David Kohlbrenner

Software/Hardware Security Person. Assistant Professor at @uwcse. Making whole systems just a bit more secure. PPP Alum. He/Him. @[email protected]

[David Kohlbrenner @dkohlbre]

@stuntpants Any idea why hugepage support is in the M1 but not in macOS? Was surprised I couldn't even force it on from userspace...

[Ariana Mirian (@[email protected]) @arimirian]

I was relying on this app to publicize that I am defending in April! And looking for 2023 jobs! Guess I'll used...LinkedIn...now?

TL;DR If you want to understand/improve security processes using data and research science methods, shoot me a note. I'll post more later if I can

[David Kohlbrenner @dkohlbre]

Retpolines leaking is unfortunate, but its good that we have concrete examples of how.
While there, read the addendum (and the timeline on addendum, oof). Looking forward to _that_ paper quite a bit!

[johannes @wiknerj]

Today @kavehrazavi and I are finally allowed to talk about #Retbleed. In 2018, #SpectreV2 was fixed by replacing indirect jumps with returns. But, returns can be poisoned like indirect jumps, throwing us us back to 2018 again. Paper, demo, addendum, code @ https://t.co/XWzNp2kw2P

[Marco Guarnieri @MarcoGuarnier1]

Excited to share that our proposal for a @dagstuhl seminar on "Microarchitectural attacks and defenses" has been accepted! Organizers: yours truly, @BloodyTangerine, @dkohlbre, and Chris Fletcher

[David Kohlbrenner @dkohlbre]

This project was wild. @YingchenWang96 and @ricpacca knocked it out the park at every step. Check it out!
It is time to think about a different way of writing safe, timing-independent, code :)

[Riccardo Paccagnella @ricpacca]

We found a way to mount *remote timing* attacks on *constant-time* cryptographic code running on modern x86 processors. How is that possible? With #hertzbleed! Here is how it works (with @YingchenWang96).

https://t.co/SRUgBRQpu2

[Pardis Emami-Naeini @PNaeini]

Please help distribute: I am hiring a postdoc to join my lab at @dukecompsci. Email me (with your CV) if you are interested in human-centered security and privacy, especially when it relates to data from medical/robotic application domains, and/or marginalized populations. 🙂

[Joseph Ravichandran @0xjprx]

We found a way to defeat pointer authentication (and forge kernel pointers from userspace) on the Apple M1 via a new hardware attack.

Here’s how it works-

https://t.co/6Kz3jnRtwI

[David Kohlbrenner @dkohlbre]

And now it is May 24th!

At (or remotely at) IEEE S&P? Check out @jose_vicarte 's talk on "Augury: Using Data Memory-Dependent Prefetchers to Leak Data at Rest" coming up shortly in Session 7A.

[David Kohlbrenner @dkohlbre]

We found a way to leak data on Apple Silicon processors that is "at rest": that is, data the core never reads speculatively or non-speculatively.
This will be an odd one, so stick around for the 🧵 and see https://t.co/KCnw9PAlSS

[David Kohlbrenner @dkohlbre]

For more information check out https://t.co/8DeBFWLcyF and go see the talk at
@IEEESSP 2022 by @jose_vicarte on May 24th

[James Forshaw @tiraniddo]

Today, GPZ and Google Cloud are releasing a technical report on a security research project in collaboration with AMD on their Secure Processor and the Secure Encrypted Virtualization feature. It includes some interesting bugs we found. Read the blog at https://t.co/CQjYeuw474

[David Kohlbrenner @dkohlbre]

@kangadac For now it appears to be unique to Apple.
AWS Graviton 2 (neoverse N1 iirc) didn't seem to have the AoP DMP or similar in our testing.

[David Kohlbrenner @dkohlbre]

@cutesmilee__ @matteyeux Probably :)
The challenge comes in finding an efficient way to recover the leaked pointer value via P+P or something.
We didn't get it working but I wouldn't be surprised if someone can.

[David Kohlbrenner @dkohlbre]

@joseph_h_garvin Completely agree on prefetching being speculative.
We see the difference here because the DMP lives in the L2, not in the core. So, the core never speculatively reads the data, and never actually sees the line until it actually asks for it!