From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 18E271382C5 for ; Sat, 17 Mar 2018 14:15:40 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 7ABE4E088B; Sat, 17 Mar 2018 14:15:31 +0000 (UTC) Received: from mail-pl0-x229.google.com (mail-pl0-x229.google.com [IPv6:2607:f8b0:400e:c01::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id EA88DE0833 for ; Sat, 17 Mar 2018 14:15:30 +0000 (UTC) Received: by mail-pl0-x229.google.com with SMTP id w15-v6so7531278plq.9 for ; Sat, 17 Mar 2018 07:15:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to; bh=CMplnHZ5i316EzA1Ehc0dlbGlZPb4Aoc0thpc9TBLFA=; b=d2JSM1t7YycAkisA9fOz+djI4ynbERzMoOvsMpNMwea2qEFJxez5tpKHHeyu8vBxb0 5lFgn56AmD7GBNqr8npVc7QE5bq+wIxK6Of8awT6JUN49NqXqruqPds8nwj38jYSlLvF dwitOuksZhX18OEajIgt4aLaOHsO1ANhQh/p96eDNRfk18hYaiDL+75AuQZQEJr1TUf2 wiiVJ1AQGaRK6fJb13Q/vEr5oWVVL63UoO8o1XBIhmtUSTBO5h5k9C+FH/901WM/kaq+ MnwWOdMLcOOxpYvTjrnZhfKjD8hzzMS3rRXjU1x/S047Y+1N6Mg2uEV7V+sbk9j1ZngV Wl8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to; bh=CMplnHZ5i316EzA1Ehc0dlbGlZPb4Aoc0thpc9TBLFA=; b=EiSXH3Wqt2m4E2YHhsmRg26fG9/Zwcb6RPB2Bqq/ilyBrUNvtwGo7oNM9bQg6PoaE+ snAj8eAVs5FkVyW2jAmILR9eJlRzlnGBThYWKzD1EGLYVrxQCYdp2KAcajtkEcgiFKi6 r1oh85XMcRX35TS3Y/U1OPhCwKzqseQsxUqibkvApbPhzjk7VONWWZtjNc1hIThVXFu5 gp8mmQSb7l5pwa8jzqzp7/cqhP9VEOCQJyO7fZKlbdz43QCuFOemNTmt5LywyFediRZA fO1+UHPSB7ZaxUl+y3rmhHlZV4t0gVhFySZJI1/TbjnPTp26i9dtb9wgu9naUsfGfwFA 5PDw== X-Gm-Message-State: AElRT7EvdpOUkYcyU++cLxkbULiY4SYqLnP6oRiX5MOHMWe3xe614Iau GHmHASuMQ/QrtBxMjtN8CL00PL0SwqeTbETr9P8pcw== X-Google-Smtp-Source: AG47ELudNKZGIoePkar6zkQirI/3BhISiKf2XI2w95GT9AoBTH5xfmiNrM6pf+8bG55xBwzel7hZBIMTugcAe/rBCVY= X-Received: by 2002:a17:902:74c5:: with SMTP id f5-v6mr5762719plt.91.1521296129219; Sat, 17 Mar 2018 07:15:29 -0700 (PDT) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Sender: freemanrich@gmail.com Received: by 10.236.166.8 with HTTP; Sat, 17 Mar 2018 07:15:28 -0700 (PDT) In-Reply-To: References: <20180314005408.7pfj7jphsmnlkeek@matica.foolinux.mooo.com> From: Rich Freeman Date: Sat, 17 Mar 2018 10:15:28 -0400 X-Google-Sender-Auth: cBYG1uxuNQDP1XArBlnx89COS3U Message-ID: Subject: Re: [gentoo-user] Re: A new AMD CPU weakness? To: gentoo-user@lists.gentoo.org Content-Type: text/plain; charset="UTF-8" X-Archives-Salt: 89a8fa74-be2a-42bb-af8d-31c1e8083c65 X-Archives-Hash: 46048d30df84267d02f99b18d960af6d On Sat, Mar 17, 2018 at 9:53 AM, Fast Turtle wrote: > > All this does is makes damn sure I will not buy any used hardware > since you can change embed into the UEFI firmware what ever you want - To be fair that is hardly anything new either. Sure, this particular attack is new, but the concept has been around for a while. The NSA was even dropping code into hard drive firmware. I suspect the reason firmware attacks aren't more common is that they're more useful for things like espionage (government or corporate) where actually profiting from the stolen data requires investments, and the fact that firmware programming is a fairly obscure discipline. That and they require getting to the firmware in the first place, which often requires physical access, or tampering with equipment before it is purchased. The NSA can give UPS a check for $10k to bump your 2-day delivery to "hand-carry on private jet with a brief stop at this nondescript building." The average hacker doesn't have that option. -- Rich