Intel Reveals New Spectre-Like Attack, Advises Disabling Hyper-Threading

[biffzinker]

I take it back for Costco. Since, like Sams, you have to scan your membership card before each purchase (even when paying with a bank card) someone would have to be really dumb to use a stolen bank card there.

With smart chips on payment cards now anyone can use your card as a credit payment, and a lot businesses migrated to no signature required for credit. Not to mention the cashiers don't verify the name or picture on the payment card.

 

[trparky]

With smart chips on payment cards now anyone can use your card as a credit payment, and a lot businesses migrated to no signature required for credit.

And this is the biggest reason why credit card fraud in the United States is higher than anywhere else in the world. I remember reading somewhere that the United States represents somewhere around 35% of the world's credit card transactions but we also represent 75% of the world's credit card fraud. Why? Because there's literally no verification in the US (chip-and-sign, or should I say chip-and-nothing) to make sure that the person using the card is supposed to be using the card unlike in Europe where it's chip-and-PIN.

 

[lexluthermiester]

Europe where it's chip-and-PIN.

Everywhere I go, it's chip and pin now. There are a few places that are still converting over but most have already. But we're off topic and I digress..

 

[biffzinker]

it's chip-and-PIN.

Still is for debit but it does nothing when your allowed to bypass entering a pin, and instead are allowed credit with nothing else required.

 

[Bill_Bright]

Not to mention the cashiers don't verify the name or picture on the payment card.

I thought I was clear - guess I was not. Remember, trparky was talking about his credit union debit card and I was talking about my bank debit card. And my comment - which you quoted - was talking about using them at Costco or Sam's. For those not familiar, you have to be a member to shop at Costco or Sam's.

Yes, if someone gets your Costco or Sam's Club card, they can use it at Costco or Sam's Club. And both those places (at least around here) have self-checkouts so no clerks involved. But those cards can't be used anywhere else but at Costco or Sams. Pretty sure you can't even use your Sam's card at Walmart.

My point was if your Credit Union Visa Debit or Bank MasterCard Debit was stolen and the card thief tried to use it at Costco or Sams, they would have to scan a valid Costco or Sams card with it to make any purchases. If they used their own Costco or Sam's card with your stolen Visa or MC debit card, that would be dumb as they would likely get caught.

 

[trparky]

instead are allowed credit with nothing else required

And that's why credit card fraud is so high. In Europe it's chip-and-PIN for both credit and debit modes, in the US there's no such thing. Don't want to put your PIN in or you forgot it? Just press the green button and it'll go through.

 

[Bill_Bright]

in the US there's no such thing.

Well that's not true. While it may not be universally enforced, it is widely applied and I think getting there. The problem is, it is the merchant who must expend the resources (read: $$$) to implement the necessary tools to prevent such fraud. Not the credit card issuers. The banks, once again (with the help of no regulation ), have set themselves up to reap the profits while the little guy (consumers and small businesses) carry the majority of the burden.

 

[R-T-B]

More bullfeathers! The careless and/or ignorant user who fails to properly keep his or her computer and security system updated would not know how their system got infected - though surely they would blame Microsoft or Intel. But there are 1000s of professional security analyst around the globe right now scouring the malicious code that is out in the wild who would know.

No, because you can't trust what the hardware of an infected system tells you. Knowing malicious code is out there is not a case of confirming an active operating infection based on a hardware-level vulnerability. You are unlikely to ever get that (though you may with very advanced tools in a lab setting, but that doesn't really count). Thus, my point.

Go get em Bill. The amount of unsubstantiated BS in this topic is bizarre.

True but, being a operating professional in this field, it's not coming from me.

 

[juiseman]

The recent smart chip on a credit card is suppose to prevent the old way of skimming via mag strip.

But the gas pumps are all still mag strip readers as far as I know.
At least in my part of the world.....

 

[Bill_Bright]

No, because you can't trust what the hardware of an infected system tells you. Knowing malicious code is out there is not a case of confirming an active operating infection based on a hardware-level vulnerability. You are unlikely to ever get that (though you may with very advanced tools in a lab setting, but that doesn't really count). Thus, my point.

Yes.

Did you read what I said and what you quoted? Apparently not. I agreed with you that the less experienced (and careless/ignorant) would not know how their system got infected. But (and you just agreed with this! ) the well equipped professional would. So "yes".

And of course what the professional sees in their well equipped labs counts! You can't dismiss facts you don't like just because they show how incorrect your BS is! How do you think the anti-malware industry discovers new malware? They use, among other techniques, honeypots to capture new code for analysis so they can create definition files and other detection methods block such malware. So of course the use of advanced tools in a lab setting counts.

True but, being a operating professional in this field, it's not coming from me.

Yes it is. You may be an OS professional but that does not qualify you as being a malware or hardware or CPU vulnerability professional.

You made a blanket statement saying malware that came via one of these Intel CPU vulnerabilities would "be untraceable". Like all blanket statements, that is wrong, thus BS coming from you! You also claimed there will "never" be a report of such an infection. Another blanket statement for more BS. Professional labs (which do indeed count!) and "white hats" have already reported there are several 100 pieces of malware out in the wild that are designed to exploit these vulnerabilities. But there is yet to be any report of any of those being successful at penetrating all a computer's defenses and succeeding at exploiting one of those vulnerabilities.

Will we see such a report? I can't foretell the future and neither can you! That's the point! But I sure suspect if/when such malware infections are discovered, it will be reported simply because the IT press loves to report bad news, and there are many AMD fans who will parrot those reports - for years to come.

And yes, I am fully cognizant of the irony in stating "all blanket statements are wrong".

But the gas pumps are all still mag strip readers as far as I know.
At least in my part of the world.....

A new station in my area was just built and it has a chip reader. Where I normally get my gas, they just put in all new pumps but they use strip readers. However, you have to enter the zip code tied to the billing information for that card to proceed. I know two people who have had their wallets stolen. Both were recovered with their driver's licenses still in the wallets. Only the cash and credit cards were stolen. So unless the bad guy memorized the zip code from the license before tossing the wallets, they at least could not use one of those cards to buy gas at those pumps.

 

[R-T-B]

Bill, slow down and take a breather. I said I DOUBTED we would ever see such a report, not that it is strictly impossible. There is no need to get worked up like that over an opinion / prediction on my part based on the traits of the problem.

EDIT:

It would seem I did indeed use an absolute. I assumed otherwise but obviously you are right. I recant. I can only defend my statement as a "doubt you'll see it scenario" not an absolute.

Sincere apologies for the confusion. Wording does indeed matter.

You made a blanket statement

Indeed and I was operating on the premise I could not posdibly be that foolish. Like all blanket statements, that was wrong.

You may be an OS professional

I'm a little more than that, bears saying. I am a UEFI reverse engineer and skilled malware analyst that in the last years has actually made that his primary business (easier than Journalism, less people and more code lol).

 

[Bill_Bright]

I am not worked up. I am just trying to stop the BS so readers don't get blasted with a bunch of falsehoods and misinformation about safety and security when using Intel processors. This is a technical forum and presented "facts" should be technically correct - regardless how our personal opinions shape our biases.

EDIT:

It would seem I did indeed use an absolute. I assumed otherwise but obviously you are right. I recant. I can only defend my statement as a "doubt you'll see it scenario" not an absolute.

Sincere apologies for the confusion.

Thanks for this.

My personal opinion is that we will see such a report IF an infected machine is discovered to have been infected by malware designed to exploit one of those vulnerabilities. Why wouldn't it be? That type information is exactly the type shared among the anti-malware industry so it can be thwarted on a global basis. That's what the VIA is all about.

So why will there be such a report? Because some code is going to have to sneak past all security coming in, reach directly into the CPU and exploit the vulnerability, grab the data exposed by that vulnerability, then sneak back out. And you are suggesting that can be done - especially on a fully patched and updated computer - without leaving any trace for a malware professional in their labs to find? I don't think so. In fact, I am sure of it.

 

[R-T-B]

Thanks for this.

No prob. It's important to acknowledge when you're wrong too... but brains are tricky! They require you recognize that first.

 

[Bill_Bright]

It's important to acknowledge when your wrong too...

Not just important for the obvious technical reasons - but for the character admitting a mistake demonstrates. That character garners much more respect from me than just about anything else!