Unpatchable Apple Exploit Found!!!

Recorded live on twitch, GET IN
/ theprimeagen
Become a backend engineer. Its my favorite site
boot.dev/?prom...
This is also the best way to support me is to support yourself becoming a better backend engineer.
Follow Low Level!!!!
/ lowleveltweets
/ lowlevellearning
Article link: arstechnica.co...
By: Dan Goodin | da...
MY MAIN YT CHANNEL: Has well edited engineering videos
/ theprimeagen
Discord
/ discord
Have something for me to read or react to?: / theprimeagenreact
Kinesis Advantage 360: bit.ly/Prime-K...
Hey I am sponsored by Turso, an edge database. I think they are pretty neet. Give them a try for free and if you want you can get a decent amount off (the free tier is the best (better than planetscale or any other))
turso.tech/dee...

[@HyperionStudiosDE]

So annoying when researchers stumble over your government backdoor. 😞

[@_Safety_Third_]

☝️

[@CommanderRiker0]

No joke...

[@Volvith]

I wouldn't be surprised if there's a whooole lot of 0days we just don't know about. And by 'we' i mean the common people, us plebs.

[@Knowbody42]

@@Volvith Of course there are. Stuxnet proves this. Using several zero day vulnerabilities and a leaked private key from Realtek.

[@Dekatelon]

it's just one of many...

[@S0L4RE]

Chat message I saw was so funny… > users act worried about a low level vulnerability, meanwhile they're giving league of legends a rootkit

[@Volvith]

Lmao. _If you think it's just league of legends you should look up how many rootkit-access level anticheats/DRM's are employed in the gaming industry._ The best part is they don't even work. Cheaters can literally just sidestep nearly all of them. And what few they can't, they will some time in the future.

[@xeqqail3546]

It's a good thing guys! a reason to finally ditch the game cuz tencent gonna data mine your pc through root kit

[@OveRaDaMaNt]

@@Volvithwhile they are frequently side stepped, they aren't that big of a deal to have on your pc. People have been whining about it for years and yet nothing bad has happened. This is why normies don't even care about that stuff.

[@sathalel4084]

@@OveRaDaMaNt ESEA literally used their kernel level anti cheat as a bitcoin miner. Vangaurd has been shown to cause multiple issues with end user machines crashing them over driver issues. Just because you aren't aware of issues doesn't mean they don't exist.

[@moonasha]

@@OveRaDaMaNt nothing bad has happened? didn't hackers use the rootkit DRM in that one chinese gacha game to install ransomware on people's computers? And then the one that helldivers uses has had loads of bad publicity. And I know these things definitely do interfere with drivers, lots of reports of people's peripherals refusing to work. These things literally tamper with other processes. They don't just read them, they write

[@mascot4950]

One day is not a vacation, that's called sleeping in.

[@Kane0123]

When you have a few thousand degenerate pseudo-children in the form of Twitch viewers, any day off would feel like a holiday.

[@MegasXaos]

You mean a weekend?

[@kingoffongpei]

He's making an effort to take more "mini-retirements."

[@snooks5607]

@@MegasXaos less than a weekend

[@Kane0123]

Prime retiring from streaming. It’s official.

[@alexgerdisch]

much love to the LowLevelLearning drop in for more intel, that was cool

[@svenmify]

It’s not intel, it’s apple

[@marss4536]

@@svenmify i think he meant intelligence

[@svenmify]

@@marss4536 well yeah, obviously

[@Chamieiniibet]

The Meltdown is, basically, this: you say "CPU, take the value at this memory address I don't own, and treat it as the relative address in my current memory space". CPU retrieves the value you don't own, goes to the address in your address space, and fetches it into the cache. And then drops the result because of the security. But! As a 16-bit value can only have 65k variants, you can check which of the 65k memory values in your address space is in the cache - by trying to retrieve it and measuring the response time. The address of it is the value by that address you don't own.

[@StinkyCatFarts]

We know

[@MisterAssasine]

I didnt, this was a very concise explanation which helped me understand the problem@@StinkyCatFarts

[@chordogg]

Thanks! I didn’t watch the video but wanted to know the vulnerability.

[@deadchannel8431]

@@StinkyCatFarts 🤓

[@StinkyCatFarts]

@@deadchannel8431 🤡

[@TALHA-hr6xf]

"As an adult, I don't put stickers on my laptop" Tough but fair - I needed to hear this.

[@cenobitedk]

Its so true

[@duckyatsea]

Putting stickers on stuff has absolutely nothing to do with maturity, it was a trash take from a guy who wanted to take a low swing at many Apple users because “I’m so much better with my Linux laptop, look how mature I am”. There is nothing wrong with putting something fun and whimsical and bringing just a little bit more happiness into your day instead of being a gruff, coffee-chugging grouchy computer engineer. Some of us want to actually be happy

[@TALHA-hr6xf]

@@duckyatsea You use a mac and put stickers on it? Do you get your fruit cut up into slices with a sippy cup as well lol

[@littlemeg137]

I'm old as dirt and the whole lid of my Thinkpad is stickerbombed.

[@jeromemainaud]

Having stickers on a laptop is a security. It make your computer unique and reduce the risk of substitution (either on purpose or by mistake) when you use it in a public area.

[@scifino1]

Side channel attacks are a fascinating topic. I remember hearing of one where a specific encryption algorithm was cracked for a specific device, because the device had an LED that would blink when data was being written to memory, which would leak the cryptographic keys to an attacker looking at that LED.

[@0dsteel]

and then it evolves into the LED is lit, but when the cpu draws slightly more power for some specific operation, the LED emits slightly less light D:

[@juleswernes]

but the framerate of the security camera was too low, so they used the moving shutter effect to get a time resolution of the energyconsumption

[@earthling_parth]

@@juleswernesI remember seeing a video about that. It was absolutely wild that researchers were able to guess the card keys used by most hotels with a 24fps feed from a run-of-the-mill security camera.

[@garystinten9339]

It's like watching the HDD light on your PC to determine time of operation... You can see the time and rhythm of a bootup and how your computer processes information

[@FunMushizzle]

Apple knew about this exploit, it's in M1 and M2 chips.M3 chips had a single bit flag added to the hardware to override the prefetch behaviour on demand... they knew. Chip design takes years to get from inception to production, this was found three or four years ago when M3 was a glimmer in Apple's eye...

[@TheBswan]

This does not seem likely. Knowingly doing this would be super illegal and highly risky, and 95+% of users are not going to upgrade to patch a theoretical vulnerability. If your infosec team at work isn't taking away your M1 or M2, they're either incompetent or this isn't a big deal. Caveat I write JavaScript professionally so all this is speculation from a filthy casual.

[@framegrace1]

If they knew, why not fix the issue instead of disabling the whole thing?

[@ingodubingo]

@@framegrace1 $$$

[@1DJRikkiBee]

​@@framegrace1Because if they don't fix it, people will buy both.

[@earthling_parth]

So you're saying that before Apple even released their first M1 chips, they knew about this and still chose to release computing systems with that vulnerable chip in there? Doesn't apple always prioritize your security and privacy though? /s

[@bonsairobo]

Spectre and Meltdown described as "back in the day". Hooooo boy.

[@zeuglcockatrice4633]

we gettin old son

[@nosleep7026]

i mean... thats almost 10 years ago

[@wafinashwan8242]

god we old. i have a laptop vulrable by spectre

[@codey1391]

@@nosleep7026 6 years is not almost 10 years

[@MrHaggyy]

Spectre was possible on some high end chips from 2008 and many chips from 2012 onwards but you needed physical access to the socket. In the 2017/2018 breach the problem was that you could do the same things via remote diagnostics if the system was setup for it. Which sadly many chipset-bios-cpu combination were out of factory.

[@loocid455]

"I want on a vacation for a day" is the most American thing ThePrimeagen has ever said.

[@Tidbit0123]

LMAO

[@Enhancedlies]

nail on the head , Americans dont understand

[@meanmole3212]

I WANT on a vacation for a day, as in they don't even get that 1 day off, it is only in their dreams.

[@UliTroyo]

Oh snap, it’s Low Level Learning! He rocks!

[@w3w3w3]

yea fr

[@microcolonel]

Let's say hypothetically they knew that this "0day" was here, and love that it will force people to prematurely retire M1 machines.

[@mcchaderson]

The people who would care about this would change hardware…no?

[@CommanderRiker0]

@@mcchaderson Agree, but more so they would use software based disk encryption if they were really paranoid.

[@doresearchstopwhining]

Stock is up despite being sued via anti-trust laws...

[@IOverlord]

Appletards gonna be happy to buy another improved and secured device only for $6942.0 just because it doesn't have that backdoor.

[@owenelliott5742]

@@doresearchstopwhiningwe're approaching the end of capitalism

[@zeathe]

I had someone ask about the stickers on my laptop... I said they're the computer geek version of prison tattoos

[@_Safety_Third_]

I've got an ironic CIA sticker on my laptop. What's that the computer geek version of?

[@monad_tcp]

@@_Safety_Third_ Who knows, but it is not ironic.

[@Volvith]

@@_Safety_Third_ Letting your buddy, who 'totally has like done a lot of tattoos before yo', tattoo a d*ck on your forehead.

[@icodestuff6241]

@@_Safety_Third_ blood gang tattoos

[@karmatraining]

That's funny

[@beofonemind]

It scares me how smart hackers are, and the techniques they have that I would never think to defend against.

[@JohnathanMenezes-yb2ux]

because you don’t have the resources of a major nation state behind you….

[@garystinten9339]

It's just like taking a 3d cube and turning to it looks at the same cube but from a different angle.. basically reordering the information into another outcome based on what info you have and how you want to twist it.

[@beofonemind]

@@garystinten9339 Interesting way to put it, Thank You.

[@JeffSherlock]

Smart or not, its what they do. They that millions of other people used to do things, before computers put them out of business.

[@Nik-rx9rj]

You are the PRIME source of tech news. I love coming back to your videos EGEAN and EGEAN

[@Eldarlll]

Fitting pfp

[@wafinashwan8242]

fireship better

[@Eldarlll]

@@wafinashwan8242 they different things. fireship is shallow and just gives a short summary, while prime often gives great insight

[@duckyatsea]

He can't even talk about tech news without acting special for having a system76 laptop (which were vulnerable to Meltdown/Spectre in the past), I would hardly say he's a good source.

[@username7763]

This is totally patchable. Pop the CPU out of the socket and pop a new one in. That was the fix for the Pentium fdiv bug. Apple just has to mail everyone a new CPU. Expensive, for sure. But this is what companies with recalled products do. Oh, soldered in and glued together.... yeah "modern" computing is dumb.

[@yearswriter]

M1 die soldered . But I get teh idea

[@NotYourSpy]

boomer take. monolithic everytime. all day battery. i do not own a mac.

​@@NotYourSpybig dum dum take. No replacement for displacement. Enjoy your Tesla.

[@Chamieiniibet]

Well, it's almost the entire machine is that "CPU". So the replacement item price would anyway be almost equal to the price of complete mainboard

[@monad_tcp]

SOCKET, ahahah hhaaqhahaha haaaaaaaaaaaaaaaaaa haha no sockets, you have to use a BGA reflow station and pay $$$$ for specialized service. get rekt

[@ryangrogan6839]

Basically, a side-channel attack is being able to derive information from observing the operation of some system.

[@SaraMorgan-ym6ue]

basically stop watching Microsoft porn kid🤣🤣🤣🤣🤣🤣🤣

[@JibunnoKage-cj2kz]

Original side-channel issues where (as I recall) first raised as an issue right after virtualization was becoming mainstream in datacenters... about 2003-2004 or there about. At the time VMware and other type-1 hypervisor publishers (most not yet mainstream) were struggling to create methods to protect VMs watching VMs on the same physical machines.... explaining this issue... to non-technical management... was I think one of the most difficult things I have had to do in my 30+ IT career in virtualization/security/infrastructure design work. And what is possible now, is light years more complex, you have only scratched the surface of what the real zero-day exploits are now.

[@SaraMorgan-ym6ue]

are those encryption keys critical security flaws or are they the option to allow you to replace the ssd on the apple laptop has anyone checked out if that is possible with that leak?

[@FAB1150]

To explain it further, a side channel attack is an attack that doesn't use flaws in something, but observes how it is working. The famous example is the pizzerias near the Pentagon: The pentagon is extremely secure so knowing then they're planning something is (let's say) impossible... But when everybody is working, they eat at the facility, so you see a spike in orders at nearby pizzerias! The spectre/meltdown attacks work by making the CPU think it's gonna load something by for example running a function repeatedly that always returns something. Once it's "trained", you suddenly make the function return something else. The CPU will have already returned the value you repeatedly calculated before, and it has to redo the operation once it sees it's wrong. By timing how long the CPU takes to correct the mistake you're able to understand what it's doing! Spectre/meltdown use this to gather data about what is in cache (for example, doing a simple operation multiple times on parts of memory you can access, then suddenly try to do the same operation on a part of memory you can't access so the CPU does it, realizes it can't, and corrects the mistake while you time it), without actually ever reading the cache. Super cool! Explanation about the actual attack is very simplified because I don't know how it works more in depth than this lol. It's black magic

[@RichHeart89]

Pc: vulnerability found and lessons learned in 2016. Apple: well let’s do it in 2024

[@JAN0L]

5:15 Someone had that same battle net update popup happen to them at the end of a no-hit run in Dark Souls and died because of it.

[@super_salty9189]

Zentreya. Was the saddest shi ever.

[@npsit1]

For the memory leak from the cache, an attacker could tell the CPU to return values from memory outside the range of where data is protected because the branching prediction doesn't check the memory space restrictions, therefore you can effectively get some data from the branch prediction outside of its own memory space. The data may be inaccurate because it's only a prediction, but it's still data regardless.

[@jonnyso1]

Side channel sounds scary AF, the kinda thing you go into a habbit role of madness to avoid if you're really paranoid.

[@johnchilton4005]

Cool cameo by LowLevelLearning!

[@monad_tcp]

lol "cameo" its a voice "cameo"

[@johnchilton4005]

@@monad_tcp I don't find that "cameo" is limited to visual media

[@djin81]

I'd imagine your isPointer(value) function would be something like - The HW MMU knows the pages allocated to the virtual memory sandbox the application is in. So the HW cache looks at the upper bits of values in the cache and if they match a virtual page address mapped in that processes virtual memory sandbox, that's pretty likely to be a pointer. I think it'd probably just look a few resent cache page addresses, like a TLB. Scanning through all allocated pages would obviously be a performance loss in a L1 or L2 cache.

[@monad_tcp]

I still wonder why they don't use pointer tagging via hardware, its just 3 extra bits, how much more expensive that can be ?

[@DigitalOsmosis]

Additionally, in normal operation at a hardware level there are probably patterns that repeat, so tracking state over time you could probably build an engine that could improve performance by guessing if the next operation "isPointer"

[@NoodleBerry]

Well pointers (that aren't null) tend to be big positive numbers, so I guess every big positive number is a pointer now.

[@cat-.-]

It’s very easy to imagine a looks_like_ptr() function. Only some ARM instructions allow pointer operands. So if you have some data that is the same as an ARM machine code which takes a pointer operand, and the “pointer” looks like a viable virtual address, then the data looks like a pointer.

[@riley1636]

Icestorm cores are the name for the efficiency cores. The performance cores are called Firestorm cores. Likely a reference to their impact on the thermal envelope of the CPU.

[@thekwoka4707]

Bitwise math is cool, and more people should know it in programming

[@CharlesBallowe]

Responsible disclosure can also be "seeing active exploit in the wild". A theoretical attack that isn't being actively exploited is lower risk, but active exploits need to alert people so they can defend.

[@XDarkGreyX]

My noob self caught mention of the XOR swap earlier this year and I looked it up and found articles but man was I too stupid to grasp their explanation. That bit magic eludes me.

[@nyx211]

It's simple: a XOR a = 0 a XOR 0 = a a XOR b = b XOR a That means that: a XOR b XOR a = b b XOR a XOR b = a

[@garystinten9339]

Think algebra terms

[@gwentarinokripperinolkjdsf683]

I love how prime is just as intrigued by xor swap as I was. I found it myself when trying to swap too variables without using an intermediate variable and I wanted to do it in a way that wasn't just using an intermediate behind the scenes. then i quickly looked it up and was glad to see it was a very old algorithm

[@lucaszapico926]

Honestly! Super cool that you just plugged lowlevelearning into your stream. 👏👏 nice job with your community prime!

[@Feedback406]

Low Level Learning X Prime 🔥🔥🔥🔥🔥

[@taylorcox8743]

This only works if your Mac is already compromised, it’s an issue with the silicon but if it gets to that point then your machine is already infected.

[@L1Q]

Wrong, you would not call your machine infected because you run JavaScript on Amazon page. When meltdown and spectre happened, js engines exposed enough precision in their timing APIs it was a viable vector of attack.

[@littlemeg137]

I forget who said it first, but laptop stickers are the tech equivalent of prison tattoos.

[@FalcoGer]

@6:00 spectre works something like this: 1. Allocate Memory Array: The attacker creates a program that allocates a memory array. 2. Condition Branch Predictor: The attacker conditions the CPU's branch predictor to predict that a bounds check will pass. 3. Access Out-of-Bounds Memory: The attacker feeds an out-of-bounds address to the array. 4. False Branch Prediction: The CPU's branch predictor falsely predicts that the bounds check will pass. 5. Speculative Execution: The CPU speculatively executes code, including accessing data from the out-of-bounds address and using it to index another array (the "capture" array) owned by the attacker. This causes that part of the capture array to be put into cache. 6. Branch Misprediction: The CPU eventually realizes the branch prediction was wrong and undoes the speculatively executed code. 7. Cache Side-Channel: The CPU does not undo the cache fetching of the capture array, leaving traces of the speculative execution. 8. Access Time Measurement: The attacker measures access times to the capture array to determine which index corresponds to the data accessed speculatively. 9. Cache Eviction and Repeat: The attacker evicts the cache for the capture array and repeats the process.

[@rezasajadiany7120]

looks like a pointer in prefetcher is simply if this address was previously used as a pointer (and that instruction committed ok) then the prefetcher "learns" that information in what you can think of a "hardware table." So, address 0xdead was once accessed as a pointer, then prefetcher allocates a row in that table and remembers this address in case it sees it again in the future. Now there is another problem here: all these uArchitecture optimizations are left as is during context switches (too expensive to clean up everything,) so you could leak information across context too... It's can of worms that shows up with prefetchers and branch predictors

[@chickenduckhappy]

That we still load cryptographic secrets into general purpose hardware with caching and branch prediction &c. Is absolutely insane plus a general backdoor into all current computers. We only use specialized hardware for login and disk encryption, so why not also for all other crypto with universal kernel support and a common little C library? And I mean since 2014 or so, when timing attacks on otherwise unreachable memory were a big topic for the first time?

[@loocheenah]

the M1 chip is just asking its AI cores trained on exabytes of pointer addresses to distinguish between what is a pointer address and what is not

[@kzalesak4]

Been watching for a while, absolutely love the streams. Endless fun and tons of info. Thanks!

[@ThePrimeTimeagen]

tytytyty

[@jackle3002]

Man I must be a mad nerd.. because I’m just cracking up at “looks like a pointer code” you’re awesome prime.

[@spencert94]

It sounds like they're saying since they know the encryption function, the IsPointer function, and if IsPointer has returned true (since they can see if the cache has updated?), they construct a piece of data x that goes in like IsPointer(encrypt(x, key)) and if IsPointer returns true or false that narrows down the possible values of the key.

[@gytisbl]

just want to give a quick shout out to my man *LowLevelLearning* for such a great explanation about side channel hacks

[@DKLHensen]

It's a feature: Hangman, you guess a letter, CPU tells you if it's in there or not.

[@featherless2524]

As an adult I have a crazy subs sticker, a remilia sticker and a drawing I made myself stickered all on the side. Only kids wouldn't sticker their computer that's for sure!

[@DiegoBM]

The highlight of this video for me is that Low-level learning follows the primeagen!

[@inventorofmachines]

idc if someone physically has my laptop, I'll consider it compromised. vulnerability discovered or not discovered.

[@nb6175]

Really!? If you run full disk encryption you simply would consider your data p0wned if someone has your laptop? What is the point of full disk encryption then? Why even bother?

[@arabiancandybar]

@@nb6175 Why are you so upset about full disk encryption all of a sudden?

[@inventorofmachines]

Ya i dont use full disk encryption. I guess if someone is willing to desolder my ssd and do electronics black magic with it, ill consider that they just have all my stuff anyway, regardless of if this vulnerability existed or not.

[@LusidDreaming]

Yea, but there are a lot of people with very sensitive data on their laptop where it does matter. It wouldn't necessarily be catastrophic to me (annoying nonetheless), but I could imagine people in intelligence, defense and financial sectors would probably be more paranoid about something like that.

[@segueoyuri]

I missed the part where the article mentioned it was a physical exploit. It doesn't seem to be. It actually says any software can get this access and it doesn't even need sudo access. I don't think Apple would compromise regular user performance because some people would desolder SSDs from macbooks (which is very annoying and time consuming btw) and apply a very specific exploit that can take 10 hours to get something.

[@gardensalsasunchips562]

It doesn’t require physical, as in touching the processor, access. You need access to the same processor as another process you want to infer information from

[@adjusted-bunny]

It's all about dangling pointers and backdoors.

[@stylis666]

"I don't put stickers on my laptop; I'm an adult. I like things clean." One moment later: "Raptor Lake, that's a badass name!" I'm with chat on that one, you need stickers on your laptop 🤣

[@SupBro31]

a pointer is usually word aligned, page aligned etc.

[@kazushi-6174]

Seems that only cryptographic algorithms running on Application Processors are at risk, not Secure Enclave(SE)-backed ones like FileVault on internal SSDs or login passwords. So applications that don't utilize SE, including encrypted Time Machine backups on external drives, are no longer secure until patched.

[@j.jester7821]

Apple owes everyone a refund. and maybe some damages.

[@mkabilly]

If you're the processor, it's not hard to "guess" if something is a pointer. First of all, pointers tend to be word-aligned -- if your word is 64 bits long, it means every pointer will be a multiple of 8. Second of all, with Virtual Memory, your pointers don't have absolute memory addresses, but they're all relative to some base (that you, as the MMU, know). So the first guess would be: any word-sized value that's a multiple of 8 and is within this process' virtual page boundaries. Not all integers can be pointers in most architectures. Especially modern ones. This isn't something silly.

[@mrechonet]

The way Mac's encrypt the drives is done via hardware keys. Im going to assume none of that stuff is really exposed to the OS.

[@emptydata-xf7ps]

Depending on the architecture, the keys could be read with an oscilloscope as it passes over the motherboard. This is how Xbox was hacked back in the day. I would assume it’s something different but hardware keys are no safer than software keys. If it’s stored in memory anywhere it’s vulnerable somehow.

[@robsnook4512]

@@emptydata-xf7psI just store mine inside the laptops body chassis on a post it note

[@riley1636]

irrc this doesn't impact the T1 or T2 chips but unsure what the usage of that is with respect to how they interact with the cpu or other processes.

[@gabemcguire2463]

Calling Georgia Tech “JIT” is going to show up in my nightmares

[@bencodesall]

Girthy ... lol. Was in a band named "Girth" once. We had side-chain leaking issues too.

[@oleg4966]

Say what you will, it's impressive as hell that this backdoor was only found four years later. On an entirely new architecture that had lots of tech-savvy early adopters, to boot.

[@pradhumnkanase8381]

It was not found after after 4 years lol. It was made public after 4 years

[@oleg4966]

​@@pradhumnkanase8381 Fine, if you want me to be precise: found by people who did not put it there.

[@CitAllHearItAll]

Hates stickers on his laptops. Likes things clean and nice. Has giant mustache. He’s an adult.

[@Njna]

"As an adult I don't put stickers on my..." woah.. take a step back there grandpa. LOL.

[@imcorfitz]

18:20 think I just witnessed the birth of a new meme

[@Mbro-dq2do]

Grow to be 6'4" 230 lbs and I assure you no one is stealing your latop from you.M1 Max here. Best machine Ive ever woned. No doubt thee most secure machine ive ever had

[@graxxor]

LLL was on the ball... super clear and succinct... Fantastic!

[@dexterman6361]

As for pointer prediction, I think there are "usual cases". For example, if I am not mistaken, even if an address is 64 bits wide, the hardware uses only 48 to address memory (~256TB), meaning the top 16 bits are always 0 (if not stuffed with other bits for other optimizations by the programmer ... used, for example, in fast map datastructures). Another part of it is that an application's virtual memory range is typically the same. The stack and heap usually fall within the roughly similar regions (despite ASLR / KASLR), which are later translated by the MMU (memory management unit). Another great way to predict if a value is a memory address is to look at the instructions it is operated upon by. If a value has load, store, offset, and "memory-like" calculations performed on it, it is almost certainly an address. Classic access patterns such as virtual-table indirection for runtime-polymorphism use pretty uniform implementations, so that can be another good metric. I think these operations are not as hard to implement as they seem to be. The first can be done with simple bit-masking. After that, you can check if the value lies b/w some VM ranges (the kernel can do this, and given tight hardware-kernel integration on macs, this shouldn't be impossible to achieve). By this point the value is almost certainly an address. And by perhaps checking what previous instructions were executed on this value, you can pretty confident that something is an address. I mean, it made sense to implement it at a hardware/firmware level and spend really expensive silicon realestate for it, so I think it's safe to assume the implementation itself wasn't thaaaaat hard (for smart engineers), and took up fairly small cost in terms up hardware/firmware resources.

[@kirbofn524]

If im not wrong, for the isPointer function, you could get the memory segments of the process and then just check if the val that is inside the ptr is < seg.max and > seg.min. Making sure its 8 bit alligned, and a bunch of other stuff to check if its a pointer. Not 100% all the time, but very close to it

[@super_salty9189]

Battlenet doing Prime dirty. But still did Zentreya way more dirty.

[@YadraVoat]

Although it's beyond my current ability as well, to design a pointer detector, where I detect you barking up the wrong tree is in that you're talking about programming the pointer-detector using code (instructions), while the actual pointer-detector implementations you're pondering, are implemented in logic gates, so there may well be an "is pointer" flag-bit or register or something else physical which can be checked to see if the 64-bit value is a pointer. I realize that's not the same as "looks like" a pointer, but my point is that this is occurring in hardware, not software.

[@martijn3151]

Another useful purpose of XOR: XOR a value with itself equals 0. This sounds trivial, but is used heavily on for instance the Z80 processor in the Game Boy and MSX. Often you need the value 0 to be in register A. In C this would be something like: int a = 0. So, intuitively you’d think: load 0 in register a (ld a, 0) right? Well, that works, but it can be done way more efficient. "ld a, 0" costs 2 bytes and consumes 8 cycles, whereas "xor a" is only 1 byte with 4 cycles. And on a small CPU like the Z80, that’s a massive improvement.

[@Kane0123]

Battle net requiring a launcher to sit between me and my game is the real performance issue.

[@Foxstab]

Reminder that Ainz actually cast Sharknado. The Overlord author is whimsical.

[@rjakiel73]

A14, M1, M2 and M3. Yes they are all vulnerable.

[@amesasw]

Looks like a pointer? Maybe it's checks if it looks like a valid memory address which code could point to?

[@xdega]

When you picked up your System76 laptop, I about vomited. I used to own one, felt like overpriced piece of white-label junk (cheap plastic laptop with added branding and a significant markup). I remember reaching out to S76 support for a replacement charger, and they quoted me something ridiculous like $200. A little too "premium" for me, tbh.

[@nickm.4274]

Most high watt laptop chargers are pretty expensive.

[@NotGarbageLoops]

Shared device contexts also apply to browser windows. That is, if you have multiple tabs open, and one of them is hammering cache, it can sniff your encryption information via JS. This can happen not only via malicious sites but also ads. I'd link the research paper but.. yeah. KZbin spam filters and all that.

[@nevokrien95]

Values tend to not use the full range of what numbers have to offer. Take uint64. Most uint64s would fit into uint32...and most 32s into 16s. For signed ints you would have that 1 significant bit for the minus then lots of zeros so 100000011 is probably -3 000000011 is probably 3 101101011 is probably a pointer

[@chickenduckhappy]

Simple: you read from your own memory but the adress depends on a hidden forbidden byte from not allowed memory. Then the read into your own memory doesn't actally happen but then you actually read your own memory and one block of memory will be read way faster.

[@francoisdprob]

What an awesome explanation by LLL

[@3rikMad]

One thing to note is that the XOR trick (17:38 - 20:57) doesn't work if both operands are the same variable (or accessing the same memory location). a ⊕ a is always 0, which gets assigned back to a. Since both operands are now 0, a would always end up being 0 instead of its original value like it would be with a true swap. It seems odd to swap a variable with itself, but could be concern if you implement this with a function that takes two pointers and then pass the same pointer to both arguments. Here's an example in C. #include void xor_swap(int *a, int *b) { *a ^= *b; *b ^= *a; *a ^= *b; } int main(void) { int x = 5; int y = 7; printf("Before swaps: x=%d y=%d ", x, y); xor_swap(&x, &y); printf("Swapped x with y: x=%d y=%d ", x, y); xor_swap(&x, &x); printf("Swapped x with x: x=%d y=%d ", x, y); return 0; } It prints the following: Before swaps: x=5 y=7 Swapped x with y: x=7 y=5 Swapped x with x: x=0 y=5

[@julkiewicz]

The attacker doesn't have to have access to the machine. I think it was mentioned that the attack can be launched from within a web browser

[@nbrown5907]

See we kept telling you all NOTHING is safe lol. They just found a low level backdoor into Linux too. Windows is not lonely at all in this manner roflol. Funny thing is Windows 12 is rumored to be much more like Linux and its compartmented design.

[@tenminutetokyo2643]

Finally someone realizes how moronic and childish stickers on laptops are. Wondering how long it would be before someone actually realized it's stupid.

[@dezee2412]

All M2-MaX owners. Shall we start a Class Action to demand a M3 chip upgrade 😶‍🌫

[@AHeinermann]

When governments think building a backdoor into encryption is a "good idea" .

[@Takyodor2]

If it looks like a pointer and quacks like a pointer, it's probably a security issue.

[@girarr3029]

Thank you for the "how would I code that" part

[@gingeral253]

Love Low Level Learning

[@joyjin538]

internal ssd encryption/decryption is not done on the cpu but in the secure enclave.

[@deluxe_1337]

2:00 for real, I always cringe when I see people with stickers on their laptops...

[@AlexanderCerutti]

18:26 Michael Scott summoned!

[@hyperxml]

I’m just commenting to support the Chanel

[@ChristopherBown]

Funny, Apple is having a hard time getting people to upgrade from M1 and M2 laptops. Interesting timing for the announcement heading into Q2. lol

[@Raima888s]

Sounds like the same issues the apple has previously in their t2 security chips. They were also not able to be patched.

[@4w0ken]

Vulnerability != Exploit ;)

[@nicolaskeroack7860]

1:53 *proceed to tell how much he loves rust and dye his hair blue*

[@kneekoo]

5:14 It looks like Blizzard hired Luke Skywalker on the update department, to use the Force. 😆

[@MrOnePieceRuffy]

See.. I'm a Foilhat and I can't be objective on that parts, but for some reason, it's for years ALWAYS a Mechanic like this, which doesn't wants me to believe anymore to the "Skill Issue"-Theory. "0x24000 Segment Overflow" are the Magic Words here (since iPhone 3 btw!). To still thinking, it's not for the Secret Services, is the real Conspiricy Theory

[@hctiBelttiL]

17:24 This bit about XOR memory was brilliant. Earned you my subscription. Thank you for the insight!

[@StrengthOfADragon13]

As I understand how the information is leaked, everyone is allowed to see what addresses are cached, and by making data "look" like an address the DMP will treat the value like an address and grab that "address" making it incidentally public

[@VergilPrime]

Mans just insulted laptop stickers. Bad take bro.