Post by Andy K.
Another Branch Prediction Attack
When Spectre and Meltdown were first announced earlier this year,
pretty much everyone predicted that there would be many more attacks
This attack (and my memory is fading already on the others, but I think
it at least applies to Spectre as well) relies on comparing the
performance of the CPU at executing tasks, with the time taken to
perform branching instructions varying depending on data present in
areas of memory theoretically inaccessible to user code.
Besides the predictive operation of the branching instructions, which
can't be easily changed, and the use of protected memory areas, which
has currently been changed at the expense of general performance,
another key requirement for the attack is an accurate way of
I noticed that Firefox's short-term response to the Spectre
vulnerability was to reduce the availability and resolution of
Taking this a step further, would it be possible to actively reduce
the precision of the hardware timers in the x86 architecture only
when a large number of predictive branching instructions are
executed in short succession?
If additional hardware is able to watch the data read by the CPU
from RAM for such a succession of these branching instructions,
it could trigger random variations in the frequency output by the
timer clock generator. These variations can be of large enough
significance to hide any effect from predictive branching, or at
least make the computation time required to detect it impractical.
Existing x86 CPUs could then still be used within the system, with
the only new limit to their performance being timing accuracy,
when required at the same time that unusually frequent branching
instructions are being executed.
Actually, I'm afraid the Time Stamp Counter introduced with the
Pentium may sabotage this approach:
Well bugger, I've typed too much to abandon this post now.
Warning, I'm in one of my thinking outside of the box moods so
the following thinking is likely to be rather irrelevant and
I then started thinking about how additional hardware could be
added to existing computers so as to offer an equivalent
to the software patches. Some sort of additional connector
sandwidched between the RAM sticks and the RAM sockets on the
motherboard could, maybe, allow additional circuitry to detect
the CPU reading branch instructions by monitoring the data
lines. Though this assumption is made in ignorance of the degree
of optimisation acheived with the x86 architecture and the
effects that adding additional loads on the RAM outputs is
likely to have on stability.
Then one comes to the question of how to change the clock
frequency used for the timer without actually modifying the
circuit used to generate it. It turns out that the prime
factors able to influence a crystal oscillator are heat,
acceleration, magnetic fields, and radiation. Long story
short, ruling out Heat due to the thermal mass of the
component, I've concluded that a device using an elecromagnet
to attract a lever, to move a small piece of lead, to
uncover a potent radioactive source, should produce enough
varying vibration, electromagnetism, and radiation that
when glued onto the can of the oscillator crystal it
should make it quite giddy.
Unfortunately I later discovered that the 14.318MHz
crystal frequency used for the timers is also synthesised
to generate the clock signals for PCI, USB, and all sorts
of other stuff that probably shouldn't be toyed with. A
shame, until then it was all looking so practical. :)
Note that this doesn't affect the modification I described
earlier of randomly varying the timer clock, because this
could be done after the generation of the other clock
-"Intel 8253". Original PC timer chip - Wikipedia
-"High Precision Event Timer". Higher frequency timer added
later to the PC architecture - Wikipeida
-"Time Stamp Counter". Evil little thing that Intel put
in the Pentium to make sure that the fix I just
described wouldn't work. Or an internal execution
cycle counter - Wikipedia
-"Introduction to Quartz Frequency Standards"
-See ch. III "Oscillator Instabilities"
-Influences on precision Crystal Oscillator accuracy
(PC crystals won't be "precision").
-"INFLUENCE OF A MAGNETIC FIELD ON QUARTZ CRYSTAL RESONATORS"
- R. BRENDEL
-Again about precision crystals.
#_ < |\| |< _#