[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
On Sunday, 4 March 2018 15:57:33 GMT Nick wrote: > > One thing I am a little concerned over: on a scale of 'recommended' to > 'insane', how sensible is it in the Spectre era to trust a VPS to > remain secure? Realistically you are more likely to mess up running your own server than be attacked by bugs like Spectre. Maybe a rookie mistake like running Exim as a mail server ;) Of course it is possible that attacks using Spectre will become routine, but this is going to be quite challenging as it depends on CPU version of the machine being attacked, kernel version and mitigation's in place. This week's latest enhancement for Software Guard Extensions requires physical access to the machine, and if attackers have that your hosting company have already failed. Even if it becomes routine, they will still need to execute code on the same host server as the victim, which could be expensive if the hosting company have a lot of servers. It is also likely the hosting company is vulnerable to something much more mundane. There will be more CPU side channel attacks, modern CPUs are that complex. There will also be more bugs in whatever virtualisation technology is in use, but before this lots of companies relied on file permissions to keep website owners apart, and as dreadful a model as that was it was "good enough" for many web hosts, because your site or service just isn't worth punting up the money to become a customer in the hopes of being on the same server, and finding a hole. There are loads of dreadful security bugs no one talks about much on the Internet, we just ultimately accept the risk. Just look at how widely DNSSEC is deployed, versus how difficult it is to do cache poisoning. Heck I see people who should know better throwing their DNS to services like Google's recursive DNS with no particular protections.
Attachment:
signature.asc
Description: This is a digitally signed message part.
-- The Mailing List for the Devon & Cornwall LUG https://mailman.dclug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/listfaq