A technical paper titled “InSpectre Gadget: Inspecting the Residual Attack Surface of Cross-privilege Spectre v2” was presented at the August 2024 USENIX Security Symposium by researchers at Vrije Universiteit Amsterdam.

Abstract:

“Spectre v2 is one of the most severe transient execution vulnerabilities, as it allows an unprivileged attacker to lure a privileged (e.g., kernel) victim into speculatively jumping to a chosen gadget, which then leaks data back to the attacker. Spectre v2 is hard to eradicate. Even on last-generation Intel CPUs, security hinges on the unavailability of exploitable gadgets. Nonetheless, with (i) deployed mitigations—eIBRS, no-eBPF, (Fine)IBT—all aimed at hindering many usable gadgets, (ii) existing exploits relying on now-privileged features (eBPF), and (iii) recent Linux kernel gadget analysis studies reporting no exploitable gadgets, the common belief is that there is no residual attack surface of practical concern.

In this paper, we challenge this belief and uncover a significant residual attack surface for cross-privilege Spectre-v2 attacks. To this end, we present InSpectre Gadget, a new gadget analysis tool for in-depth inspection of Spectre gadgets. Unlike existing tools, ours performs generic constraint analysis and models knowledge of advanced exploitation techniques to accurately reason over gadget exploitability in an automated fashion. We show that our tool can not only uncover new (unconventionally) exploitable gadgets in the Linux kernel, but that those gadgets are sufficient to bypass all deployed Intel mitigations. As a demonstration, we present the first native Spectre-v2 exploit against the Linux kernel on last-generation Intel CPUs, based on the recent BHI variant and able to leak arbitrary kernel memory at 3.5 kB/sec. We also present a number of gadgets and exploitation techniques to bypass the recent FineIBT mitigation, along with a case study on a 13th Gen Intel CPU that can leak kernel memory at 18 bytes/sec.”

Find the technical paper here. Published August 2024. Distinguished Paper Award Winner.  Find additional information here on VU Amsterdam’s site.

Wiebing, Sander, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida. “InSpectre Gadget: Inspecting the residual attack surface of cross-privilege Spectre v2.” In USENIX Security. 2024.

Further Reading
Defining Chip Threat Models To Identify Security Risks
Not every device has the same requirements, and even the best security needs to adapt.

The post Uncovering A Significant Residual Attack Surface For Cross-Privilege Spectre-V2 Attacks appeared first on Semiconductor Engineering.

We’re still waiting for the perfect hybrid PC that can work as well as a tablet as it does as a laptop. As we enter 2024, it seems like many companies have also given up on that ideal — but Microsoft, Apple and Samsung still have some options to consider. And we’re still seeing OS tweaks to make iOS and Android more usable for larger displays. If you’re on the hunt for your next computer and are dead-set on it being a 2-in-1, we’ve collected our current top picks here plus all of the things you should know before making a purchase.

Editor’s note (5/8/2024): Apple has announced a quartet of new iPads, including overhauled 11- and 13-inch iPad Pros with OLED displays, thinner designs and faster M4 chips, a refreshed 11-inch iPad Air with an updated M2 chip and an all-new iPad Air with a 13-inch display. There’s a new Magic Keyboard and Apple Pencil Pro as well. As part of the updates, the 10th-gen model has permanently dropped in price to $350. All of the new devices are currently available for pre-order now. Updated versions of the base iPad and iPad mini are still reportedly expected later in 2024. Our current iPad pick below may still work for some people, but everyone else should wait to see how the new hardware stacks up. We’ll have full reviews in the near future and will update our advice accordingly.

Factors to consider before buying a 2-in-1 laptop

When you’re shopping for a 2-in-1, there are some basic criteria to keep in mind. First, look at the spec sheet to see how heavy the tablet is (alone, and with the keyboard). Most modern hybrids weigh less than 2 pounds. If the overall weight of the tablet and its keyboard come close to 3 pounds, you may be better off getting an ultraportable laptop.

Also, while some 2-in-1s offer built-in LTE or 5G connectivity, not everyone will want to pay the premium for it. An integrated cellular radio makes checking emails or replying to messages on the go far more convenient. But it also often costs more, and that’s not counting what you’ll pay for data. And, as for 5G — you can hold off on it unless you live within range of a mmWave beacon. Coverage is still spotty and existing nationwide networks use the slower sub-6 technology that’s barely faster than LTE. For now, tethering a PC to your phone is still the best way to get online.

These machines still have their limits, of course. Since they’re smaller than proper laptops, they tend to have less-powerful processors. Keyboards are often less sturdy, with condensed layouts and shallower travel. Plus, they’re almost always tablets first, leaving you to buy a keyboard case separately. (And those ain’t cheap!) So, you can’t always assume the advertised price is what you’ll actually spend on the 2-in-1 you want.

See Also:

• Best Laptops for 2024

• Best Gaming Laptops

• Best Cheap Windows Laptops for 2024

• Best Chromebooks

• Best Laptops for College Students

Sometimes, getting a third-party keyboard might be just as good, and they’re often cheaper than first-party offerings. If you’re looking to save some money, Logitech’s Slim Folio is an affordable option, and if you don’t need your keyboard to attach to your tablet, Logitech’s K780 Multi-Device wireless keyboard is also a good pick.

While we’ve typically made sure to include a budget 2-in-1 in previous years, this time there isn’t a great choice. We would usually pick a Surface Go, but the latest model is still too expensive. Other alternatives, like cheaper Android tablets, are underpowered and don’t offer a great multitasking interface. If you want something around $500 that’s thin, lightweight and long-lasting, you’re better off this year looking at a conventional laptop (like those on our best budget PCs list).

We’re still waiting for the perfect hybrid PC that can work as well as a tablet as it does as a laptop. As we enter 2024, it seems like many companies have also given up on that ideal — but Microsoft, Apple and Samsung still have some options to consider. And we’re still seeing OS tweaks to make iOS and Android more usable for larger displays. If you’re on the hunt for your next computer and are dead-set on it being a 2-in-1, we’ve collected our current top picks here plus all of the things you should know before making a purchase.

Editor’s note (5/8/2024): Apple has announced a quartet of new iPads, including overhauled 11- and 13-inch iPad Pros with OLED displays, thinner designs and faster M4 chips, a refreshed 11-inch iPad Air with an updated M2 chip and an all-new iPad Air with a 13-inch display. There’s a new Magic Keyboard and Apple Pencil Pro as well. As part of the updates, the 10th-gen model has permanently dropped in price to $350. All of the new devices are currently available for pre-order now. Updated versions of the base iPad and iPad mini are still reportedly expected later in 2024. Our current iPad pick below may still work for some people, but everyone else should wait to see how the new hardware stacks up. We’ll have full reviews in the near future and will update our advice accordingly.

Factors to consider before buying a 2-in-1 laptop

When you’re shopping for a 2-in-1, there are some basic criteria to keep in mind. First, look at the spec sheet to see how heavy the tablet is (alone, and with the keyboard). Most modern hybrids weigh less than 2 pounds. If the overall weight of the tablet and its keyboard come close to 3 pounds, you may be better off getting an ultraportable laptop.

Also, while some 2-in-1s offer built-in LTE or 5G connectivity, not everyone will want to pay the premium for it. An integrated cellular radio makes checking emails or replying to messages on the go far more convenient. But it also often costs more, and that’s not counting what you’ll pay for data. And, as for 5G — you can hold off on it unless you live within range of a mmWave beacon. Coverage is still spotty and existing nationwide networks use the slower sub-6 technology that’s barely faster than LTE. For now, tethering a PC to your phone is still the best way to get online.

These machines still have their limits, of course. Since they’re smaller than proper laptops, they tend to have less-powerful processors. Keyboards are often less sturdy, with condensed layouts and shallower travel. Plus, they’re almost always tablets first, leaving you to buy a keyboard case separately. (And those ain’t cheap!) So, you can’t always assume the advertised price is what you’ll actually spend on the 2-in-1 you want.

See Also:

• Best Laptops for 2024

• Best Gaming Laptops

• Best Cheap Windows Laptops for 2024

• Best Chromebooks

• Best Laptops for College Students

Sometimes, getting a third-party keyboard might be just as good, and they’re often cheaper than first-party offerings. If you’re looking to save some money, Logitech’s Slim Folio is an affordable option, and if you don’t need your keyboard to attach to your tablet, Logitech’s K780 Multi-Device wireless keyboard is also a good pick.

While we’ve typically made sure to include a budget 2-in-1 in previous years, this time there isn’t a great choice. We would usually pick a Surface Go, but the latest model is still too expensive. Other alternatives, like cheaper Android tablets, are underpowered and don’t offer a great multitasking interface. If you want something around $500 that’s thin, lightweight and long-lasting, you’re better off this year looking at a conventional laptop (like those on our best budget PCs list).

We’re still waiting for the perfect hybrid PC that can work as well as a tablet as it does as a laptop. As we enter 2024, it seems like many companies have also given up on that ideal — but Microsoft, Apple and Samsung still have some options to consider. And we’re still seeing OS tweaks to make iOS and Android more usable for larger displays. If you’re on the hunt for your next computer and are dead-set on it being a 2-in-1, we’ve collected our current top picks here plus all of the things you should know before making a purchase.

Editor’s note (5/8/2024): Apple has announced a quartet of new iPads, including overhauled 11- and 13-inch iPad Pros with OLED displays, thinner designs and faster M4 chips, a refreshed 11-inch iPad Air with an updated M2 chip and an all-new iPad Air with a 13-inch display. There’s a new Magic Keyboard and Apple Pencil Pro as well. As part of the updates, the 10th-gen model has permanently dropped in price to $350. All of the new devices are currently available for pre-order now. Updated versions of the base iPad and iPad mini are still reportedly expected later in 2024. Our current iPad pick below may still work for some people, but everyone else should wait to see how the new hardware stacks up. We’ll have full reviews in the near future and will update our advice accordingly.

Factors to consider before buying a 2-in-1 laptop

When you’re shopping for a 2-in-1, there are some basic criteria to keep in mind. First, look at the spec sheet to see how heavy the tablet is (alone, and with the keyboard). Most modern hybrids weigh less than 2 pounds. If the overall weight of the tablet and its keyboard come close to 3 pounds, you may be better off getting an ultraportable laptop.

Also, while some 2-in-1s offer built-in LTE or 5G connectivity, not everyone will want to pay the premium for it. An integrated cellular radio makes checking emails or replying to messages on the go far more convenient. But it also often costs more, and that’s not counting what you’ll pay for data. And, as for 5G — you can hold off on it unless you live within range of a mmWave beacon. Coverage is still spotty and existing nationwide networks use the slower sub-6 technology that’s barely faster than LTE. For now, tethering a PC to your phone is still the best way to get online.

These machines still have their limits, of course. Since they’re smaller than proper laptops, they tend to have less-powerful processors. Keyboards are often less sturdy, with condensed layouts and shallower travel. Plus, they’re almost always tablets first, leaving you to buy a keyboard case separately. (And those ain’t cheap!) So, you can’t always assume the advertised price is what you’ll actually spend on the 2-in-1 you want.

See Also:

• Best Laptops for 2024

• Best Gaming Laptops

• Best Cheap Windows Laptops for 2024

• Best Chromebooks

• Best Laptops for College Students

Sometimes, getting a third-party keyboard might be just as good, and they’re often cheaper than first-party offerings. If you’re looking to save some money, Logitech’s Slim Folio is an affordable option, and if you don’t need your keyboard to attach to your tablet, Logitech’s K780 Multi-Device wireless keyboard is also a good pick.

While we’ve typically made sure to include a budget 2-in-1 in previous years, this time there isn’t a great choice. We would usually pick a Surface Go, but the latest model is still too expensive. Other alternatives, like cheaper Android tablets, are underpowered and don’t offer a great multitasking interface. If you want something around $500 that’s thin, lightweight and long-lasting, you’re better off this year looking at a conventional laptop (like those on our best budget PCs list).

Despite being available for around 16 months now, the Surface Pro 9 is still the latest in Microsoft’s line of iconic 2-in-1 laptops. With the Surface Pro 10 still looking a way off, you might be thinking of investing in the current model. While it isn’t expensive in laptop terms, it’s still a significant outlay — the cheapest option in the US still costs $850 plus tax. What you might not know is that the retail price is different in every country, which raises the prospect of buying abroad to get a better deal. But first, you’ll need to know the cheapest place to buy the Surface Pro 9. We’ve done the research, so you don’t have to.

We’ll find out if there are better prices to be had in other nations, but there’s another potential incentive to shop abroad. Many countries, including the US, levy a sales tax on their residents, but visitors to their shores can often avoid paying it. This is why duty-free shopping in airports is popular. As a US tourist, you may be able to avoid paying the sales tax on the Microsoft Surface Pro 9 in another country. We’ll consider this a little more below.