Spectre Can Obfuscate Tracking Tools, Too

As the security community learns more about the Spectre vulnerability, clever coders are already finding other exploits. Heres looking at the first of many.

Those doggone programmers. Give them a massive bug and they figure out a way to make it work for them.
Now, if you dont have a programming or geek bone in your body then what follows may seem to be completely impenetrable. You may leave and go sit down with some cocoa without taunts. This isnt for everyone.
OK kids, Mom and Dad out of the room? Lets start.
Serge Guelton was the guy to first figure this out regarding the Spectre vulnerability, and I draw heavily on his blog for the code that illustrates this technique. In fact, to avoid any possible mis-attribution, as well as changes to that code that may occur in the future, I would encourage everyone to
check the blog
for the actual code that is involved in this. (See
New Intel Vulnerability Hits Almost Everyone
.)
(Source:
Pixabay
)
Spectre, at the most basic, allows the reading of a memory location on a vulnerable CPU without actually referencing or accessing that location in a programming sense. It can do this on any location, whether protected or not, and that is what is causing all the problems. (See
Security Warning: Intel Inside
.)
The function that Guelton came up with extends the proof of concept code.
It will first perform a copy from src -- the original program code -- to mem -- the temporary copy that you are making -- to make sure the address is not located on the stack. It will then go on to use the Spectre vulnerability to make a shadow copy from mem to dest, where the programmer can manipulate it.
Gueltons function shadow_memcpy uses a global hidden state -- which is the memory cache -- in order to transfer data from one buffer to another one. This hidden state is invisible to tracking tools, and with this technique there is no data dependency existing between src and dest.
The first sneaky trick that can be done with it is an opaque predicate. Data is injected by shadow_memcpy into the predicate Boolean function, but calls to it will always return true -- no matter what data is injected.
This will also work for storing a function pointer, rather than some value. This extends the utility of shadow_memcpy to wrap all sorts of function calls in its protection.
Tracing tools will usually track the use of any register that has been marked as being a symbolic value. They then will try to reconstruct the instructions in a backwards manner. But use of shadow_memcpy will stop this from happening, blocking the tracking tool.
So, what you have, effectively, is a way to hide what you are doing from most tracking tools.
Now, shadow_memcpy may fail in use. Its a timing attack, and multithreaded applications may throw that timing off. Not only that, someone may analyze the treated code by hand and find a pattern that they can recognize. So, this method is not infallible.
However, we are seeing how a bug or flaw can be used by clever programmers to affect others parts of the system or infrastructure. Such cleverness can only be more prevalent as time goes on and we learn more about how vasbt the Spectre vulnerability is.
Related posts:
Congressman Looking for Answers About Spectre & Meltdown
Spectre, Meltdown Flaws Already Producing Spam
After Spectre & Meltdown, Intel Faces an Evil Maid Problem
— Larry Loeb has written for many of the last centurys major dead tree computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Spectre Can Obfuscate Tracking Tools, Too