Explore lessons learned from the development and release of Blacksmith, a tool designed to detect Meltdown vulnerabilities, in this ShowMeCon 2018 conference talk. Dive into the intricacies of autonomous endpoint protection, memory side channel attacks, and speculative execution. Gain insights into the S1 Platform's multiple detection engines, and understand the concepts behind Meltdown through practical analogies and toy examples. Analyze proof-of-concept code, examine malicious caching behavior, and learn about page fault behavior and fingerprinting techniques. Discover the challenges faced during Blacksmith's development, receive valuable feedback, and understand the outcomes of this project. Reflect on potential improvements and alternative approaches for future implementations of similar security tools.
Overview
Syllabus
Intro
Overview
The S1 Platform: Autonomous Endpoint Protection
Multiple Types of Detection Engines
Fun little analogy from Zootopia
Memory (High Level Concept)
Notional Intel Data Cache
Side Channel Attacks
Memory Side Channel Timing Attack
Flush + Reload - Major Advantages
Speculative Execution - Practical Analogy
Toy Example Provided in Meltdown Paper
Meltdown (High Level Concept)
Analyzing POC Code
perf_events
Malicious Caching Behavior
Page Fault Behavior
Fingerprinting
Why Release?
Blacksmith
Challenges
Feedback
Lessons Learned / Outcomes
If you could do this again... what would change?
