hertzbleed.com
What now Any Forums?
What now Any Forums?
Adam Nelson
Alexander Garcia
Don't care, not upgrading my kernel, not updating my microcode, mitigations=off, fuck off.
Andrew Cook
fpbp
/thread
Carson Collins
This. These sort of attacks are never deployed in malware targeting consumers. If I was running a web server I'd be rushing to apply any mitigation for this. But I'm not putting it on my gaming PC, work laptop or home server.
Dylan Kelly
It's a nothingburger
Zachary Reed
>Name Logo Website
getting tired of this template whenever some new, "earth-shattering" vulnerability is announced
Elijah Miller
>Logo
>ambiguous description
>research link
>Q&A: Am I affected?? What can I do now??
Jaxson Williams
>When did you disclose Hertzbleed?
>We disclosed our findings, together with proof-of-concept code, to Intel, Cloudflare and Microsoft in Q3 2021 and to AMD in Q1 2022. Intel originally requested our findings be held under embargo until May 10, 2022. Later, Intel requested a significant extension of that embargo, and we coordinated with them on publicly disclosing our findings on June 14, 2022.
>Do Intel and AMD plan to release microcode patches to mitigate Hertzbleed?
>No.
>Why did Intel ask for a long embargo, considering they are not deploying patches?
>Ask Intel.
IT GLOWS
Lucas Long
Why was AMD notified 2 quarters later?
Adam Martin
Whenever a vulnerability researcher wants to feel important, they get an bug that ((((could))) to be real exploit (if the planets align) and make a website saying how clever they were for finding it and throwing a big middle finger to anyone related to that code.
Security bugs are just bugs, that is.
Also, this explains why they are sooo insistent on complete disclosure instead of responsible disclosure. Otherwise they cannot get the fame they want with their little website.
Lucas Collins
>mitigations=off
Based beyond belief
Perhaps differences in architecture?
Gabriel Flores
>tfw i have been this sad clown for over 20 years now
Ryder Thomas
just keep your computers working hard so the CPU clock frequency never scales down
Austin Nguyen
>including desktop and laptop models from the 8th to the 11th generation Core microarchitecture
mfw I have 4th gen
Cameron Rogers
this is pretty much the suggested solution, disable scaling
John Phillips
cringe name, therefore disregarded
Luis Harris
M1 cucks please...
Lincoln Gutierrez
>pic
honk fucking honk bros
Juan Flores
>muh timing sidechannel
>proof of concept runs locally
>IT CAN ALSO BE EXPLOITED REMOTELY WAOW
>no proofs
Have any of these ever actually been demonstrated to work remotely? I would imagine network latency would screw up measurements, so it'd have to be in the form of getting the target machine to run a script. The closest thing I've seen was a JS implementation of Spectre but the accuracy was balls.
Jaxon Martin
>tfw typing this on my M1 MacBook Pro
Carson Reyes
Say it again.
Cooper Taylor
How much did they short intel?