• IP addresses are NOT logged in this forum so there's no point asking. Please note that this forum is full of homophobes, racists, lunatics, schizophrenics & absolute nut jobs with a smattering of geniuses, Chinese chauvinists, Moderate Muslims and last but not least a couple of "know-it-alls" constantly sprouting their dubious wisdom. If you believe that content generated by unsavory characters might cause you offense PLEASE LEAVE NOW! Sammyboy Admin and Staff are not responsible for your hurt feelings should you choose to read any of the content here.

    The OTHER forum is HERE so please stop asking.

Intel finally Surrendered to AMD! latest Intel Chip with AMD Radeon inside

Ang4MohTrump

Alfrescian
Loyal
https://www.pcworld.com/article/3246204/ces/intel-launches-core-chips-with-amd-radeon-graphics.html

Intel launches five Core chips with Radeon graphics from rival AMD
Intel unveils the speeds, feeds, and prices of the 8th-gen Intel Core with Radeon RX Vega M graphics. The five new chips will appear in notebooks from Dell and HP, plus new Intel NUCs.

Senior Editor, PCWorld | Jan 7, 2018 6:01 PM PT


intel-core-vega-100746209-large.jpg

Intel
More like this



Latest Reviews

Intel’s startling marriage with AMD’s graphics chips has finally borne fruit, as Intel announced five new Core H-series chips that use two variants of the AMD “Vega M” GPU. The combination of Intel and AMD technology should outperform a last-gen system with a discrete Nvidia chip, Intel says.

You can jump straight to our performance section to learn more about Intel’s claims.

The new 8th-generation, quad-core Core i5 and Core i7 chips, together with what AMD calls the Radeon RX Vega M GPU, will power laptops from Dell and HP. They’ll also appear in new Intel-branded “Hades Canyon” NUCs, with prices beginning at $799 and $999, Intel said.

[ Further reading: Our picks for best PC laptops ]
Intel’s announcement Sunday at CES adds a significant amount of detail to the bombshell AMD and Intel dropped in November. Intel’s overarching goal with its Core/Radeon combination has been to deliver a gaming PC with great VR capabilities within an ultrabook form factor. We now know the NUCs will ship in late March, though timing remains unclear for the notebook launches. Intel also shared more information on speeds and feeds.

Intel originally disclosed that its new processor contained an H-series Core chip, the AMD GPU, and HBM2 memory, all within the same package. We now know the clock speeds of the five Core i5 and i7 cores will range from 3.8GHz to 4.2GHz, and that 4GB of HBM2 memory will accompany both the Vega M GH and Vega M GL, the two GPU versions whose 20 and 24 compute units appear to be much more powerful than AMD’s own Ryzen 7 and Ryzen 5 for laptops.

Intel says its new chips will be 7 percent faster in 3DMark versus a Core i7-7700HQ system with an Nvidia GTX 1060 Max-Q (6GB) chip accompanying it, and up to 13 percent faster in games.

Why this matters: For years, we’ve seen integrated notebook processors and notebook chips that use discrete GPUs, each with their own performance tier. Intel’s new partnership with AMD’s Radeon division splits the difference, offering a somewhat modular solution together with graphical performance that’s rather impressive. We all suspected that the Intel-AMD partnership would be a game-changer, and we’re starting to see that it is. We don’t know how Intel will price these chips compared to its more vanilla Core i5 and Core i7 processors, however.

8th-gen-intel-core-processor-100746178-large.jpg
Intel
Intel’s new 8th-gen Core package with a Vega M core inside of it is surprisingly photogenic.

Table of Contents
Core plus Radeon equals power
What Intel formally refers to as the “8th-gen Intel Core with Radeon RX Vega M graphics” is a typographical nightmare, so it makes more sense to either refer to them with a nickname—whatever it ends up being, Kaby Lake-G perhaps?—or simply by their actual model names. Naturally, since they’re all members of the 8th-gen Core family, all five processors boast four cores and eight processing threads.

Most notable among the new chips—which differ in processor speed, vPro capabilities, and whether they use the Vega M GH and Vega M GL—is the Core i7-8809G. That chip, leaked last week, was the first indication that Intel’s new chips would indeed include AMD’s Vega cores. It’s also the only one of the five chips that totally unlocks the CPU, GPU, and HBM.

Alongside the Core i7-8809G, though, are the Core i7-8709G, the Core i7-8706G, the 3.1Core i7-8705G, and the Core i5-8305G. As the chart below shows, they all share a common cache size (8MB), a common integrated Intel GPU (the Intel HD620), and two memory channels connecting to DDR4-2400 memory.

Intel
Intel’s five new Intel Core chips with the Radeon RX Vega M core inside. Note that they’re differentiated by clock speed, GPU core, and whether or not they have vPro capabilities. Intel did not disclose prices.

">
Intel
Intel’s five new Intel Core chips with the Radeon RX Vega M core inside. Note that they’re differentiated by clock speed, GPU core, and whether or not they have vPro capabilities. Intel did not disclose prices.

Unfortunately, the Core cores are probably the least interesting element of the new design, as the Radeon RX Vega M is clearly the star of the show. It’s worth noting, though, that these new chips actually include two GPUs: Intel’s integrated Intel HD 630 GPU can process video and other less stressful video tasks, leaving the Vega M core to power up if needed.

Incorporating HBM2 was really the only clue that AMD had sold Intel a semi-custom Vega design, and not reused the older Polaris core. The two versions of the Vega M—the GH, or “Graphics High,” and the GL, or “Graphics Low”—don’t differ that much from one another. The GH uses 24 compute units and 1,536 stream processors, and boosts from 1,063 MHz to 1,190 MHz. The GL, meanwhile, includes 20 compute units and 1,280 stream processors, and boosts from 931 MHz to 1,011 MHz.

Interestingly, though the chip is called the Vega M, Intel won’t confirm that it uses the AMD Radeon Vega core. “This is a custom Radeon graphics solution built for Intel,” an Intel spokeswoman said in an email. “It is similar to the desktop Radeon RX Vega solution with a high-bandwidth memory cache controller and enhanced compute units with additional Render Output Units.”

Eight lanes of PCI Express Gen 3 connect the CPU and the GPU, an architecture designed for “intense” graphics workloads, Intel says. And all of the dies within the package are connected via the Embedded Multi-die Interconnect Bridge, the “secret sauce” that marries disparate dies into a single unit.

Intel
Both the Radeon RX Vega M core and the integrated Intel HD630 core have capabilities that complement one another.

">
Intel
Both the Radeon RX Vega M core and the integrated Intel HD630 core have capabilities that complement one another.

In comparison to AMD’s existing Ryzen parts, the new Kaby Lake-G chips far exceed their AMD rivals. The first Ryzen Mobile laptop CPUs include 10 Vega-based compute units. AMD’s dedicated, discrete GPU, the $399 Radeon RX Vega 56, uses 56 compute units. (A 28-compute unit/1,792 stream processor desktop APU is also rumored to be in the works.) All told, however, the new 8th-gen Core chips appear to pack in a ton of performance.

Intel’s Kaby Lake-G performance claims
So how will Kaby Lake-G actually perform? Because Intel’s new Kaby Lake-G chip is the first of its kind, there’s not much to compare it to within Intel’s lineup. Normally, Intel compares new chips to a five-year-old PC—not that useful for our purposes. Here, though, Intel did something slightly different: It compared the RX Vega M GH core to a 3-year-old Core i7 PC with a discrete Nvidia GTX 960M card. In this face-off, the new Intel chip looks quite impressive (click to expand the chart below).

Intel
Intel makes a good case to upgrade, if you’re still stuck in the Haswell generation.

">
Intel
Intel makes a good case to upgrade, if you’re still stuck in the Haswell generation.

Naturally, Intel also makes its case by comparing Kaby Lake-G to the current leader in discrete Nvidia GPUs, the Nvida GTX 1060. Here, the new chip comes off surprisingly well, too, though the test is also stacked against the opposition.

Intel
Intel’s new Core i7-8809G with Radeon graphics, compared to a Core i7-7700HQ and Nvida GTX 1060. Note that the test isn’t totally comparable, as Nvidia’s chips are complemented by a 7th-generation Core i7.

">
Intel
Intel’s new Core i7-8809G with Radeon graphics, compared to a Core i7-7700HQ and Nvida GTX 1060. Note that the test isn’t totally comparable, as Nvidia’s chips are complemented by a 7th-generation Core i7.

Finally, Intel compared the slower Vega M GL against older PCs—specifically the Core i7-8550U with an Nvidia GTX 1050 chip alongside it.

Intel
Here, the deck is stacked more fairly, as two 8th-gen Core chips are being compared.

">
Intel
Here, the deck is stacked more fairly, as two 8th-gen Core chips are being compared.

The new chips that use Vega M GH cores are rated at 100 watts, while the GL cores are rated at 65 watts, Intel said. Intel also used a technique called dynamic tuning to power-manage all three components to improve their efficiency. That trick shoehorned in a little extra thermal headroom within the processor, so that, if needed, either the CPU or GPU could reach its respective boost speed to max out performance, all without worrying about immediately throttling down to prevent overheating.

Though the new chips include an H-series Core—that’s the version of the Core chip designed for use with any external GPU—Intel managed to squeeze them all inside of a G-series package. This helped Intel achieve the 40 percent savings in board space that the company disclosed earlier.

“We’ve only talked about one processor on 8th-gen today,” said John Webb, director of client graphics marketing at Intel. “There’s still more to come. Look for continued news on H-series [chips] as we get into 2018. I think you’ll be very excited about what’s there, as well.”

Software and drivers via Intel
Since the new Core chips with Radeon graphics represent a partnership between AMD and Intel, you can expect software support from both companies—though they will be routed through Intel. “There’s a lot of great software coming at them,” Webb said.

That means that while customers will receive AMD-specific features—Radeon Chill, Radeon ReLive, and the important FreeSync support—you can expect to see to a lot of Intel blue, as they’ll all be supplied by Intel.

Overclocking utilities—Intel XTU, and Radeon Wattman—will be supplied by their respective companies. Intel’s Webb said that Intel has committed to “Day Zero” drivers via gameplay.intel.com, too. Again, while you might expect AMD to shoulder a lot of the load here, Intel will be your source for official driver updates.

Computers from Dell, HP, Intel, and more
According to Intel, two customers will initially use the new Kaby Lake-G chips: Dell and HP. Unfortunately, Intel executives declined to go into any further detail. But because the new chips are being launched this week at the Consumer Electronics Show, we expect more announcements over the next few days.

Intel
Intel isn’t saying whether the new notebooks from HP and Dell will meet these configurations.

">
Intel
Intel isn’t saying whether the new notebooks from HP and Dell will meet these configurations.

Intel did reveal some of the specs of generic notebooks using the Radeon RX Vega M core, which you can see above. If there’s anything a little worrying, it’s that the projected weight, 4.6 pounds, looks rather heavy for an “ultrabook” form factor.

Mark Hachman / IDG
A reference notebook, of the sort that will be enhanced by the AMD-Intel partnership. The large, black blank space is designed for stylus input.

">
Mark Hachman / IDG
A reference notebook, of the sort that will be enhanced by the AMD-Intel partnership. The large, black blank space is designed for stylus input.

We can guess that both the Dell and HP notebooks will be celebrated for their VR prowess, which is also the target application of Intel’s two new NUCs, according to John Deatherage, the marketing director for Intel’s NUC products.

Intel plans to launch two models of what it calls its “Hades Canyon” NUC—aka “Next Unit of Computing”: The NUC8i7HVK, and the NUC8i7HNK, based on the Core i7-8809G and the Core i7-8705G, respectively. The full specs are below, and note that both NUCs (8.7 inches by 5.6 inches) include a pair of rear-mounted Thunderbolt 3 ports as well front- and rear-mounted HDMI ports, too.

Intel
The specs of Intel’s new NUC kits, the NUC8i7HVK and NUC8i7HNK.

">
Intel
The specs of Intel’s new NUC kits, the NUC8i7HVK and NUC8i7HNK.

In fact, a closer look at the NUCs reveal that they’re literally covered in ports.

Intel
And this is just the back panel. The front adds six more, including an SD slot and headphone jack.

">
Intel
And this is just the back panel. The front adds six more, including an SD slot and headphone jack.

Finally, there’s a cool LED-lit skull that can be toggled on and off.

nuc8i7hvk-skull-on-larger-100746208-large.jpg
Intel
“The processor and graphics will be more than you’ve ever had for NUC as well,” Deatherage added.

Both the NUC8i7HVK, and the NUC8i7HNK will begin shipping in late March, for prices that begin at $999 and $799, respectively. Fully configured systems will likely be $300 to $400 more depending on the configuration, an Intel representative said.

Naturally, it’s unclear how these new NUCs, as well as the notebooks from HP and Dell, will shape up. But if you’ve waffled between buying a traditional notebook or ultrabook with integrated graphics, or going for something a bit more powerful, Intel’s new Core-Radeon partnership sounds like it will be worth a second look. We’re looking forward to testing them out.

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed.
Related:
As PCWorld's senior editor, Mark focuses on Microsoft news and chip technology, among other beats.

Follow
 

chonburifc

Alfrescian (Inf)
Asset
Wow. I must be a dinosaur. The last known intel chip i know is pentium 4. After that, never follow liaoz. Used whatever that was issued by previous ex-employers.

Currently using what cpu also dont know. They all sounds the same to me.
 

eatshitndie

Alfrescian (Inf)
Asset
E26E58B3-BF0E-41ED-B4FD-19D600E09C71.jpeg
5E9DCE44-E16D-4C06-A429-1A8E620478D8.jpeg
no problem running a 12-player game with over 69k active units with individual ai.....with an intel m3 and graphics processor on a macbook. at the time when pic is taken, game whittled down to 5 players - me vs. 4. :biggrin:
 

sand_ban

Alfrescian
Loyal
All the Bapok Silicon Valley con man can fuck themselves! I am ultra disappointed with them. Products all full of Security Flaws and back door loop holes. Go and eat shit!
 

Rule of MOB

Alfrescian
Loyal
Nvidia is gone from graphics to automobile business. Intel has no choice but to suck on AMD Radeon

https://www.forbes.com/sites/alanoh...upremacy-with-vw-uber-alliances/#7a20f3c74178

Nvidia Expands Its Drive For Robocar Tech Supremacy With VW, Uber Alliances


Alan Ohnsman
, Forbes Staff
IMG_1303-1200x900.jpg
Alan Ohnsman
Nvidia CEO Jensen Huang discusses the companies partnerships with Uber, Volkswagen, Baidu and Aurora at CES 2018 in Las Vegas.

Nvidia’s push to become the leader in computing and AI for self-driving cars has yielded two new major alliances: It’s partnering with Uber to supply technology for the ride-hailing service’s future driverless vehicle fleet and will work with Volkswagen to create artificial intelligence applications for its global auto line.

Nvidia founder and CEO Jensen Huang announced the two projects, and numerous other achievements by the Silicon Valley powerhouse, amid a two-hour presentation that mirrored the essence of CES, the sprawling tech extravaganza that takes over Las Vegas each January.

Developing autonomous vehicle tech to make driving generally safer and more pleasant, improve trucking and make robotic taxis a reality are “three fantastic opportunities for us to apply our work to revolutionize the (transportation) industry,” the garrulous Huang, clad in his trademark black leather jacket, told an audience of several hundred at the MGM Grand Convention Center on the opening night of CES 2018. "Three incredibly large and growing opportunities."



Nvidia is working with more than 320 companies worldwide on automotive applications, including Audi, Tesla, Volvo, Baidu, Mercedes-Benz, in addition to the Volkswagen and Uber projects. Its primary competitor in this space, Intel, is also expanding autonomous vehicle tech partnerships, notably in projects with Alphabet’s Waymo and BMW. The prize is a share of the massive revenue generated from the transportation industry, which Huang estimated at $10 trillion worldwide.

Nvidia’s Volkswagen project is to bring AI and deep learning to next-generation VW models that are being designed now. “Artificial intelligence is revolutionizing the car,” Volkswagen CEO Herbert Diess told the Las Vegas audience. “Autonomous driving, zero-emission mobility and digital networking are virtually impossible without advances in AI and deep learning.”

One a VW vehicle that may benefit from the partnership is a revamped all-electric version of the Microbus, Huang said, who created a virtual reality version on screen for the MGM audience.

Volkswagen-I.D.-Buzz_1-1200x800.jpg
Volkswagen, Nvidia
Volkswagen's electric Microbus is one of the future vehicles that may benefit from Nvidia technology.

Nvidia’s collaboration with Uber comes as that company seeks to reinvigorate its self-driving vehicle R&D, which appeared to stall after Uber ousted Anthony Levandowski, the previous head of the program. A former member of Google’s self-driving team, Levandowski is accused of stealing trade secrets related to autonomous vehicle technology from Waymo, triggering a high-profile lawsuit between the two companies.

“Developing safe, reliable autonomous vehicles requires sophisticated AI software and a high-performance GPU computing engine in the vehicle,” Eric Meyhofer, head of Uber Advanced Technologies Group, said in a statement. “Nvidia is a key technology provider to Uber as we bring scalable self- driving cars and trucks to market.”

In addition to the two new partnerships, Huang talked about Nvidia’s plans to partner with autonomous tech startup Aurora on a computing platform, expand its cooperation in China with Baidu and parts maker ZF, work with BlackBerry QNX, enhancements to its automotive AI capabilities, new augmented reality technology, and big upgrades in its supercomputing hardware for driverless cars.

“To make autonomous vehicles possible you have to solve this incredible computing problem, the largest scale computing problem of its kind, from the bottom all the way to the top," he said. "The number of problems necessary for the industry to solve in order to bring AV to the world is just utterly daunting.”

Uber-Self-Driving-Ride-Hailing-Cars-and-Self-Driving-Freight-Trucks-1200x800.jpg
Uber, Nvidia
Nvidia is partnering with both the Uber Advanced Technologies Group and Volkswagen to provide AI computing technology as it continues to expand its role as a leading technology for automated vehicles.

Alan Ohnsman covers technology-driven changes reshaping transportation. Follow him on Twitter. Have tips to share with Forbes anonymously? Click here.

 

eatshitndie

Alfrescian (Inf)
Asset
Has the security vulnerabilities been fix with this new intel chip?
all new i5 and i7 cores, nope, not for spectre. for meltdown, it’s a software fix, and its jointly done by intel and chip buyer or customer. apple and google have done their homework on meltdown. not sure about others.
 

eatshitndie

Alfrescian (Inf)
Asset
This means N-vidia fuck spider already.
nvidia has grown leaps and bounds on latest servers and virtual machines at data centers. gpu is originally designed for graphics and gaming but its use is beyond simple hobbies. it’s now part of any microprocessor suite and is important to enhance performance in current apps as user generated video apps on mobiles, notebooks and laptops trend to very high resolution, like 4k. it will also be useful in 5g and future iot apps. buy.
 

Truth_Hurts

Alfrescian
Loyal
all new i5 and i7 cores, nope, not for spectre. for meltdown, it’s a software fix, and its jointly done by intel and chip buyer or customer. apple and google have done their homework on meltdown. not sure about others.
So basically wat u r saying is that it's not fix except for 'meltdown'?
 

eatshitndie

Alfrescian (Inf)
Asset
So ah Sai... basically what you are saying is even with the new chips..the security issues are still not fixed?
the firmware design is baked in those chips, including new cores of i5 and i7. must require a totally new design. that is a multi billion dollar investment.
 

Truth_Hurts

Alfrescian
Loyal
the firmware design is baked in those chips, including new cores of i5 and i7. must require a totally new design. that is a multi billion dollar investment.


Ah sai,,than wont they be sued for releasing a defective product? what about those PCs in hospitals, banks, power plants, industries etc,,? they continue selling will make things worse. This defect might give ah tiong chip developers a heads up,,they can make their own chips and if its proved safer and better than intel,,intel is fucked,,already one can see how much leaps and bounds the ah tiongs have made in consumer electronics and military and space technology,,they are giving the yanks a run for the money, USA tech companies can no longer be complacent
 

Truth_Hurts

Alfrescian
Loyal
https://www.channelnewsasia.com/new...new-update-to-fix--spectre--chip-flaw-9844062

Apple releases new update to fix 'Spectre' chip flaw

image: data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==

upload_2018-1-9_12-21-31.gif

FILE PHOTO - An Apple iPhone 7 and the company logo are seen in this illustration picture taken in Bordeaux, France on February 1, 2017. REUTERS/Regis Duvignau/File Photo
09 Jan 2018 03:30AM (Updated: 09 Jan 2018 12:12PM)
Share this content
Bookmark

REUTERS: Apple Inc on Monday released an updated version of its operating system software to fix a major microchip security flaw that affected nearly all computer chips made in the last decade.

On its website, Apple explained that the latest security updates Safari 11.0.2 and iOS 11.2.2 both include security improvements to "mitigate the effects of Spectre".

The iOS 11.2.2 update is available for iPhone 5S and later, iPad Air and later, and iPod touch 6th generation. Meanwhile Safari 11.0.2 is available for Mac computers with OS X El Capitan 10.11.6 and macOS Sierra 10.12.6.

Last week, Alphabet Inc's Google and other security researchers disclosed two major chip flaws, one called Meltdown affecting only Intel Corp chips and one called Spectre, that left computing devices vulnerable to hackers.

"For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available," the company said on its website.

The technology giant also released software updates for its Mac, Apple TV and Apple Watch.


Advertisement
The iPhone maker had said on Thursday it will release a patch for the Safari web browser on its iPhones, iPads and Macs.

Apple had also said that there were no known instances of hackers taking advantage of the flaw.

Source: Reuters/am
Read more at https://www.channelnewsasia.com/new...new-update-to-fix--spectre--chip-flaw-9844062
 

eatshitndie

Alfrescian (Inf)
Asset
Ah sai,,than wont they be sued for releasing a defective product? what about those PCs in hospitals, banks, power plants, industries etc,,? they continue selling will make things worse. This defect might give ah tiong chip developers a heads up,,they can make their own chips and if its proved safer and better than intel,,intel is fucked,,already one can see how much leaps and bounds the ah tiongs have made in consumer electronics and military and space technology,,they are giving the yanks a run for the money, USA tech companies can no longer be complacent
sure kena class action lawsuit by a bunch of hungry lawyers. but they will claim it’s not defective, but intentional to use the “speculative execution” feature to increase performance.
 

Tony Tan

Alfrescian
Loyal
The 3 fuckers who dug out the 20 yrs old INTEL CRAP:


https://www.wired.com/story/meltdown-spectre-bug-collision-intel-chip-flaw-discovery/


Triple Meltdown: How So Many Researchers Found a 20-Year-Old Chip Flaw At the Same Time
bug_collision-FINAL.jpg

The vulnerabilities behind the devastating Meltdown and Spectre attacks have existed for decades. Four groups of researchers independently found them within mere months of each other.
HOTLITTLEPOTATO
share2338
  • email
On a cold Sunday early last month in the small Austrian city of Graz, three young researchers sat down in front of the computers in their homes and tried to break their most fundamental security protections.

Two days earlier, in their lab at Graz's University of Technology, Moritz Lipp, Daniel Gruss, and Michael Schwarz had determined to tease out an idea that had nagged at them for weeks, a loose thread in the safeguards underpinning how processors defend the most sensitive memory of billions of computers. After a Saturday night drinking with friends, they got to work the next day, each independently writing code to test a theoretical attack on the suspected vulnerability, sharing their progress via instant message.

That evening, Gruss informed the other two researchers that he'd succeeded. His code, designed to steal information from the deepest, most protected part of a computer's operating system, known as the kernel, no longer spat out random characters but what appeared to be real data siphoned from the sensitive guts of his machine: snippets from his web browsing history, text from private email conversations. More than a sense of achievement, he felt shock and dismay.

"It was really, really scary," Gruss says. "You don’t expect your private conversations to come out of a program with no permissions at all to access that data."

From their computers across the city, Lipp and Schwarz soon tested proof-of-concept code they'd written themselves, and could see the same results: Lipp remembers seeing URLs and file names materializing out of the digital noise. "Suddenly I could see strings that shouldn't belong there," he says. "I thought, 'Oh God, this is really working.'"

Bug-Collision-Inline.jpg

Graz University of Technology researchers (from left) Daniel Grüss, Moritz Lipp, and Michael Schwarz represent just one team of four that independently discovered the same two-decade-old critical security flaw in processors within months of one another.
Graz University of Technology
That night, none of the three Graz researchers slept more than a few hours. The next day, they sent a message to Intel warning them of a potentially industry-shaking flaw in their chips. They'd found a gap in one of the most basic security defenses computers offer: that they isolate untrusted programs from accessing other processes on the computer or the deepest layers of the computer's operating system where its most sensitive secrets are kept. With their attack, any hacker who could run code on a target computer could break the isolation around that low-privilege program to access secrets buried in the computer's kernel like private files, passwords, or cryptographic keys.

On cloud computing services like Amazon Web Services, where multiple virtual machines coexist in the same physical server, one malicious virtual machine could peer deeply into the secrets of its neighbors. The Graz team's discovery, an attack that would come to be known as Meltdown, proved a critical crack in one of computing's most basic safeguards. And perhaps most troubling of all, the feature they had exploited was introduced into Intel chips in the mid-1990s. The attack had somehow remained possible, without any apparent public discovery, for decades.

Yet when Intel responded to the trio's warning—after a long week of silence—the company gave them a surprising response. Though Intel was indeed working on a fix, the Graz team wasn't the first to tell the chip giant about the vulnerability. In fact, two other research teams had beaten them to it. Counting another, related technique that would come to be known as Spectre, Intel told the researchers they were actually the fourth to report the new class of attack, all within a period of just months.

"As far as I can tell it’s a crazy coincidence," says Paul Kocher, a well-known security researcher and one of the two people who independently reported the distinct but related Spectre attack to chipmakers. "The two threads have no commonality," he adds. "There’s no reason someone couldn’t have found this years ago instead of today."

Quadruple Collision
In fact, the bizarre confluence of so many disparate researchers making the same discovery of two-decade-old vulnerabilities raises the question of who else might have found the attacks before them—and who might have secretly used them for spying, potentially for years, before this week's revelations and the flood of software fixes from practically every major tech firm that have rushed to contain the threat.

The synchronicity of those processor attack findings, argues security researcher and Harvard Belfer Center fellow Bruce Schneier, represents not just an isolated mystery but a policy lesson: When intelligence agencies like the NSA discover hackable vulnerabilities and exploit them in secret, they can't assume those bugs won't be rediscovered by other hackers in what the security industry calls a "bug collision."

'There’s no reason someone couldn’t have found this years ago instead of today.'

Paul Kocher, Cryptography Research

The Meltdown and Spectre incident isn't, after all, the first time major bugs have been found concurrently. Something—and even Schneier admits it's not clear what—leads the world's best security researchers to make near-simultaneous discoveries, just as Leibniz and Newton simultaneously invented calculus in the late 17th century, and five different engineers independently invented the television within years of one another in the 1920s.

"It's weird, right? It’s like there’s something in the water," says Schneier, who last summer co-authored a paper on vulnerability discovery. "Something happens in the community and it leads people to think, let’s look over here. And then they do. And it definitely occurs way more often than chance."

So when the NSA finds a so-called zero-day vulnerability—a previously unknown hackable flaw in software or hardware—Schneier argues that tendency for rediscovery needs to factor into whether the agency stealthily exploits the bug for espionage, or instead reports it to whatever party can fix it. Schneier argues bug collisions like Spectre and Meltdown mean they should err on the side of disclosure: According to rough estimates in the Harvard study he co-authored , as many as one third of all zero-days used in a given year may have first been discovered by the NSA.

"If I discover something lying dormant for 10 years, something made me discover it, and something more than randomly will make someone else discover it too," Schneier says. "If the NSA discovered it, it’s likely some other intelligence agency likely discovered it, too—or at least more likely than random chance."

Speculative Speculation
While some elements of Meltdown and Spectre's four-way bug collision—a bug pile-up may be a better description—remain inexplicable, some of the researchers followed the same public breadcrumbs to their discoveries. Most prominently, security researcher Anders Fogh, a malware analyst for German firm GData, in July wrote on his blog that he had been exploring a curious feature of modern microprocessors called speculative execution. In their insatiable hunger for faster performance, chipmakers have long designed processors to skip ahead in their execution of code, computing results out of order to save time rather than wait at a certain bottleneck in a process.

Perhaps, Fogh suggested, that out-of-order flexibility could allow malicious code to manipulate a processor to access a portion of memory it shouldn't have access to—like the kernel—before the chip actually checked whether the code should have permission. And even after the processor realized its mistake and erased the results of that illicit access, the malicious code could trick the processor again into checking its cache, the small part of memory allotted to the processor to keep recently used data easily accessible. By watching the timing of those checks, the program could find traces of the kernel's secrets.

Fogh failed to build a working attack, due to what other researchers now say were quirks of his testing setup. But Fogh nonetheless warned that speculative execution was likely a "Pandora's box" for future security research.

Still, Fogh's post hardly sounded alarms for the broader hardware security research community. It was only months later that the researchers at the Graz University of Technology started to closely consider his warnings. Their first real clue came instead from the Linux kernel mailing list: In October, they noticed that developers from major companies including Intel, Amazon, and Google were all suddenly interested in a new defensive redesign of operating systems, called KAISER, that the Graz researchers had created, with the goal of better isolating the memory of programs from the memory of the operating system.

The Graz researchers had intended KAISER to solve a far less serious issue than Meltdown or Spectre; their focus was on hiding the location of a computer's memory from malicious, not necessarily blocking access to it. "We felt happy," Lipp remembers. "People were interested in deploying our countermeasures."

Soon, however, developers on the mailing list began to note that the KAISER patch could slow down some Intel chips by as much as five to 30 percent for some processes—a far more serious side effect than the Graz researchers had found. And yet, Intel and other tech giants were still pushing for the fix.

"There must be something bigger here," Lipp remembers thinking. Were the tech firms using KAISER to patch a secret, more severe chip-level flaw? Only then did he and the other Graz researchers think back to Fogh's failed speculative execution attack. When they decided to try it themselves, they were shocked when their slightly tweaked implementation of Fogh's technique worked.

They also weren't alone. Just weeks earlier, by chance, researcher Thomas Prescher at Dresden, Germany security firm Cyberus had finally gotten around to testing Fogh's method. "I had looked at it half a year ago and found the ideas very interesting, but at some point I just forgot about it." Prescher says. "In November, I came across it again by chance and just decided to try it. I got it to work very, very quickly."

In the end, the Cyberus and Graz researchers reported their work to Intel within days of each other in early December. Only after Intel responded to each of the researchers' bug reports in the middle of that month did they learn that someone had independently discovered and reported their Meltdown attack months prior—as well as the distinct speculative execution attack known as Spectre. That warning came from Project Zero, Google's elite team of bug-hunting hackers. In fact, Project Zero researcher Jann Horn had found the attack in June—weeks before Anders Fogh's blog post.

Starting From Zero
How did Horn independently stumble on the notion of attacking speculative execution in Intel's chips? As he tells it, by reading the manual.

In late April of last year, the 22-year-old hacker—whose job at Project Zero was his first out of college—was working in Zurich, Switzerland, alongside a coworker, to write a piece of processor-intensive software, one whose behavior they knew would be very sensitive to the performance of Intel's chips. So Horn dived into Intel's documentation to understand how much of the program Intel's processors could run out-of-order to speed it up.

He soon saw that for one spot in the code he was working on, the speculative execution quirks Intel used to supercharge its chip speed could lead to what Horn describes as a "secret" value being accidentally accessed, and then stored in the processor's cache. "In other words, [it would] make it possible for an attacker to figure out the secret," Horn writes in an email to WIRED. "I then realized that this could—at least in theory—affect more than just the code snippet we were working on, and decided to look into it."

'Something happens in the community and it leads people to think, let’s look over here. And then they do.'

Bruce Schneier, Harvard Belfer Center

By early May, Horn had developed that technique into the attack that would come to be known as Spectre. Unlike Meltdown's more straightforward abuse of the processor, Spectre leverages speculative execution to trick innocent programs or system processes on a computer into planting their secrets in the processor's cache, where they could then be leaked out to a hacker performing a Meltdown-like timing attack. A web browser, for instance, could be manipulated into leaking a user's browsing history or passwords.

Spectre is harder for attackers to exploit than Meltdown, but also far more complex to fix. It also works not only in Intel chips, but across ARM and AMD chips too, an even thornier and longer-term problem for the industry. Horn reported his findings to the chipmakers on June 1. And as he continued to explore speculative execution's other possibilities, he found and reported the Meltdown attack to Intel three weeks later.

Finally, there would be one more coincidence in the storm of bug collisions around Meltdown and Spectre. Just around the time that Horn was beginning to test his attacks, Paul Kocher was starting a sabbatical from the San Francisco-based company he'd founded, Cryptography Research. He wanted time, in part, to explore a broad issue he saw in computer security: the increasingly desperate drive to squeeze ever-greater performance out of microchips at all costs—including, perhaps, the cost of their fundamental security.

At a cryptography and hardware conference in Taipei last September, Kocher's former colleague Mike Hamburg raised suspicions about speculative execution. Kocher was immediately determined to prove the problem. "It wasn't so much of an 'aha' moment as an an 'eww' moment," Kocher says of the realization that led him to the same attack method. "As soon as I started to look at speculative execution, it was pretty clear to me as a security person that this as a really bad idea."

Not long after he'd returned from Taipei, Kocher had coded a working exploit of his own—with no knowledge that Google's Horn had found exactly the same decades-old issue just months earlier.

Outlier or Telling Anecdote?
For Kocher, the key question isn't how so many researchers stumbled onto the same class of attack at roughly the same time. It's how the attacks remained undiscovered for so long—or whether they were in fact discovered, and used to hack unwitting targets in secret.

"If you asked me whether intelligence agencies found this years ago, I would guess certainly yes," Kocher says. "They have some of the world’s best efforts at these sorts of things. It would be quite likely they would have noticed. And if they found something like this, as long it's yielding good intelligence, they don’t tell anyone."

"It's not just the NSA," he adds. Other state-sponsored hackers likely have the skills—and had the time—to have potentially found the Spectre and Meltdown attacks, too.

On Friday, White House cybersecurity coordinator Rob Joyce, a former senior NSA official, told The Washington Post that the NSA didn't know about Spectre and Meltdown and had never exploited the flaws. Joyce has also touted a move to reveal more about the NSA's rules for disclosing vulnerabilities it finds, a policy known known as the Vulnerabilities Equities Process.

'If you asked me whether intelligence agencies found this years ago, I would guess certainly yes.'

Paul Kocher

Despite the almost uncanny anecdotal evidence for bug rediscovery that Spectre and Meltdown represent, it's far from clear just how common that phenomenon has become. The Harvard Study co-authored by Bruce Schneier, for one, examined a trove of bug report data containing 4,300 vulnerabilities. Fourteen percent of Android vulnerabilities were reported again within just 60 days of their initial discovery, and around 13 percent of Chrome bugs. "For the NSA, holding onto vulnerabilities is way more dangerous than you’d think, given the raw numbers," Schneier says.

But another study released last year by the RAND corporation, which looked at bugs from an unnamed research organization, found only a 5.7 percent chance that a given bug would be found again and reported within a year—although the study didn't account for other, secret bug discoveries.

Lillian Ablon, one of the RAND study's authors, sees the Spectre and Meltdown rediscoveries not as a broad sign that all bugs are found several times over, but that trends in computer security can suddenly focus many eyes on a single, narrow field. "There may be bug collisions in one area, but we can’t make the grand statement that bug collisions happen all the time," she says. "There will be codebases and classes of bugs where no attention exists."

Paul Kocher argues the real lesson, then, is for the security research community not to follow in each others' footsteps but to find and fix bugs in the obscure code that rarely attracts widespread attention.

"Throughout my career, whenever I've looked somewhere there isn’t a security person looking, I find something nasty and unpleasant there," Kocher says. "The shocker for me is that these attacks weren't discovered long ago. And the question that I struggle with and fear is, how many other things like this have been sitting around for 10 or 15 years?"

More Meltdown
Related Video
Security
The iOS 11 Privacy and Security Settings You Should Set Up Right Now
Heads up, iPhone owners. iOS 11 comes with a batch of security features that merit your attention.


security
How Meltdown and Spectre Were Independently Discovered By Four Research Teams At Once
Author: Andy GreenbergAndy Greenberg

More Stories
View Comments
 

Tony Tan

Alfrescian
Loyal
It is hard to imagine that these flaws are like WIDE OPENED ASSHOLES, for 20 Fucking Years! Everywhere including Banks, Pentagon, Telcos, Governments, CIA, FBI, police, Istana, Courts, ICA, CID, SAF, SPF, Putin's NUKEs, Wehat, WhatsApp, ALL EMAIL, GMAILS, GOOGLE, FB, Bitcoin etc..... countless,

And wide opened for hackers and WIKILEAK, V For Vendetta, Anonymos, Kim Jong Nuke.... every bastards.

And yet still saying this 20 years this asshole is VIRGIN not fucked at all?

Can I believe that?

No body fuck this LCB Lao Bapok?
 
Top