This kills the Town Crier (and a good chunk of Chainlink)

[Anonymous No.16611247]

This is a week old and I can't believe none of you other dorks mentioned this.

https://www.youtube.com/watch?v=yo9B2ZRVW9Q

Other:
https://plundervolt.com/
https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/

>But the Plundervolt researchers found out that ‘undervolting’ CPUs by just the right amount could indeed put the CPU into a sort of digital twilight zone where it would keep on running yet start to make subtle mistakes.
>The code thought it was skipping to data a safe distance ahead in memory, e.g. 17 million bytes forward; but the undervolted multiplication tricked the CPU into reading memory from an unsafe distance backwards in memory, outside the memory region assigned to the enclave, e.g. 519 million bytes backward.

For brainlets:
>be LINK node operator
>so and so (probably corporate) wants confidentiality using TEEs for sensitive and highly valuable data
>you say okay (but you're a bad actor)
>starve the node's CPU of a little voltage
>fetch data from inside the enclave to outside it
>sell it on the black market and do whatever else bad actors do with confidential data

At least there's still mixicles or this project would be completely dead and worthless.

What this means (for brainlets):
>4th Industrial Revolution delayed
>Another 2 years of bag-holding

Thanks intel for the christmas gift

[Anonymous No.16611253]

DR;NS
fuck your mother

[Anonymous No.16611291]

>>16611247
Chainlink is windows your stupid ass suggestion is linux with a shinny skin.........fuck you suck dick fggt

[Anonymous No.16611520]

>>16611253
>>16611291
The absolute state of link stinkers

[Anonymous No.16611597]

>>16611247
Mixicles is 70 lines of code that's a better iteration of SGX. This doesnt matter or change anything

[Anonymous No.16611881]

>>16611247
cope

[Anonymous No.16611906]

>>16611247
>random bug cannot be fixed according to OP
>nor can it be mitigated
>nor using this knowledge can it be worked around completely

Fuck off idiot. This is why the LINK team is working on so many different solutions and options for the people using the network. Imagine unironically thinking that this one Intel SGX error is enough to destroy everything the LINK team has been working on. The worst part about tech fags is they are always so over fucking dramatic about the dumbest shit that does not matter in the real world. Bickering about which OS is the best, bickering about monitors when they suck ass at vidya, on and on and on. Melodramatic cocksucker

[Anonymous No.16611917]

>>16611247
>>16611247
come on OP sergey is already WAYYY ahead of you.

[Anonymous No.16611968]

>>16611247
They already addressed the vulnerability you retards

[Anonymous No.16611997]

Yeesh

>What should affected user do?

>If you do not use SGX, you do not need to do anything. If you do use SGX: Intel has released a microcode update that - together with a BIOS update - allows disabling of the undervolting interface. The fact that undervolting is disabled will be reflected in remote attestation.

[Anonymous No.16612011]

>>16611291
But linux is what actually runs the world...

[Anonymous No.16612282]

>>16611968
>>16611906
>>16611997
Yes banning undervolting will work just like banning guns or banning drugs works. Bad actors are incapable of changing the BIOS settings of their own node.

[Anonymous No.16612911]

When a security flaw is found, it's an unwritten custom to give the company 6 months response time to come up with a fix before releasing the details into the public. Why do you think Intel waited it the very last moment to come up with and release this fix? Because this "fix" isn't a real fix, it's a stopgap. Sure, it prevents remote hackers, who somehow attained administrator privilege, from tampering with the SGX and its enclave. But none of this matters for Intel's original usecase, and especially that of Chainlink's: that the actual owner and operator of the CPU be unable to view and access certain contents and functions that the CPU works on. The reason that Intel came up with this half-baked fix is that a real fix doesn't exist, save for coming up with a new architecture addressing this at the hardware level, because fundamentally this is a hardware issue and not a software one.

>b-b-but muh IAS
IAS can check that voltage control has been disabled but it can't check physical tampering of the hardware to induce the same effects.

>Ultimately, even if all software-accessible interfaces have been disabled, adversaries with physical access to the CPU are also within Intel SGX’s threat model. Especially disturbing in this respect is that the SerialVID bus between the CPU and voltage regulator appear to be unauthenticated [30, 31]. Hence adversaries might be able to physically connect to this bus and overwrite the requested voltage directly at the hardware level. Alternatively, advanced adversaries could even replace the voltage regulator completely with a dedicated voltage glitcher (although this may be technically non-trivial given the required large currents).

[Anonymous No.16612931]

None of this interferes with Chainlink's original purpose of being a middleware solution for tamperproof smart contracts, linking real-world data to the blockchain. What this does interfere with however is Chainlink's ability to do that and then also to do it confidentially and at scale, which is what corporate interests are in and the bottleneck for widespread corporate adoption (aka the singularity). It's clear from their papers (and especially https://blog.chain.link/driving-demand-for-enterprise-smart-contracts-using-the-trusted-computation-framework-and-attested-oracles-via-chainlink/)) that the Chainlink team were banking heavily on TEE usage to achieve this. This is very clearly a setback to anyone who is paying attention. Anyone who sees otherwise is in the left portion of picrelated.

>In conclusion, our work provides further evidence that the enclaved execution promise of outsourcing sensitive computations to untrusted remote platforms creates new and unexpected attack surfaces that continue to be relevant and need to be studied further.

[Anonymous No.16612942]

>>16611247
>>16612931
Thank you sir for your genuine concern over our financial wellbeing. Please do the needful and keep us updated.

[Anonymous No.16613305]

>>16611247
OP could you explain the dinamic of this bug?
What's the meaning of undervolting CPU?
undervolted multiplication
Is this somenthing harware related (no software attack
we are talking here about the computer host cpu that reads the memory of the enclave?

[Anonymous No.16613318]

>>16612282
>Yes banning undervolting will work just like banning guns or banning drugs works. Bad actors are incapable of changing the BIOS settings of their own node.
simply you can choose to do not trust a node who hasn't switched undervolting off.
As I read it can be showed you can see if a pc has undervolting on or off. Even remotely