DV Hardware - bringing you the hottest news about processors, graphics cards, Intel, AMD, NVIDIA, hardware and technology!
   Home | News submit | News Archives | Reviews | Articles | Howto's | Advertise
DarkVision Hardware - Daily tech news
February 17, 2020 
Main Menu
News archives

Who's Online
There are currently 187 people online.


Latest Reviews
Ewin Racing Flash gaming chair
Arctic BioniX F120 and F140 fans
Jaybird Freedom 2 wireless sport headphones
Ewin Racing Champion gaming chair
Zowie P-TF Rough mousepad
Zowie FK mouse
BitFenix Ronin case
Ozone Rage ST headset

Follow us

Security researchers find new NetCAT flaw in Intel Xeon CPUs

Posted on Wednesday, September 11 2019 @ 13:19:41 CEST by

INTC logo
Security researchers from the Vrije Universiteit Amsterdam and ETH Zurich discovered a new security vulnerability in Intel's Xeon processors. The vulnerability concerns DDIO (Data-Direct I/O), a performance feature that was introduced in 2011 to let network cards and other peripherlas communicate directly with the CPU's last-level cache. By skipping the main system memory, this optimization results in increased performance, lower latency, and lower power consumption.

But unfortunately, DDIO can also enable the stealing of data. The researchers called the vulnerability NetCAT, which is short for Network Cache ATtack. NetCAT is primarily a concern for webhosting and cloud providers.
Now, researchers are warning that, in certain scenarios, attackers can abuse DDIO to obtain keystrokes and possibly other types of sensitive data that flow through the memory of vulnerable servers. The most serious form of attack can take place in data centers and cloud environments that have both DDIO and remote direct memory access enabled to allow servers to exchange data. A server leased by a malicious hacker could abuse the vulnerability to attack other customers. To prove their point, the researchers devised an attack that allows a server to steal keystrokes typed into the protected SSH (or secure shell session) established between another server and an application server.
More details can be read at ARS Technica. The researchers admit NetCAT is a rather complex attack but they recommend that in server settings with untrusted clients, where security matters more than performance, DDIO is disabled.



DV Hardware - Privacy statement
All logos and trademarks are property of their respective owner.
The comments are property of their posters, all the rest © 2002-2019 DM Media Group bvba