8 ms·
Author of the paper here; AMA.
by adg001 2mo ago
Author of the paper here; AMA.
- adg001 2mo agoBTW, project summary is here https://www.pwnshow.com/investigations/INV-006/ https://www.pwnshow.com/investigations/INV-006/
- Joel_Mckay 2mo agoI would recommend having a look at advanced side-channel PCIe bus DMA taps used by game cheats. They use a second computer along with an external HDMI mask-overlay mixer, to dump the target computers internal game-engine state through unencrypted DMA access to the overlay channel. Thus, gives the cheaters x-ray vision and aim-bot features for games protected by kernel level anti-cheat software. Highly entertaining nuisance users. =3
- akimbostrawman 2mo agoDoes this work with IOMMU?
- Joel_Mckay 2mo agoUnknown, but there were a few obvious bios options I saw that are needed to make the kits performant with some systems. I still find it absurd people would go that far to cheat at a game. =3
- nullc 2mo ago> I still find it absurd people would go that far to cheat at a game. =3 I guess it turns the cheating into its own meta-game!
- Joel_Mckay 2mo agoTrue, but a blacklisted $5k GPU seems like a bit of a risk. =3
- saidnooneever 2mo agoit would be at a low enough level to reprogram IOMMU unless a hypervisor will prevent it. if you have a hypervisor you can prevent the other to do the dma freely in memory because u can use iommu and things like amd-vi to separate it good. but if you dont have the hv below it, any devices with dma can do the duty across entire ram.
- deleted 2mo ago[deleted]
- deleted 2mo ago[deleted]
- lolokfine 2mo ago[dead]
- bunabhucan 2mo agoIn comparing xen to qubes bulletins does the vastly different user count affect the analysis?
- deleted 2mo ago[deleted]
- deleted 2mo ago[deleted]
- adg001 2mo agoWhile user count can affect absolute disclosure volume it does not drive the main comparison in my paper. What I do is to use Xen advisories to measure upstream dependence: how much of the Qubes public advisory record is attributable to Xen/CPU/upstream components rather than Qubes core logic? That attribution result is internal to the Qubes record, so it is much less sensitive to Xen’s much larger user base.