Meltdown & Spectre vulnerabilities - Simply Explained 

@@dm1x Thank you!

...or Meltdown...js

it's a general concept that works, unlike Meltdown which is specific. Essentially it's a paper showing the following: 1. you can train a branch predictor (the thing that guesses where an if statement will go) to reliably miss, this can be used to force speculative execution of the malicious read without it crashing as that's the wrong path, yet it still takes place 2. it is possible to accurately time access latency, this reveals if something is on cache or not 3. you can exploit the JIT compilers used for JavaScript to do this stuff this is to be tailored to the victim machine, unlike Meltdown, and is harder to patch. It also proposes using other side effects of the CPU, Wikipedia for example lists bus arbitration latency aka how long it takes your instruction to get allowed to use the main data bus and a number of other "features" of modern processor design

meltdown and spectre are very smiliar. the difference is that meltdown works between different programs and specture is access different data within the same program.

And your credit card info, and your photos, or encryption keys, which can be used to man-in-the-middle and trick you into talking with the attacker when you think you're talking with a legitimate website (talking as in loading a web page or some content etc.).

Thanks I was actually thinking this as it moves forward executions in its registars ... I'll translate that in case some "New Gen" gets lost on the web and ends up here ... CPU: "Bruh I got a million things going on psssh I don't need to ask Amy what she wants on her sandwhich she gets it the same everyday I'ma go on a make it" 😝 ish

o_o

"No process can access memory address outside its memory space" this is correct but spectre is doing it by bypassing this mechanism. The speculative execution doesn't check for who's instruction it's speculating and who gave that instruction. It just checks what could be executed afterwards. The attacker could use this to make unauthorized changes in decisions that CPU makes. so the attacker doesn't lose time working against the kernel, instead he uses the permission the kernel gave to him.

ok?

Spectre. Much harder to patch and affecting almost all processors.

5:35 fatal laugh

It’s because the program using the exploit can do it really fast. As said in the video, it can guess 500kb/s, that’s 8000000 characters guessed per second. You see where this is going? It can guess a password and get it right character by character really quickly.

Sorry I meant 4000000 characters guessed per second* some simple math error on my part

It only fails if it chooses the wrong branch in the code. If only one branch is possible it won't fail.

I know I'm very slow to the punch on this one, but I thought I'd explain for anyone else confused. An attacker isn't interested in the result of readPixel(1), but rather how fast it occurs. Another process will run in the background of the protected memory access that will time how long it takes for readPixel(1) to be executed AFTER the comparison has been speculatively executed. What we're interested in is whether the pixel is already in cache or not; if we read the pixel very quickly then we know it must be in cache and the first letter of the password must therefore be 'S', but if it takes a long while then the pixel must still be in memory. If it's not in cache then we can deduce that the first letter of the password isn't 'S', as if it were, readPixel(1) would have been executed speculatively. Hope this is explained well for anyone else who stumbles across this, have a good day! 😊

Georgios G same in 2 dell laptops it sucks

I KNOW HOW TO FIX IT. Look up 'InSpectre' on google and download it. Run it as administrator and click 'Disable Spectre Protection' then restart your computer. Your pc is gonna be hella fast after that.

@@pseudorightful2406 And vulnerable.

my phone contain a risk

30 or 60fps is no additional work for me. It's just an export option in my animation program & editor. As for the rest: I tried my best at explaining both in simple terms. It doesn't always workout great for everyone.

@@simplyexplained I've had trouble getting a straight answer from anyone, really. My expectations were probably a bit high.

it's not the same lmao I just googled and even though they are of the same idea. They are not the same.