• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Intel Reveals New Spectre-Like Attack, Advises Disabling Hyper-Threading

Joined
Mar 23, 2016
Messages
4,839 (1.59/day)
Processor Ryzen 9 5900X
Motherboard MSI B450 Tomahawk ATX
Cooling Cooler Master Hyper 212 Black Edition
Memory VENGEANCE LPX 2 x 16GB DDR4-3600 C18 OCed 3800
Video Card(s) XFX Speedster SWFT309 AMD Radeon RX 6700 XT CORE Gaming
Storage 970 EVO NVMe M.2 500 GB, 870 QVO 1 TB
Display(s) Samsung 28” 4K monitor
Case Phantek Eclipse P400S (PH-EC416PS)
Audio Device(s) EVGA NU Audio
Power Supply EVGA 850 BQ
Mouse SteelSeries Rival 310
Keyboard Logitech G G413 Silver
Software Windows 10 Professional 64-bit v22H2
I take it back for Costco. Since, like Sams, you have to scan your membership card before each purchase (even when paying with a bank card) someone would have to be really dumb to use a stolen bank card there. ;)
With smart chips on payment cards now anyone can use your card as a credit payment, and a lot businesses migrated to no signature required for credit. Not to mention the cashiers don't verify the name or picture on the payment card.
 
Joined
Mar 6, 2017
Messages
3,242 (1.20/day)
Location
North East Ohio, USA
System Name My Ryzen 7 7700X Super Computer
Processor AMD Ryzen 7 7700X
Motherboard Gigabyte B650 Aorus Elite AX
Cooling DeepCool AK620 with Arctic Silver 5
Memory 2x16GB G.Skill Trident Z5 NEO DDR5 EXPO (CL30)
Video Card(s) XFX AMD Radeon RX 7900 GRE
Storage Samsung 980 EVO 1 TB NVMe SSD (System Drive), Samsung 970 EVO 500 GB NVMe SSD (Game Drive)
Display(s) Acer Nitro XV272U (DisplayPort) and Acer Nitro XV270U (DisplayPort)
Case Lian Li LANCOOL II MESH C
Audio Device(s) On-Board Sound / Sony WH-XB910N Bluetooth Headphones
Power Supply MSI A850GF
Mouse Logitech M705
Keyboard Steelseries
Software Windows 11 Pro 64-bit
Benchmark Scores https://valid.x86.fr/liwjs3
With smart chips on payment cards now anyone can use your card as a credit payment, and a lot businesses migrated to no signature required for credit.
And this is the biggest reason why credit card fraud in the United States is higher than anywhere else in the world. I remember reading somewhere that the United States represents somewhere around 35% of the world's credit card transactions but we also represent 75% of the world's credit card fraud. Why? Because there's literally no verification in the US (chip-and-sign, or should I say chip-and-nothing) to make sure that the person using the card is supposed to be using the card unlike in Europe where it's chip-and-PIN.
 
Joined
Mar 23, 2016
Messages
4,839 (1.59/day)
Processor Ryzen 9 5900X
Motherboard MSI B450 Tomahawk ATX
Cooling Cooler Master Hyper 212 Black Edition
Memory VENGEANCE LPX 2 x 16GB DDR4-3600 C18 OCed 3800
Video Card(s) XFX Speedster SWFT309 AMD Radeon RX 6700 XT CORE Gaming
Storage 970 EVO NVMe M.2 500 GB, 870 QVO 1 TB
Display(s) Samsung 28” 4K monitor
Case Phantek Eclipse P400S (PH-EC416PS)
Audio Device(s) EVGA NU Audio
Power Supply EVGA 850 BQ
Mouse SteelSeries Rival 310
Keyboard Logitech G G413 Silver
Software Windows 10 Professional 64-bit v22H2
it's chip-and-PIN.
Still is for debit but it does nothing when your allowed to bypass entering a pin, and instead are allowed credit with nothing else required.
 
Joined
Jul 25, 2006
Messages
12,557 (1.91/day)
Location
Nebraska, USA
System Name Brightworks Systems BWS-6 E-IV
Processor Intel Core i5-6600 @ 3.9GHz
Motherboard Gigabyte GA-Z170-HD3 Rev 1.0
Cooling Quality case, 2 x Fractal Design 140mm fans, stock CPU HSF
Memory 32GB (4 x 8GB) DDR4 3000 Corsair Vengeance
Video Card(s) EVGA GEForce GTX 1050Ti 4Gb GDDR5
Storage Samsung 850 Pro 256GB SSD, Samsung 860 Evo 500GB SSD
Display(s) Samsung S24E650BW LED x 2
Case Fractal Design Define R4
Power Supply EVGA Supernova 550W G2 Gold
Mouse Logitech M190
Keyboard Microsoft Wireless Comfort 5050
Software W10 Pro 64-bit
Not to mention the cashiers don't verify the name or picture on the payment card.
I thought I was clear - guess I was not. Remember, trparky was talking about his credit union debit card and I was talking about my bank debit card. And my comment - which you quoted - was talking about using them at Costco or Sam's. For those not familiar, you have to be a member to shop at Costco or Sam's.

Yes, if someone gets your Costco or Sam's Club card, they can use it at Costco or Sam's Club. And both those places (at least around here) have self-checkouts so no clerks involved. But those cards can't be used anywhere else but at Costco or Sams. Pretty sure you can't even use your Sam's card at Walmart.

My point was if your Credit Union Visa Debit or Bank MasterCard Debit was stolen and the card thief tried to use it at Costco or Sams, they would have to scan a valid Costco or Sams card with it to make any purchases. If they used their own Costco or Sam's card with your stolen Visa or MC debit card, that would be dumb as they would likely get caught.
 
Joined
Mar 6, 2017
Messages
3,242 (1.20/day)
Location
North East Ohio, USA
System Name My Ryzen 7 7700X Super Computer
Processor AMD Ryzen 7 7700X
Motherboard Gigabyte B650 Aorus Elite AX
Cooling DeepCool AK620 with Arctic Silver 5
Memory 2x16GB G.Skill Trident Z5 NEO DDR5 EXPO (CL30)
Video Card(s) XFX AMD Radeon RX 7900 GRE
Storage Samsung 980 EVO 1 TB NVMe SSD (System Drive), Samsung 970 EVO 500 GB NVMe SSD (Game Drive)
Display(s) Acer Nitro XV272U (DisplayPort) and Acer Nitro XV270U (DisplayPort)
Case Lian Li LANCOOL II MESH C
Audio Device(s) On-Board Sound / Sony WH-XB910N Bluetooth Headphones
Power Supply MSI A850GF
Mouse Logitech M705
Keyboard Steelseries
Software Windows 11 Pro 64-bit
Benchmark Scores https://valid.x86.fr/liwjs3
instead are allowed credit with nothing else required
And that's why credit card fraud is so high. In Europe it's chip-and-PIN for both credit and debit modes, in the US there's no such thing. Don't want to put your PIN in or you forgot it? Just press the green button and it'll go through. :banghead:
 
Joined
Jul 25, 2006
Messages
12,557 (1.91/day)
Location
Nebraska, USA
System Name Brightworks Systems BWS-6 E-IV
Processor Intel Core i5-6600 @ 3.9GHz
Motherboard Gigabyte GA-Z170-HD3 Rev 1.0
Cooling Quality case, 2 x Fractal Design 140mm fans, stock CPU HSF
Memory 32GB (4 x 8GB) DDR4 3000 Corsair Vengeance
Video Card(s) EVGA GEForce GTX 1050Ti 4Gb GDDR5
Storage Samsung 850 Pro 256GB SSD, Samsung 860 Evo 500GB SSD
Display(s) Samsung S24E650BW LED x 2
Case Fractal Design Define R4
Power Supply EVGA Supernova 550W G2 Gold
Mouse Logitech M190
Keyboard Microsoft Wireless Comfort 5050
Software W10 Pro 64-bit
in the US there's no such thing.
Well that's not true. While it may not be universally enforced, it is widely applied and I think getting there. The problem is, it is the merchant who must expend the resources (read: $$$) to implement the necessary tools to prevent such fraud. Not the credit card issuers. The banks, once again (with the help of no regulation :(), have set themselves up to reap the profits while the little guy (consumers and small businesses) carry the majority of the burden.
 
Joined
Aug 20, 2007
Messages
21,019 (3.40/day)
System Name Pioneer
Processor Ryzen R9 7950X
Motherboard GIGABYTE Aorus Elite X670 AX
Cooling Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans...
Memory 64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30
Video Card(s) XFX RX 7900 XTX Speedster Merc 310
Storage Intel 905p Optane 960GB boot, +2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs
Display(s) 55" LG 55" B9 OLED 4K Display
Case Thermaltake Core X31
Audio Device(s) TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED
Power Supply FSP Hydro Ti Pro 850W
Mouse Logitech G305 Lightspeed Wireless
Keyboard WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps
Software Gentoo Linux x64 / Windows 11 Enterprise IoT 2024
More bullfeathers! The careless and/or ignorant user who fails to properly keep his or her computer and security system updated would not know how their system got infected - though surely they would blame Microsoft or Intel. But there are 1000s of professional security analyst around the globe right now scouring the malicious code that is out in the wild who would know.

No, because you can't trust what the hardware of an infected system tells you. Knowing malicious code is out there is not a case of confirming an active operating infection based on a hardware-level vulnerability. You are unlikely to ever get that (though you may with very advanced tools in a lab setting, but that doesn't really count). Thus, my point.

Go get em Bill. The amount of unsubstantiated BS in this topic is bizarre.

True but, being a operating professional in this field, it's not coming from me.
 
Last edited:
Joined
Jul 25, 2006
Messages
12,557 (1.91/day)
Location
Nebraska, USA
System Name Brightworks Systems BWS-6 E-IV
Processor Intel Core i5-6600 @ 3.9GHz
Motherboard Gigabyte GA-Z170-HD3 Rev 1.0
Cooling Quality case, 2 x Fractal Design 140mm fans, stock CPU HSF
Memory 32GB (4 x 8GB) DDR4 3000 Corsair Vengeance
Video Card(s) EVGA GEForce GTX 1050Ti 4Gb GDDR5
Storage Samsung 850 Pro 256GB SSD, Samsung 860 Evo 500GB SSD
Display(s) Samsung S24E650BW LED x 2
Case Fractal Design Define R4
Power Supply EVGA Supernova 550W G2 Gold
Mouse Logitech M190
Keyboard Microsoft Wireless Comfort 5050
Software W10 Pro 64-bit
No, because you can't trust what the hardware of an infected system tells you. Knowing malicious code is out there is not a case of confirming an active operating infection based on a hardware-level vulnerability. You are unlikely to ever get that (though you may with very advanced tools in a lab setting, but that doesn't really count). Thus, my point.
Yes.

Did you read what I said and what you quoted? Apparently not. :( I agreed with you that the less experienced (and careless/ignorant) would not know how their system got infected. But (and you just agreed with this! :rolleyes: ) the well equipped professional would. So "yes".

And of course what the professional sees in their well equipped labs counts! You can't dismiss facts you don't like just because they show how incorrect your BS is! :kookoo: :rolleyes: How do you think the anti-malware industry discovers new malware? They use, among other techniques, honeypots to capture new code for analysis so they can create definition files and other detection methods block such malware. So of course the use of advanced tools in a lab setting counts.

True but, being a operating professional in this field, it's not coming from me.
Yes it is. You may be an OS professional but that does not qualify you as being a malware or hardware or CPU vulnerability professional.

You made a blanket statement saying malware that came via one of these Intel CPU vulnerabilities would "be untraceable". Like all blanket statements, that is wrong, thus BS coming from you! You also claimed there will "never" be a report of such an infection. Another blanket statement for more BS. Professional labs (which do indeed count!) and "white hats" have already reported there are several 100 pieces of malware out in the wild that are designed to exploit these vulnerabilities. But there is yet to be any report of any of those being successful at penetrating all a computer's defenses and succeeding at exploiting one of those vulnerabilities.

Will we see such a report? I can't foretell the future and neither can you! That's the point! But I sure suspect if/when such malware infections are discovered, it will be reported simply because the IT press loves to report bad news, and there are many AMD fans who will parrot those reports - for years to come. :(

And yes, I am fully cognizant of the irony in stating "all blanket statements are wrong".

But the gas pumps are all still mag strip readers as far as I know.
At least in my part of the world.....
A new station in my area was just built and it has a chip reader. Where I normally get my gas, they just put in all new pumps but they use strip readers. However, you have to enter the zip code tied to the billing information for that card to proceed. I know two people who have had their wallets stolen. Both were recovered with their driver's licenses still in the wallets. Only the cash and credit cards were stolen. So unless the bad guy memorized the zip code from the license before tossing the wallets, they at least could not use one of those cards to buy gas at those pumps.
 
Joined
Aug 20, 2007
Messages
21,019 (3.40/day)
System Name Pioneer
Processor Ryzen R9 7950X
Motherboard GIGABYTE Aorus Elite X670 AX
Cooling Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans...
Memory 64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30
Video Card(s) XFX RX 7900 XTX Speedster Merc 310
Storage Intel 905p Optane 960GB boot, +2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs
Display(s) 55" LG 55" B9 OLED 4K Display
Case Thermaltake Core X31
Audio Device(s) TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED
Power Supply FSP Hydro Ti Pro 850W
Mouse Logitech G305 Lightspeed Wireless
Keyboard WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps
Software Gentoo Linux x64 / Windows 11 Enterprise IoT 2024
Bill, slow down and take a breather. I said I DOUBTED we would ever see such a report, not that it is strictly impossible. There is no need to get worked up like that over an opinion / prediction on my part based on the traits of the problem.

EDIT:

It would seem I did indeed use an absolute. I assumed otherwise but obviously you are right. I recant. I can only defend my statement as a "doubt you'll see it scenario" not an absolute.

Sincere apologies for the confusion. Wording does indeed matter.

You made a blanket statement

Indeed and I was operating on the premise I could not posdibly be that foolish. Like all blanket statements, that was wrong. :laugh:

You may be an OS professional

I'm a little more than that, bears saying. I am a UEFI reverse engineer and skilled malware analyst that in the last years has actually made that his primary business (easier than Journalism, less people and more code lol).
 
Last edited:
Joined
Jul 25, 2006
Messages
12,557 (1.91/day)
Location
Nebraska, USA
System Name Brightworks Systems BWS-6 E-IV
Processor Intel Core i5-6600 @ 3.9GHz
Motherboard Gigabyte GA-Z170-HD3 Rev 1.0
Cooling Quality case, 2 x Fractal Design 140mm fans, stock CPU HSF
Memory 32GB (4 x 8GB) DDR4 3000 Corsair Vengeance
Video Card(s) EVGA GEForce GTX 1050Ti 4Gb GDDR5
Storage Samsung 850 Pro 256GB SSD, Samsung 860 Evo 500GB SSD
Display(s) Samsung S24E650BW LED x 2
Case Fractal Design Define R4
Power Supply EVGA Supernova 550W G2 Gold
Mouse Logitech M190
Keyboard Microsoft Wireless Comfort 5050
Software W10 Pro 64-bit
I am not worked up. I am just trying to stop the BS so readers don't get blasted with a bunch of falsehoods and misinformation about safety and security when using Intel processors. This is a technical forum and presented "facts" should be technically correct - regardless how our personal opinions shape our biases.

EDIT:

It would seem I did indeed use an absolute. I assumed otherwise but obviously you are right. I recant. I can only defend my statement as a "doubt you'll see it scenario" not an absolute.

Sincere apologies for the confusion.
:) Thanks for this.

My personal opinion is that we will see such a report IF an infected machine is discovered to have been infected by malware designed to exploit one of those vulnerabilities. Why wouldn't it be? That type information is exactly the type shared among the anti-malware industry so it can be thwarted on a global basis. That's what the VIA is all about.

So why will there be such a report? Because some code is going to have to sneak past all security coming in, reach directly into the CPU and exploit the vulnerability, grab the data exposed by that vulnerability, then sneak back out. And you are suggesting that can be done - especially on a fully patched and updated computer - without leaving any trace for a malware professional in their labs to find? I don't think so. In fact, I am sure of it.
 
Joined
Aug 20, 2007
Messages
21,019 (3.40/day)
System Name Pioneer
Processor Ryzen R9 7950X
Motherboard GIGABYTE Aorus Elite X670 AX
Cooling Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans...
Memory 64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30
Video Card(s) XFX RX 7900 XTX Speedster Merc 310
Storage Intel 905p Optane 960GB boot, +2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs
Display(s) 55" LG 55" B9 OLED 4K Display
Case Thermaltake Core X31
Audio Device(s) TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED
Power Supply FSP Hydro Ti Pro 850W
Mouse Logitech G305 Lightspeed Wireless
Keyboard WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps
Software Gentoo Linux x64 / Windows 11 Enterprise IoT 2024
Thanks for this.

No prob. It's important to acknowledge when you're wrong too... but brains are tricky! They require you recognize that first. :laugh:
 
Last edited:
Joined
Jul 25, 2006
Messages
12,557 (1.91/day)
Location
Nebraska, USA
System Name Brightworks Systems BWS-6 E-IV
Processor Intel Core i5-6600 @ 3.9GHz
Motherboard Gigabyte GA-Z170-HD3 Rev 1.0
Cooling Quality case, 2 x Fractal Design 140mm fans, stock CPU HSF
Memory 32GB (4 x 8GB) DDR4 3000 Corsair Vengeance
Video Card(s) EVGA GEForce GTX 1050Ti 4Gb GDDR5
Storage Samsung 850 Pro 256GB SSD, Samsung 860 Evo 500GB SSD
Display(s) Samsung S24E650BW LED x 2
Case Fractal Design Define R4
Power Supply EVGA Supernova 550W G2 Gold
Mouse Logitech M190
Keyboard Microsoft Wireless Comfort 5050
Software W10 Pro 64-bit
It's important to acknowledge when your wrong too...
Not just important for the obvious technical reasons - but for the character admitting a mistake demonstrates. That character garners much more respect from me than just about anything else! :toast:
 
Top