Detail Inception and Phantom attacks (#325)

This commit is contained in:
Than Harrison 2023-08-09 13:04:14 -04:00 committed by GitHub
parent 73d51bae52
commit 6f87ca2035
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -12413,6 +12413,7 @@ Model-specific registers (MSRs) and their configuration bits can also be detecte
- [Hertzbleed](https://www.schneier.com/blog/archives/2022/06/hertzbleed-a-new-side-channel-attack.html) <sup>[[Archive.org]](https://web.archive.org/web/20220712000058/https://www.schneier.com/blog/archives/2022/06/hertzbleed-a-new-side-channel-attack.html)</sup> - Deducing cryptographic keys by analyzing power consumption has long been an attack, but its not generally viable because measuring power consumption is often hard. This new attack measures power consumption by measuring time, making it easier to exploit.
- [Retbleed](https://www.bleepingcomputer.com/news/security/new-retbleed-speculative-execution-cpu-attack-bypasses-retpoline-fixes/) <sup>[[Archive.org]](https://web.archive.org/web/20220804151557/https://www.bleepingcomputer.com/news/security/new-retbleed-speculative-execution-cpu-attack-bypasses-retpoline-fixes/)</sup> - Retbleed focuses on return instructions, which are part of the retpoline software mitigation against the speculative execution class of attacks that became known starting early 2018, with Spectre.
- [Downfall](https://downfall.page/) <sup>[[Archive.org]](https://web.archive.org/web/20230809145002/https://downfall.page/)</sup> - Gather Data Sampling (GDS) and Gather Value Injection (GVI) techniques exploit the **gather** instruction to steal information from [SIMD register buffers](https://en.wikipedia.org/wiki/Single_instruction,_multiple_data) and victim processes.
- [Phantom, Inception](https://comsec.ethz.ch/research/microarch/inception/) - Attacks that leak arbitrary data using seemingly "phantom" instructions on AMD Zen CPUs; "[making] it take wrong actions based on supposedly self conceived experiences", an allusion to the film of the same name.
# Appendix B6: Warning for using Orbot on Android