“Spectre: Secrets, Side-Channels, Sandboxes, and Security”

on YouTube ↗01h 28m

" summary

Speculative execution lets transient instructions touch secrets and encode them in a cache-timing side channel; a live demo shows out-of-bounds speculative loads leaking bytes by timing cache lines. Variants 1, 2 and 4 differ: variant 2 is mitigated in software by retpoline mitigation with <~3% overhead if you recompile, variant 1 can be auto-hardened by speculative load hardening but costs ~30–40% CPU, and variant 4 forces process-level isolation for durable defense; NetSpectre proves remote leaks at very low bandwidth.

AI-written summary · about

" chapters (21)

1. 0:00Introduction
2. 1:55Ground Rules
3. 4:46Vulnerabilities
4. 5:44Information Leak
5. 7:55Side Channels
6. 12:22Speculative Execution
7. 13:04SideChannels
8. 17:57Demo
9. 18:25Timeline
10. 24:53General Variant 1
11. 35:38General Variant 4
12. 40:17Summary
13. 43:22Threat Models
14. 45:37Security Questions
15. 49:42Same Core
16. 50:50Mitigations
17. 51:33Hardwarebased mitigations
18. 52:48RTPulls
19. 54:02How does this work
20. 56:45Overhead
21. 57:51Elephant

" related talks

• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022
• 48mSpeculative execution vulnerabilitiesRaoul Strackx · hardwear.io USA 2019
• 56mSpectre/C++Zola Bridges, Devin Jeanpierre · CppCon 2019
• 24mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 50mPractical Ghostbusting: Meltdown, Spectre and YouIan Coldwater · NDC Minnesota 2018
• 25mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 15mSpecSafe: Detecting Cache Side Channels in a Speculative WorldDanfeng Zhang, Gang Tan, Mahmut Taylan Kandemir, Robert Brotzman-Smith · OOPSLA 2021
• 46mRethinking Architectures and Abstraction for a World Where Security Improvements Matter More than Performance GainsPaul Kocher · USENIX Security '18