The DMZ

« first day (2773 days earlier) ← previous day

forest

1:18 AM

@HamZa I don't think you could really sell it for all that much.

2 hours later…

forest

3:37 AM

A: How does full memory encryption in newer processes protect against DMA attacks?

How does memory encryption impact DMA attacks? Full-memory encryption is not designed to protect against DMA attacks. That is what an IOMMU is for. The IOMMU is configured using a type of ACPI table called DMA Remapping, or DMAR. This table contains a list of regions used by each DMA-capable dev...

If anyone with a greater knowledge of x86 hardware notices any mistakes, do tell me. I do not know much about TME or SME and have not read the documents in detail so I'm just going off some (hopefully reasonable) assumptions.

3 hours later…

Tom K.

6:58 AM

@forest well, maybe not for financial gain, but there might be some bragging rights included

well, there is some capital involved.. now that I think about it

1 hour later…

HamZa

8:08 AM

after Arminius disclosed the details, yes i agree that you can't really sell it
But if it was persistent xss then i think it would

Benoit Esnard

Are XSS really being sold?

Journeyman Geek

@HamZa and the real goal there was to get SE to get it sorted.

HamZa

@BenoitEsnard i could imagine it would be useful in some sense on a big website such as SE

@JourneymanGeek of course, my point is: some people don't have the same patience as @Arminius has.

Journeyman Geek

@HamZa well, the ball certainly was dropped

But ya, it depends on who finds something like that, and why

Arminius

8:36 AM

I guess it takes some dedication for an attacker to really put an XSS to use on a platform like SE which is mostly public anyway

Tom K.

Huh, interesting: security.stackexchange.com/questions/189990/…

Arminius

It might be useful for advanced phishing, to attack a mod, spread malware but it's not like there are credit card details to steal

Tom K.

especially for you web guys

HamZa

@Arminius spreading malware and also reputation damage

Arminius

Yeah

Also, wormable XSSes are interesting, but likely wouldn't work with that one

Tom K.

8:50 AM

yeah, and there's some 20 million USD of venture capital in SE as a company and afaik thy still need more. it's hard or at least harder to get new funding after you get hit by something like that

6 hours later…