Meltdown & Spectre discoveries credited to 22-year-old German genius

AppleInsider

The identification of the "Meltdown" and "Spectre" vulnerabilities in Intel- and ARM-based processors -- including chips used in Apple's Macs, iPhones, and iPads -- can be credited almost entirely to a Google security researcher in his early 20s, Jann Horn.

Originally from Germany, Horn now works in Zurich, Switzerland with Project Zero, Google's zero-day team, Bloomberg noted on Wednesday. He's said to have discovered the issues while working alone, beginning in April, when he was reading Intel processor manuals to make sure chips could handle code he'd written.

It's in reading about speculative execution that Horn realized that sensitive data was being kept in memory and could potentially be accessed by clever hacking. After talking to a fellow Google researcher, he arrived at the idea of tricking a processor into unusual speculative executions that could be used to fetch specific data.

Horn eventually told Intel, ARM, and AMD about the situation on June 1. By the time Meltdown and Spectre were announced to the public this January, Horn was given lead credit.

Accounts differ on the amount of contact between Horn and Intel. At a conference in Zurich on Jan. 11, Horn said that after his initial data sharing, there was no discussion until Intel called him in early December to confirm other researchers had found the same issues. A Google spokesman, Aaron Stein, insists however that there was much more chatter.

"Jann and Project Zero were in touch with Intel regularly after Jann reported the issue," Stein told Bloomberg.

Apple has already released several related security fixes, with more in the works. It's nevertheless facing multiple lawsuits, as are companies like ARM and Intel.

mplsp

I admittedly haven’t read extensively on the Meltdown/Spectre flaws, but the fact that it’s present in multiple processor from different manufacturers and of different types tells me this is a flaw with the underlying chip design architecture that has been used for many years now without anyone discovering the hole. Kudos to Mr. Horn for discovering the flaw, but reading this and the articles about all the class action lawsuits, I can’t understand how Intel, Apple or any other manufacturer should be held liable for something that no one knew about until 6 months ago at best. Or am I just making the mistake of applying common sense to the law?

edited January 2018

mike1

MplsP said:

I admittedly haven’t read extensively on the Meltdown/Spectre flaws, but the fact that it’s present in multiple processor from different manufacturers and of different types tells me this is a flaw with the underlying chip design architecture that has been used for many years now without anyone discovering the hole. Kudos to Mr. Horn for discovering the flaw, but reading this and the articles about all the class action lawsuits, I can’t understand how Intel, Apple or any other manufacturer should be held liable for something that no one knew about until 6 months ago at best. Or am I just making the mistake of applying common sense to the law?

Don't confuse lawsuits with law. Anybody can file a suit, for almost any reason. The merit of that suit is what will determine if they actually win. I would bet there is a good chance all these suits will be dismissed before they even get to a trial.

airnerd

MplsP said:

I admittedly haven’t read extensively on the Meltdown/Spectre flaws, but the fact that it’s present in multiple processor from different manufacturers and of different types tells me this is a flaw with the underlying chip design architecture that has been used for many years now without anyone discovering the hole. Kudos to Mr. Horn for discovering the flaw, but reading this and the articles about all the class action lawsuits, I can’t understand how Intel, Apple or any other manufacturer should be held liable for something that no one knew about until 6 months ago at best. Or am I just making the mistake of applying common sense to the law?

Nailed it...too much common sense.  Lawyers all want to be the first to hit mega-corporations in order to take the lead or make more money on the class action status.  It's a "file first and then figure out standing later" mentality, and it will keep happening as long as there are few to no ramifications.  

pdbreske

MplsP said:

Or am I just making the mistake of applying common sense to the law?

Your mistake isn't in applying common sense, it's in assuming lawyers for the plaintiffs are motivated by anything other than an easy payday. They are hoping that Apple et al will settle instead of pursuing a lengthy and expensive trial. As Mike1 points out, these will likely be thrown out of court, but if a judge decides there is some merit to the suit, there will be a non-trivial settlement paid to the plaintiffs (and their lawyers) to avoid the trial.

viclauyyc

airnerd said:

MplsP said:

I admittedly haven’t read extensively on the Meltdown/Spectre flaws, but the fact that it’s present in multiple processor from different manufacturers and of different types tells me this is a flaw with the underlying chip design architecture that has been used for many years now without anyone discovering the hole. Kudos to Mr. Horn for discovering the flaw, but reading this and the articles about all the class action lawsuits, I can’t understand how Intel, Apple or any other manufacturer should be held liable for something that no one knew about until 6 months ago at best. Or am I just making the mistake of applying common sense to the law?

Nailed it...too much common sense.  Lawyers all want to be the first to hit mega-corporations in order to take the lead or make more money on the class action status.  It's a "file first and then figure out standing later" mentality, and it will keep happening as long as there are few to no ramifications.  

Is there a way to counter suit the plaintiff if the judge deemed the the suit is totally bs for damage in US?

airnerd

viclauyyc said:

airnerd said:

MplsP said:

I admittedly haven’t read extensively on the Meltdown/Spectre flaws, but the fact that it’s present in multiple processor from different manufacturers and of different types tells me this is a flaw with the underlying chip design architecture that has been used for many years now without anyone discovering the hole. Kudos to Mr. Horn for discovering the flaw, but reading this and the articles about all the class action lawsuits, I can’t understand how Intel, Apple or any other manufacturer should be held liable for something that no one knew about until 6 months ago at best. Or am I just making the mistake of applying common sense to the law?

Nailed it...too much common sense.  Lawyers all want to be the first to hit mega-corporations in order to take the lead or make more money on the class action status.  It's a "file first and then figure out standing later" mentality, and it will keep happening as long as there are few to no ramifications.  

Is there a way to counter suit the plaintiff if the judge deemed the the suit is totally bs for damage in US?

Almost positive there is a way.  However the PR risk is there of "goliath going after david" and so it rarely happens.  It's happened before, but usually just for lawyer fees.  I'd like to see punitive damages levied against the vultures in order to send a message.

wizard69

MplsP said:.... Or am I just making the mistake of applying common sense to the law?

Well yes because the law and common sense doesn't often mix.   Often the laws are constructed to make people feel good but don't rationally take the facts into consideration.   Gun control laws are one example of lacking in common sense, as the guns aren't evil considering that 10 million a year are added to the civilian inventory.    When it comes to product liability common sense does go out the window, the prefect example is suing over hot coffee.   Product liability is often a case of emotional manipulation of the jury, instead of a rational presentation of the facts in the case.    This is why one has to be on guard when selected for jury duty and make sure the jury focuses on the facts and what is a normal expectation.    Going back to the hot coffee debacle, the normal expectation is that your hot coffee is served HOT, if you as an individual aren't prepared for that you should suffer.

Now there is another issue at work here and that is the fact that Apple has designed its or ARM compatible chips.   That makes them liable for flaws but as we have seen they have already addressed those flaws so I'm not sure how much more they can be responsible for.    I would be  a different story if Apple was still buying ARM's designs but right now all that Apple puts into the chip is an instruction set.

spamsandwich

All of the credit in the world for the spec and hardware nerds and white hat hackers of the world.

frantisek

I guess they are not happy at NSA, some little fool discovered their backdoor just like that.

mdriftmeyer

He must have been 7 when he discovered it because it has been a known potential vector since Intel traded off security for performance back in 2003.

dewme

MplsP said:

I admittedly haven’t read extensively on the Meltdown/Spectre flaws, but the fact that it’s present in multiple processor from different manufacturers and of different types tells me this is a flaw with the underlying chip design architecture that has been used for many years now without anyone discovering the hole. Kudos to Mr. Horn for discovering the flaw, but reading this and the articles about all the class action lawsuits, I can’t understand how Intel, Apple or any other manufacturer should be held liable for something that no one knew about until 6 months ago at best. Or am I just making the mistake of applying common sense to the law?

It's important to note that the chip design is not "flawed" from a functional perspective. It is flawed from a quality attribute perspective, and more specifically, for quality attributes that were not major considerations when the designs were committed to silicon (design for security, design for privacy, hacking resilience). This is a recurring pattern for all designs that are committed without consideration for specific quality attributes. The lack of consideration for a particular quality attribute may be due to several things including contemporary concerns at the time the design was committed. Some quality attributes are only a concern for certain environments or applications but these can change. For example, EMP survivability has been a quality attribute for many military systems for decades but civilian infrastructure is now equally at-risk due to the increasing dependence on automation and communication networks over time. Also, new quality attributes emerge over time and the lack of modifiability of existing, committed systems can have devastating consequences. Should we sue infrastructure and communication product companies for not incorporating EMP protection in products they designed 10-20 years ago?

This isn't at all about splitting hairs or terminology. It's the reality of architecting and design components and systems. At some point the design has to be committed to technology or implementation that cannot be practically or economically changed. Instigating legal and liability actions in response to design considerations that were committed decades ago when the attributes of contemporary concern did not exist serves no purpose other than to punatively extort money from the designers/owners of the committed designs. You can't change the past.

randominternetperson

wizard69 said:

MplsP said:.... Or am I just making the mistake of applying common sense to the law?

Well yes because the law and common sense doesn't often mix.   Often the laws are constructed to make people feel good but don't rationally take the facts into consideration.   Gun control laws are one example of lacking in common sense, as the guns aren't evil considering that 10 million a year are added to the civilian inventory.    When it comes to product liability common sense does go out the window, the prefect example is suing over hot coffee.   Product liability is often a case of emotional manipulation of the jury, instead of a rational presentation of the facts in the case.    This is why one has to be on guard when selected for jury duty and make sure the jury focuses on the facts and what is a normal expectation.    Going back to the hot coffee debacle, the normal expectation is that your hot coffee is served HOT, if you as an individual aren't prepared for that you should suffer.

Now there is another issue at work here and that is the fact that Apple has designed its or ARM compatible chips.   That makes them liable for flaws but as we have seen they have already addressed those flaws so I'm not sure how much more they can be responsible for.    I would be  a different story if Apple was still buying ARM's designs but right now all that Apple puts into the chip is an instruction set.

Please do a little research about the actual McDonald's "hot coffee" case before making assumptions.  One could argue that you're ignoring the facts of that case and resorting to emotional manipulation.  The jury in that case determined that McDonald's was serving coffee at dangerously high temperatures, disregarding the foreseeable and avoidable risk of serious injury (in this case third-degree burns "Third-degree burns (full thickness burns) go through the dermis and affect deeper tissues. They result in white or blackened, charred skin that may be numb.") in order to save money.  There are plenty of examples of bad law suits, but this isn't a good example of one.  This is an example of a corporation that completely mishandled an injury.

randominternetperson

dewme said:

MplsP said:

I admittedly haven’t read extensively on the Meltdown/Spectre flaws, but the fact that it’s present in multiple processor from different manufacturers and of different types tells me this is a flaw with the underlying chip design architecture that has been used for many years now without anyone discovering the hole. Kudos to Mr. Horn for discovering the flaw, but reading this and the articles about all the class action lawsuits, I can’t understand how Intel, Apple or any other manufacturer should be held liable for something that no one knew about until 6 months ago at best. Or am I just making the mistake of applying common sense to the law?

It's important to note that the chip design is not "flawed" from a functional perspective. It is flawed from a quality attribute perspective, and more specifically, for quality attributes that were not major considerations when the designs were committed to silicon (design for security, design for privacy, hacking resilience). This is a recurring pattern for all designs that are committed without consideration for specific quality attributes. The lack of consideration for a particular quality attribute may be due to several things including contemporary concerns at the time the design was committed. Some quality attributes are only a concern for certain environments or applications but these can change. For example, EMP survivability has been a quality attribute for many military systems for decades but civilian infrastructure is now equally at-risk due to the increasing dependence on automation and communication networks over time. Also, new quality attributes emerge over time and the lack of modifiability of existing, committed systems can have devastating consequences. Should we sue infrastructure and communication product companies for not incorporating EMP protection in products they designed 10-20 years ago?

This isn't at all about splitting hairs or terminology. It's the reality of architecting and design components and systems. At some point the design has to be committed to technology or implementation that cannot be practically or economically changed. Instigating legal and liability actions in response to design considerations that were committed decades ago when the attributes of contemporary concern did not exist serves no purpose other than to punatively extort money from the designers/owners of the committed designs. You can't change the past.

Bravo.  Very well said.

I wish we should use language such as "vulnerable" rather than "defective."  Virtually everything we consume is "defective" if "it's not perfect" is the standard.

freerange

mike1 said:

MplsP said:

I admittedly haven’t read extensively on the Meltdown/Spectre flaws, but the fact that it’s present in multiple processor from different manufacturers and of different types tells me this is a flaw with the underlying chip design architecture that has been used for many years now without anyone discovering the hole. Kudos to Mr. Horn for discovering the flaw, but reading this and the articles about all the class action lawsuits, I can’t understand how Intel, Apple or any other manufacturer should be held liable for something that no one knew about until 6 months ago at best. Or am I just making the mistake of applying common sense to the law?

Don't confuse lawsuits with law. Anybody can file a suit, for almost any reason. The merit of that suit is what will determine if they actually win. I would bet there is a good chance all these suits will be dismissed before they even get to a trial.

I think you should have said, “don’t confuse lawsuits with common sense...”

strangedays

randominternetperson said:

wizard69 said:

MplsP said:.... Or am I just making the mistake of applying common sense to the law?

Well yes because the law and common sense doesn't often mix.   Often the laws are constructed to make people feel good but don't rationally take the facts into consideration.   Gun control laws are one example of lacking in common sense, as the guns aren't evil considering that 10 million a year are added to the civilian inventory.    When it comes to product liability common sense does go out the window, the prefect example is suing over hot coffee.   Product liability is often a case of emotional manipulation of the jury, instead of a rational presentation of the facts in the case.    This is why one has to be on guard when selected for jury duty and make sure the jury focuses on the facts and what is a normal expectation.    Going back to the hot coffee debacle, the normal expectation is that your hot coffee is served HOT, if you as an individual aren't prepared for that you should suffer.

Now there is another issue at work here and that is the fact that Apple has designed its or ARM compatible chips.   That makes them liable for flaws but as we have seen they have already addressed those flaws so I'm not sure how much more they can be responsible for.    I would be  a different story if Apple was still buying ARM's designs but right now all that Apple puts into the chip is an instruction set.

Please do a little research about the actual McDonald's "hot coffee" case before making assumptions.  One could argue that you're ignoring the facts of that case and resorting to emotional manipulation.  The jury in that case determined that McDonald's was serving coffee at dangerously high temperatures, disregarding the foreseeable and avoidable risk of serious injury (in this case third-degree burns "Third-degree burns (full thickness burns) go through the dermis and affect deeper tissues. They result in white or blackened, charred skin that may be numb.") in order to save money.  There are plenty of examples of bad law suits, but this isn't a good example of one.  This is an example of a corporation that completely mishandled an injury.

Oh we informed this guy of all that in the last thread he mentioned it. Told him of the 700 different serious burn victim complaints, multiple skin grafts for this lady and years of treatment, the McDonald's PR campaign to victim blame her and suggest there is no difference between hot and dangerously hot, etc... He knows. He just doesnt care because pretending it was merely "hot coffee" mets his narrative of the the stupids suing everyone.

edited January 2018

kimberly

StrangeDays said:

Oh we informed this guy of all that in the last thread he mentioned it. Told him of the 700 different serious burn victim complaints, multiple skin grafts for this lady and years of treatment, the McDonald's PR campaign to victim blame her and suggest there is no difference between hot and dangerously hot, etc... He knows. He just doesnt care because pretending it was merely "hot coffee" mets his narrative of the the stupids suing everyone.

Very well said.

bestkeptsecret

At first I read the name as "Jon Hamm" and thought "Damn! That guy really is Superman"!!