "let's release a potential vulnerability to everyone in the world because we're the only smart people able to understand how it works" 🙄🙄 Anyone in the world could have descipher this, including North Korea, for example.
@robertsmith2956
4 ай бұрын
@@xSaDii Yea, North Korea is known for notifying the world of exploits so they can be patched. How long did it take for anyone to figure out VW's emission trick? if (OBD2 plugged in == TRUE) .....;
@oscarcharliezulu
5 ай бұрын
Whoa. Just goes to show how hard security really is. If not truly possible.
@zxuiji
2 ай бұрын
The solution is very simple for operating systems to implement. First whenever loading drive memory onto ram it just loads it twice, giving 2 copies of the same memory. When an illegal access is encountered it just reads back a few instructions from the active user execution page and identifies any writes to restore the value of the page from the copy. This will naturally cause the cache to get overwritten effectively eliminating spectre's ability to indirectly grab unauthorised data. Since the page will have a 2nd copy on ram it's feasible to load the memory onto ram once then tell the ram to copy that page to another mapping on it. The speed hit should be much less than disabling pre-emptive execution altogether.
@cry1273
5 ай бұрын
First 🎉 nice video
@DanielBoctor
5 ай бұрын
First indeed. Glad you liked it! Thanks for watching ❤
@KeenyNewton
4 ай бұрын
That’s pizza correlations with side order was brilliant.
@MrSammyTeee
2 ай бұрын
Fantastic use of the Pizza index to explain side-channel attacks!
@swdev245
5 ай бұрын
What a coincidence. Coming here from ThePrimeTime video where he lets a security researcher who just so happened to be in his chat explain the topic. Great video.
@lfla0179
4 ай бұрын
This is like Jean Grey telling Spiderman: "you were the only man that didn't picture me naked". Which spiderman will promptly picture her naked. There, cartoon humans are prone to speculative execution from cartoon psychics too.
@mightytheknight2878
2 ай бұрын
Hardwere issue, that is insane A hack that is no bug, no real software or protection issue; literallyjust confusing the cpu by gaslighting it, insane This video are very informative
@dirtydan6960
4 ай бұрын
I wanna imagine some software dev trying to figure out why his program keeps getting segmentation fault errors and just stumbles across this to get it working
@gaiustacitus4242
5 ай бұрын
Gamers always know when military operations are getting underway. How? Military personnel notify their guilds that they will be absent to avoid being kicked from the guilds. They also make similar arrangements to make bill payments, to have mail delivery changes, and many other things that "side channel" analysis can use to make accurate predictions.
@mrpicky1868
5 ай бұрын
would be nice to hear about the state of these vulnerabilities and also list of CPUs(only popular ones) that have no big vulnerabilities
@richardmillhousenixon
4 ай бұрын
If it doesn't have any big vulnerabilities, it just doesn't have any _known_ big vulnerabilities.
@rekall76
2 ай бұрын
what's surprising to me about cache hit detection timing hacks is that cpu's with speculative execution weren't designed to invalidate some cached data during a rollback
@abhishankpaul
5 ай бұрын
"Let's not get ahead of ourselves" *also proceeds to explain how to obtain correct information after speculatively running code to access data
@Redsmeg68
4 ай бұрын
The people that figure this stuff out are geniuses
@christopherl.potter3915
3 ай бұрын
Wait wait wait - ACOUSTICALLY reading your fingerprints by the swipe of your finger across the touchscreen?!?!? Holy guacamole, what information is sacred?
@waynekeenansvideos
5 ай бұрын
Great explanation. Slight niggle... It's not the OS that does the memory access check it's the MMU in the CPU. So it seems that for (optimisation/complexity?) reasons the CPU manufactures don't actually enforce the MMU settings, which are configured the OS. When an access violation occurs it's the CPU which raises a fault that the OS traps.
@DanielBoctor
5 ай бұрын
This is very interesting, thanks for pointing it out! I didn't realize this at the time. The more you know. I went ahead and updated my pinned comment. Thanks again!
@waynekeenansvideos
5 ай бұрын
@@DanielBoctor No worries. A really minor point, the rest of the video is amazingly clear. thank you.
@brovid-19
2 ай бұрын
Bru, I love how you just explained SPECTRE with pizza.
@grantwindsor6814
5 ай бұрын
The fact that you were able to something insane so so simply is insane. Great video
Пікірлер: 1,6 М.