Antivirus is shit, everything is compromised, etc etc (Cybersecurity thread)

[Lana Torrin]

Dont really know what I expected.. Of course im vulnerable..

[Malcanis]

Looks like it's upgrade time for you. Pity this happened just before the Ryzen 2 gets launched.

[Mashie Saldana]

Dont really know what I expected.. Of course im vulnerable..

That is pretty much how the report looked like for my Xeon E5-1650 which is the same generation.

I'm intrigued how easy any of this would be to exploit on a Linux system behind a firewall that only has OpenVPN exposed to the world. Of course if all that is needed is a Java script in a browser then I'm probably stuffed.

[elmicker]

Browsers are pretty thoroughly hardened against speculative execution attacks now.

[Nordstern]

Browsers are pretty thoroughly hardened against speculative execution attacks now.

What about in-game browsers? Or an attack method that doesn't rely on a browser?

[Straight Hustlin]

Real question here, what exactly is possible through these exploits that can affect your average home user? From what my laymans interpretation of the reports when this first came out, it seemed like it largely affected data centers and virtual machine setups.

Sent from my Moto Z2 Play using Tapatalk

[Daneel Trevize]

Imagine you run a common password manager, so you don't have to manually generate or remember high-entropy passwords.
Then think what access someone would gain by having the data from this, and/or access to your google/email account.

Most of most people's entire digital security is behind 1 main password and maybe 1 physical device as a 2FA factor.

[Spaztick]

Yea, for the consumer or home user I see this as a way to access password to get into other more valuable things. Nothing important is on my home computer with the i7 that I use for vidya games and such, but my laptop is a potential vulnerability because that's where all the work happens. They haven't said if an Apple computer is vulnerable because it would have slightly different architecture but it's still an Intel chip. Can't exactly rip that out and replace it with an AMD.

[Nordstern]

Yea, for the consumer or home user I see this as a way to access password to get into other more valuable things. Nothing important is on my home computer with the i7 that I use for vidya games and such, but my laptop is a potential vulnerability because that's where all the work happens. They haven't said if an Apple computer is vulnerable because it would have slightly different architecture but it's still an Intel chip. Can't exactly rip that out and replace it with an AMD.

You just made me nostalgic for Super Socket 7 boards. AMD K6-III+ running at 450MHz!

[Cosmin]

Yeah my Ivy-E shows the same "stats".

Fuck this shit.

[Nordstern]

Made some memes, feel free to steal/redistribute.

[Malcanis]

Now that almost all the traditional northbridge functions are handled on die by both Intel and AMD, there's probably no insurmountable technical barrier to doing this, but IIRC, the stopper is Intel refusing to license their sockets, not AMD refusing to build for them.

[Cosmin]

If my memory serves me right, at one point there were motherboards who would take both Intel or AMD CPUs, but were manufactured by a third party? I'm not sure, it was a really really long time ago and mostly didn't work anyway.

[Mashie Saldana]

If my memory serves me right, at one point there were motherboards who would take both Intel or AMD CPUs, but were manufactured by a third party? I'm not sure, it was a really really long time ago and mostly didn't work anyway.

That was back in the 386/486 era. Back then you could plug in either an Intel, AMD or Cyrix CPU as they were pin compatible.

[Daneel Trevize]

Made some memes, feel free to steal/redistribute.

AMD booth has you beat

[Spaztick]

DEFCON should be fun this year.

[Keckers]

Real question here, what exactly is possible through these exploits that can affect your average home user? From what my laymans interpretation of the reports when this first came out, it seemed like it largely affected data centers and virtual machine setups.

Sent from my Moto Z2 Play using Tapatalk

I kinda feel like the biggest risk to my data is still vulnerabilities in third parties.

How scalable are these exploits that home users could be targeted en masse?

[elmicker]

biggest risk to your data is still yourself and your idiot colleagues

not trivially - still need a vector to get code onto the machine. browsers are increasingly hardened so you need to already be bouncing through something else or delivering compromised binaries, at which point who gives a shit.

[Nordstern]

If my memory serves me right, at one point there were motherboards who would take both Intel or AMD CPUs, but were manufactured by a third party? I'm not sure, it was a really really long time ago and mostly didn't work anyway.

That was back in the 386/486 era. Back then you could plug in either an Intel, AMD or Cyrix CPU as they were pin compatible.

Super Socket 7, as I mentioned previously.

AMD booth has you beat

EPYC LEVELS OF SHADE!

That popcorn machine belongs in the AMD booth. An AMD rep should just go take it. When questioned by the Intel reps, they should respond with "We're about to steal your business, and you're worried about us stealing a popcorn machine?"

[Keckers]

biggest risk to your data is still yourself and your idiot colleagues

not trivially - still need a vector to get code onto the machine. browsers are increasingly hardened so you need to already be bouncing through something else or delivering compromised binaries, at which point who gives a shit.

Having less than 5 colleagues who have the potential to be idiots makes me pretty safe then.