![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
- Joined
- Dec 19, 2005
- Messages
- 18,858
Hmm. Not too good, more performace regressions coming?
"But the fact that Intel has left variants of MDS unpatched for more than 18 months, in fact, raises the question of whether sophisticated hackers may have already used them on real targets, says Vrije Universiteit researcher Herbert Bos. Intel noted in a blog post about its latest MDS patch that "to date, we are not aware of any use of these issues outside of a controlled lab environment." But Bos points out that the technique leaves no trace that would make in-the-wild attacks detectable. "Researchers find these things without even trying very hard. And it probably means that other adversaries will find them, too," says Bos. "If you have a powerful group of hackers associated with an intelligence agency, they're not going to say, 'Here’s one proof-of-concept, now I’m going to stop looking.'"
Just as troubling, argues Vrije Universiteit's Giuffrida, is the fact that Intel doesn't seem to be taking proactive steps to find new vulnerabilities or variants of existing ones on its own. "If Intel isn’t looking and is making no effort," Giuffrida asks, "who knows how many vulnerabilities are left?""
https://www.wired.com/story/intel-zombieload-third-patch-speculative-execution/
"But the fact that Intel has left variants of MDS unpatched for more than 18 months, in fact, raises the question of whether sophisticated hackers may have already used them on real targets, says Vrije Universiteit researcher Herbert Bos. Intel noted in a blog post about its latest MDS patch that "to date, we are not aware of any use of these issues outside of a controlled lab environment." But Bos points out that the technique leaves no trace that would make in-the-wild attacks detectable. "Researchers find these things without even trying very hard. And it probably means that other adversaries will find them, too," says Bos. "If you have a powerful group of hackers associated with an intelligence agency, they're not going to say, 'Here’s one proof-of-concept, now I’m going to stop looking.'"
Just as troubling, argues Vrije Universiteit's Giuffrida, is the fact that Intel doesn't seem to be taking proactive steps to find new vulnerabilities or variants of existing ones on its own. "If Intel isn’t looking and is making no effort," Giuffrida asks, "who knows how many vulnerabilities are left?""
https://www.wired.com/story/intel-zombieload-third-patch-speculative-execution/