Levi Strauss & Co. (Levi’s) says that hackers used social engineering on three of its employees to gain access to and steal corporate data stored on their machines.

The company has disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC), saying that its response was sufficiently quick to prevent the compromise of consumer data.

“Based on preliminary findings from the Company’s investigation, the Company believes that certain corporate information was accessed and exfiltrated as a result of the incident,” Levi’s says.

“As of the date of this filing, the Company believes that its rapid response efforts successfully contained and terminated the unauthorized access, and that no consumer data was impacted.”

The company added that it has not experienced any interruption in business operations as a result of the incident.

Levi’s clothing giant has 19,000 employees and an annual revenue of $6.3 billion, best known for its signature 501-line jeans.

The company operates at least 3,300 stores worldwide, and its products can also be found in numerous third-party retail shops, both “brick and mortar” and online.

The firm says it recently detected a cybersecurity incident in which an unknown attacker social-engineered three of its employees, resulting in the breach of company-issued computers.

The investigation launched in response to the incident remains ongoing, and additional notifications will be provided to affected parties as required.

Based on the findings of the investigation to date, Levi’s does not believe the incident will have a material impact on its business or financial position.

Levi’s also noted that it has not experienced any operational disruptions as a result of this breach.

BleepingComputer could not identify online any threat actors claiming the attack on Levi’s.

However, some media outlets have linked this incident to UNC6671, which Google’s Threat Intelligence Group (GTIG) associated with a recent wave of voice phishing attacks targeting hundreds of organizations.

Although Levi’s stated that no customer data was impacted, until more information becomes available, holders of Levi’s shop accounts should monitor for suspicious activity and promptly report it to the firm.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

One of Apple’s memory suppliers is making a massive investment to expand chip production amid global shortages, but it won’t make your next iPhone any cheaper.

On Friday, SK hynix announced that it has approved a 54 trillion won ($38.3 billion) investment to build two new semiconductor fabrication plants in South Korea.

The investment includes 35.2 trillion won ($24 billion) towards the Yongin Y2 facility, which will produce high-bandwidth memory (HBM) and next-generation DRAM products. Construction will begin in 2027 and wrap up by 2029.

A 19.1 trillion won ($13.6 billion) investment will go towards building the Cheongju M17 facility set to open in late 2028. The facility would serve as a NAND production base, geared toward enterprise SSD and AI inference storage.

SK hynix is one of the world’s largest memory chip manufacturers. It’s one of Apple’s key memory suppliers and provides components used across Apple’s lineup, including the iPhone, iPad, and Mac.

Unfortunately, neither of these investments directly helps the average Apple consumer. Instead, the new facilities are being built to serve high-growth AI and enterprise markets, not traditional consumer electronics.

Rockets and feathers

Of course, one could argue that by creating dedicated facilities for increasing enterprise products, SK hynix could give itself breathing room to manufacture consumer-grade products.

And, maybe that’s true.

Even still, SK hynix’s investment isn’t going to solve issues anytime soon. After all, the plants aren’t even slated to open until late 2028 at the earliest.

We’ve said it before, and we’ll say it again: this is going to get worse before it gets better.

Currently, DRAM prices are edging up to an untenable level for even large corporate customer bases, with nothing to say of the average consumer.

DDR-5 DRAM prices have very nearly sextupled on average on the consumer side. In February 2025, two 16GB sticks of DDR5-6000 RAM sold for about $100.

Present pricing is around $600.

We’ve most recently seen the effects as Apple increased prices on most of its product lineup.

The increase wasn’t surprising. Inflation and supply chain issues often drive prices “up like a rocket,” especially on consumer-level products.

The market, bolstered by consumers at all levels rushing to buy products “before they get any more expensive,” stands to make a good profit. That is, at least, until people genuinely can’t afford the costs.

And while we’ll likely see a drop in pricing due to increased manufacturing and market correction, I wouldn’t expect it to be fast or dramatic.

Instead, prices will float “down like a feather.” Slowly, and likely in a sine-wave pattern.

The point, as it often is, is that asymmetric price transmission is a real pain in the ass for the end consumer.

There’s more than supply and demand

Global supply chain shortages are a real thing. The boom of AI has put a lot of stress on manufacturers to keep up with demand.

iPhone 17 Pro Max has been limited by supply chain constraints

But let’s not point the accusatory finger purely at data centers and general market scarcity. There’s plenty of blame to go around.

It’s important to remember that SK hynix is also one of the companies targeted in a recent price fixing suit.

The complaint centers on DRAM, the working memory used in computers, smartphones, tablets, servers and many other electronic devices. Samsung, SK hynix and Micron dominate the global DRAM market, giving them enormous influence over memory supply.

Allegedly, Samsung, SK hynix and Micron shifted manufacturing capacity toward HBM, which commands much higher prices from AI companies. This shift has left DRAM supplies dwindling across the tech industry.

And yes, companies are allowed to pursue more profitable products. But the real question is whether these companies coordinated the production decisions or reached them independently.

Ultimately, whatever investments SK hynix makes right now doesn’t solve the immediate problem. Suppliers have already sold their entire production capacity of memory at high prices through 2027.

Get ready to unleash your inner demon when Overwatch Season 4 begins on Aug. 11. The game’s next chapter brings new tank hero D.Mon, who comes from the same robot suit-piloting Meka Squad as launch hero D.Va but brings a different style of gameplay to the hero shooter’s tank roster.

Yuna “D.Mon” Lee enters the roster as the first new tank hero since Domina back in February. The mech pilot has been in the lore since 2018, when she appeared in D.Va’s Shooting Star cinematic, and the community has been begging for more mech heroes ever since.

And here she is: the new leader of South Korea’s Meka Squad. D.Mon is an “untouchable, cool ice queen,” according to Eleni Rivera, a narrative designer for Overwatch. That’s an interesting contrast to the Meka team’s former leader as mentioned in the lore, who was much louder and more in your face. D.Va was a bit more of an individualistic leader, doing her own thing, Rivera said, whereas D.Mon is much more about being a cool, collected team player.

In a group media interview, Lead Hero Producer Kenny Hudson said, “The story of this hero has been great attention to detail, and pride in the craft.” Much like the rest of the community, the Overwatch team has had high expectations for this hero for years. 

D.Mon design and gameplay

In contrast to D.Va’s design, which fulfilled a more ballistics-based mech fantasy, D.Mon brings agile, sci-fi sword and shield gameplay to Overwatch. Referencing the popularity of the game’s iconic, hammer-swinging tank, Reinhardt, Hudson said the team wanted to expand the melee tank roster, aiming to “give those players who like to play up-close and personal with their tanks more to choose from.”

D.Mon’s primary fire swings a plasma sword in an arc in front of her, while her secondary fire pulls up a shield. While the shield is up, you can activate primary fire to lunge forward with the sword, dealing damage and knocking back enemies. She also has a Fusion Repeater ability that gives her a few seconds of ranged damage and a resource-based horizontal dash ability that boosts her quickly along the ground.

Hudson said D.Mon’s design was partly inspired by the team wanting to see what happens when you have a melee tank with more mobility. As a result, she’s able to dash around while holding up her shield, giving her a distinct feel from other melee tanks, who generally lack movement abilities.

Her ultimate ability, called Limit Break, charges up the plasma sword before swinging through a wide arc. The maneuver grants D.Mon overhealth, and any enemies hit take damage from the swipe while also receiving increased damage from other attacks for a brief duration. 

Like D.Va, D.Mon switches to pilot form if her mech is destroyed and can build up ultimate charge to call down a new mech. When she does, nearby enemies take damage and are knocked back.

Hudson said that, based on internal playtests, D.Mon is very effective at taking space and works well in rush comps that feature speed boosts from supports like Lúcio or Juno. Her ultimate ability also pairs well with other damage hero ultimates, thanks to the damage amplification element, Hudson said, while noting that D.Mon had to play heavily around cooldowns — especially the fuel for her dash.

Brainstorming D.Mon team compositions

I’m interested to see where D.Mon fits into the overall roster. While her design has echoes of Reinhardt, D.Mon appears to be significantly more maneuverable, though she lacks Reinhardt’s raw melee damage and larger team-friendly shield. And unlike her Meka Squad teammate, D.Mon can’t boost into the air to quickly claim high ground or circumvent shields. Instead, she’ll have to rely on the quick bursts of horizontal movement to circle around (or maybe plow straight through) enemy teams.

Her dash ability and melee weapon should be a tough matchup for tanks like Domina and Sigma, who rely on barriers and distance to stay safe. I also imagine her being effective against low-mobility heroes like Cassidy, Ana and Illari, who might not be able to escape a D.Mon dashing in with shields up. 

A team of D.Mon along with flankers, like Shion, Tracer or Genji, and a backline of healers, with Juno, Ana or Kiriko, sounds good to me on paper. The flankers can match D.Mon’s engagement, especially with the help of a speed-boosting Hyper Ring, and can help the tank burst down key targets. A similar team with one flanker subbed out in favor of someone like Cassidy or Sojourn may also work, with D.Mon and the flanker causing havoc and creating space for the ranged damage player to do their thing.

At the same time, I imagine D.Mon having trouble against an enemy team full of ranged damage heroes that can maintain their distance, especially on maps with high ground, or against highly mobile teams that are hard to pin down. D.Mon seems like she would struggle against a Winston or Wrecking Ball with Tracer, Echo or Pharah dealing damage from afar and extremely mobile supports like Kiriko, Lúcio and Jetpack Cat, all of whom would be hard to pin down with a plasma sword.

D.Mon might pull me back into playing tank

Exciting new tank heroes are the best thing Overwatch can add to the game. The tank role is the least popular because it’s the one that most challenges your map knowledge, macro strategy and — based on personal experience — overall mental fortitude. Most players, me included, generally find it more fun to just run around shooting things or healing teammates. 

With a good team, though, playing tank can feel electrifying. The glory of being the team leader, drawing enemy attention and clearing space for your teammates is a unique type of thrill in Overwatch. Sadly, it’s too often undermined by any combination of uncoordinated teammates, enemy counter-swapping or just generally having every single resource and crowd-control ability thrown in your direction. 

Junker Queen has become my go-to tank because she’s a little more self-sufficient, thanks to her damage abilities’ bonus self-healing — and because she depends on smart use of those abilities. A Junker Queen who lands every knife and axe swing will dominate a lobby; one who misses most of them will immediately crumple. 

I’m hoping that D.Mon offers a similar experience. Her Fusion Repeater can get bonus damage on a head shot, rewarding precise aim, and I’m hoping that her dash ability supports enough skill expression to reward practiced and creative uses. I can already envision the thrill of turning a losing fight with a well-timed Limit Break, keeping D.Mon alive with sudden overhealth while helping your team cut through the remaining enemies.

I’ve been playing more tank for the past week just in anticipation of D.Mon’s release, and seeing her kit in detail has only made me more excited about yeeting myself into the frontlines. That may or may not last over the course of the season, but it’s the first time since Junker Queen launched in 2022 that I’ve been excited about playing tank, and that itself is an achievement.

See you on the battlefield in season 4.

Adam Benjamin

Managing Editor

Advertisement

Adam Benjamin has helped people navigate complex problems for the past decade. The former digital services editor for Reviews.com, Adam now leads CNET’s services and software team and contributes to its game coverage.

See full bio

A go-kart track is an odd location to launch a tech initiative in the nation’s biggest city. Yet last month there was New York City mayor Zohran Mamdani, zipping around the 900-foot oval at Coney Island’s Luna Park before stepping up to a podium to unveil a program called Public Interest Technology (PIT) Crews. Thus the go-kart theme.

PIT will consist of five “game-changing” teams that, Mamdani promised, will “raise the bar for what New Yorkers can expect from City Hall.” Working closely with city agencies, these small groups of engineers and designers will strive to change the hidebound and confusing tenor of current city services by using state-of-art skills to rapidly whip up specialized apps that solve real problems. “We want to transform how New Yorkers interact with the government,” said the mayor. “We want to raise expectations on what government can deliver, because we really can deliver.”

Do those words sound familiar? If you follow government tech, they might. Because Mamdani’s message could have fit quite comfortably in the pitch that Barack Obama’s chief technology officer, Todd Park, delivered in 2014 while recruiting tech talent for what would become the United States Digital Service. The USDS was an idealistic effort to bring top Silicon Valley talent into the executive branch to bypass the logjams caused by outdated and inefficient IT, by building great, user-centric software.

The agency somehow survived the first Trump administration and kept going through the Biden term. But in 2025, Elon Musk and his DOGE wrecking crew infiltrated the agency and pulled the plug on much of the useful stuff. (Now, with the National Design Service, the Trump administration is ostensibly trying to revive some of what it destroyed.)

Mamdani’s PIT crew initiative adopts much of the original USDS ethos, with a timely twist: It embraces Silicon Valley expertise while taking a skeptical, almost adversarial, stance toward Big Tech itself. The combination of mayoral charisma and a chance to make software that doesn’t serve advertisers, the military, or the pocketbooks of centibillionaires makes the Mamdani team an attractive, high-status, mid-career change of pace for some techies. Suddenly, one of the sexiest places in geekdom is the Brooklyn headquarters of New York City’s Office of Technology and Innovation.

Mamdani’s transition team set the stage for an urban, democratic-socialist-adjacent, USDS-style tech squad when it tapped Lisa Gelobter for the city’s chief technology officer job. Gelobter’s résumé includes stints at big companies and startups, but the standout item was her post at the United States Digital Service, where she was embedded in the Department of Education. She led the effort to create a College Scorecard that focused on nuts-and-bolts criteria like costs and graduation rates. To this day, she gets misty when recalling her Washington experience; she even remembers what she was wearing when the USDS team took a group picture with Obama just before he left office.

“I’m really excited about trying to recapture that essence, that energy here,” she says. Her budget for the program is $5.24 million, with an additional $2 million grant from the Rockefeller Foundation, which will fund one of the crews.

Gelobter says she brings an engineering mindset to New York City government. “I know how to build software,” she says. “I know how to run a technology organization from a technology perspective.” It’s also a cultural thing for her. “I’m wearing jeans to work—not because I don’t look great in a suit, but it’s a statement, right?” she says. (The same norm-breaking happened in the USDS, which had to overcome objections from bureaucrats who didn’t want to meet with anyone wearing a hoodie.) Naturally, the two people Gelobter hired to run the PIT crew program are also USDS veterans, Luke Farrell and Maya Israni.

networks

Attackers turned admin access into a route downstream, while N-able tells N-central customers to patch – again

N-able has confirmed attackers exploiting an N-central zero-day made it into customer networks, as the vendor pushes out a second mandatory hotfix just days after the first.

The security shop published an update on Thursday detailing what happened after attackers exploited CVE-2026-18577, the critical N-central flaw that can hand an unauthenticated attacker administrative access to the remote monitoring and management platform.

According to N-able, attackers exploited vulnerable N-central servers remotely, then used the platform’s Take Control feature to connect to systems inside the environments being managed through them.

Once there, they registered a new Cloudflare Tunnel service to keep their foothold even after being booted from the N-central server – behavior that Huntress had already observed in the wild.

N-able has now confirmed that its own investigation found the same activity, and says a “limited number” of customers were affected. It hasn’t said how many customers that means, how many downstream systems attackers reached, or what they did once they had established persistent access. 

N-Able didn’t answer these questions when asked by The Register, instead providing a statement saying it is “proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques.”

The firm’s limited disclosure comes alongside Hotfix 2, version 2026.3.1.10, which N-able says customers running N-central on-premises must install immediately – including those that already installed the first emergency fix released on August 2.

“This is not a duplicate of our previous communication,” N-able warned. “Hotfix 2 is required, even if you already applied the earlier hotfix.”

The company says the new update supersedes Hotfix 1 and adds further hardening measures as it monitors threat actors and watches them “evolve their attack techniques.”

Exactly what prompted the second round of defenses isn’t clear. N-able hasn’t said whether attackers found a way around Hotfix 1, and its latest description says the exploited vulnerability affected N-central servers running versions prior to 2026.3.1.7, the first hotfix. Hosted N-central environments have already received the latest mitigations, according to the vendor.

N-able first became aware of the attacks on July 31, after its Adlumin managed detection and response service picked up suspicious activity at a customer. Further digging uncovered a zero-day being actively exploited against an N-central server.

CVE-2026-18577 was subsequently disclosed, and the first hotfix was released on August 2. CISA added the bug to its Known Exploited Vulnerabilities catalog and gave US federal agencies until August 6 to fix it – an unusually short three-day deadline reserved for vulnerabilities the agency considers an urgent risk.

N-central is particularly attractive territory for attackers because managed service providers use the software to administer large numbers of customer systems from one place. Compromising the management platform can therefore provide a route into machines belonging to the MSP’s customers rather than leaving attackers stuck on the original server.

Huntress previously described successful exploitation as giving an attacker the same level of N-central access normally reserved for trusted network operations and engineering staff. Its investigation found attackers using that access to launch remote-control sessions against managed endpoints.

N-able has now published 10 IP addresses it says were used in the attacks and released a service template that customers can use to hunt for known indicators of compromise on Windows endpoints.

The company is warning customers not to take a clean scan as an all-clear, however, saying the tool only checks for indicators identified so far and that more may emerge as its investigation continues.

For anyone running N-central on-premises, the immediate instruction is pretty straightforward: install Hotfix 2, even if Hotfix 1 is already in place. ®

I mean, they’ve been around forever.

SSDs are faster than flash drives, durable and ludicrously capacious

Max Miller for Engadget

The rising cost of SSDs makes flash drives a more practical choice

Max Miller for Engadget

For a while now we’ve been mocking the Trump White House’s plans for an “AI framework” that would have the frontier AI labs hand over their top models for an initial review. After all, this was more or less the exact same plan that the Biden admin worked out in 2023, but it was done in a thoughtful and careful manner. And it caused a bunch of the VC bros in Silicon Valley to come out in support of fascism, while claiming it was a necessary defense against Biden’s attack on supposedly open innovation. Of course, all of that was bullshit, and that’s made even more clear by every step the Trump White House has taken to reinvent a similar “voluntary” AI review plan, but dumber.

Indeed, Trump’s AI framework is so dumb… that they’re keeping it a secret.

The White House does not plan to publicly release its new framework for evaluating advanced AI models, three sources familiar with the discussions told Axios.

Ah, transparency at work. It’s also wreaking havoc on the rest of the AI ecosystem that wasn’t invited to the White House to get the details.

The Trump administration invited staffers from OpenAI, Anthropic, Google, Meta, Nvidia, and other leading AI companies to the White House on Tuesday to share an overview of its new AI oversight framework, the people said. AI developers will have the ability to voluntarily submit new models to the federal government up to 30 days ahead of their public release. The White House will then vet their cyber capabilities according to a classified benchmarking system and share the AI models with federal agencies and trusted corporate partners.

The White House isn’t sharing more information about its testing criteria or which AI models will be covered by the framework, though open models will reportedly be excluded, according to Axios. That has left smaller AI startups, safety advocates, and third-party researchers in the dark about crucial aspects of how the federal government is addressing the cyber risks posed by advanced AI systems. Some argue that the secretive process will give an advantage to larger companies.

Advertisement

Considering that the likes of Andreessen Horowitz (investors in OpenAI) claimed they had to support Donald Trump over Joe Biden because they would support anyone who agreed with their “little tech agenda,” I’m curious how they can possibly square that with the fact that this new framework is significantly worse than the Biden framework, specifically for the “little tech” companies that a16z has used as a shield to defend their support for authoritarian politics?

Of course, the other reason why the White House is probably keeping the framework a secret is because it would show how incompetent they are. All the reporting so far suggests the entire process has been a clusterfuck, which is much more about which companies get to set up which regulatory moats to protect their own business models, rather than what’s best for either innovation or the American public.

At Nvidia, Microsoft, Google and Meta, executives grew increasingly concerned that Anthropic and OpenAI would win over the White House with their arguments for tighter restrictions, according to two of the people. That would potentially cement the A.I. start-ups’ positions as market leaders,

Other A.I. labs were at risk of falling permanently behind, the people added. And because several of the companies make their own open-source models or supply hardware to businesses that use open-source technology, they worried the restrictions could harm them.

Over private texts, phone calls and video conferences, executives quietly built an argument that open-source models were good for the world and for American innovation, according to three of the people familiar with the talks.

Advertisement

But, of course, that’s just the way things work when you have a White House that makes decisions entirely based on transactional motives, rather than anything involving principles.

As we discussed last week, so much of this is all about whose vision of the AI world wins out — whether a handful of giant companies get to lock in the regulatory moat they’ve built for themselves, or an actually competitive market lets people make their own decisions and keep control over their own experiences. Maybe that’s the real reason nobody’s allowed to see the rulebook: because it would reveal who the administration agreed to let write the rules.

Filed Under: ai, ai framework, competition, donald trump, joe biden, open weights, voluntary testing

Companies: a16z, anthropic, google, nvidia, openai

A New Mexico court has ordered Meta to pay $567 million for failing to warn the public about the dangers its social media platforms posed to children. The judgment is in addition to the $375 million the Instagram and Facebook parent company was ordered to pay in March as part of the trial’s first phase.

In a ruling late Thursday, Judge Bryan Biedcheid wrote that New Mexico teens are in the midst of a mental health crisis and found that “Meta’s platforms are a significant contributing cause to the crisis.” The $567 million will fund awareness and prevention, screening and assessment, and referral programs, with the bulk — $420 million — going to treatment.

Biedscheid’s ruling called Facebook’s platforms a “public nuisance” and compared Meta to a factory, with advertising and other content displayed on the platforms as its product and “the psychological harm and sexual exploitation of children to be the pollution that must be abated.”

The court ordered Meta to implement private-by-default settings for its users under 18 and to limit their Friends to users who are also under 18. Accounts belonging to under-18s shall not show up in search or appear in recommendations, according to the order.

New Mexico Attorney General Raúl Torrez said Thursday’s verdict is a victory for parents worried about the effects social media is having on their children.

“This case has always been about protecting children, standing up for families, and making sure that one of the world’s largest technology companies cannot profit from practices that endanger young people without consequence,” Torrez said in a statement.

Meta said in a statement that it disagreed with the ruling and would appeal it.

“We work hard to keep people safe on our platforms and have been transparent about the challenges of identifying and removing bad actors and harmful content,” a Meta spokesperson said in a statement. “We remain confident in our record of protecting teens online and will continue to defend ourselves against claims that misrepresent the facts.”

This isn’t the only legal scrutiny Meta has faced over how it handles underage users on its platform. In March, a California jury found both Instagram owner Meta and Google’s parent company Alphabet liable in a lawsuit brought by a 20-year-old woman who alleged that YouTube and Instagram were designed to be addictive to children.

Social media platforms have introduced specific settings and tools for their youngest users, such as Instagram’s teen accounts, but many of these were launched relatively recently, in just the past few years.

Steven Musil

Night Editor / News

Steven Musil is a senior news editor at CNET News. He’s been hooked on tech since learning BASIC in the late ’70s. When not cleaning up after his daughter and son, Steven can be found pedaling around the San Francisco Bay Area. Before joining CNET in 2000, Steven spent 10 years at various Bay Area newspapers and had a brief stint at MacWeek.

See full bio

Advertisement

security

Timer interrupts reopen branch predictor poisoning window, with a working Zen 2 exploit to prove it

Two MIT researchers will present a new speculative execution attack at DEF CON 34 that uses precisely timed interrupts to bypass defenses against Spectre v2.

Daniël Trujillo and Mengjia Yan of MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) shared their paper [PDF] with The Register ahead of publication. Their attack targets mitigations designed to neutralize potentially hostile branch predictor states before sensitive code runs.

Such neutralization is an important defense against Spectre-style attacks. Depending on the mitigation, the processor or operating system isolates, clears, or safely retrains relevant predictor state when entering privileged code or shortly before a protected branch executes.

Different chipmakers deploy neutralization mitigations slightly differently. Intel’s eIBRS sanitizes branch predictors upon context switch, while AMD’s Safe RET, introduced after the Inception attack Trujillo co-authored in 2023, focuses on the point immediately before a protected branch is executed. Trujillo and Yan refer to these as entry neutralization and in-place neutralization respectively.

Crucially, the two classes share the same underlying assumption that attackers cannot alter branch predictor states within what’s known as a “post-neutralization window” – the period between state neutralization and the branch predictor being used.

The defense here relies on the assumption that everything between the point of neutralization and the usage by a victim branch is safe. Trujillo and Yan’s attack shows how attackers can re-poison the branch predictor during the post-neutralization window.

The researchers call the new class of attack TONTOU, for Time-of-Neutralization to Time-of-Use. They demonstrated that an attacker can exploit the post-neutralization window to re-poison branch predictor state on recent AMD and Intel processors.

To do this, they developed an attack primitive called “interrupt injection.” An unprivileged program schedules high-frequency timer interrupts in the hope that one will land during the often tiny post-neutralization window.

Being able to trigger interrupts during the post-neutralization window allows attackers to divert control flow so that an interrupt handler executes after the sanitization phase and before the victim branch is used. 

The interrupt handler can then re-poison predictor structures such as the return stack buffer (RSB) or branch history buffer (BHB), causing a protected branch to speculatively jump to a disclosure gadget that leaks kernel data through a side channel.

Practical attacks

The researchers said that their tests showed the TONTOU attacks worked on both Intel and AMD-based Linux systems.

They tested TONTOU on Intel Cascade Lake Refresh and Arrow Lake processors and AMD Zen 2 and Zen 4 chips. The researchers built a complete end-to-end exploit only for Zen 2, largely because the Intel attack requires specific software conditions.

Speculative side-channel attacks remain difficult to pull off, and you’re more likely to fall victim to ransomware than Spectre in the real world.

Another serious caveat is that each end-to-end attempt took about 18 minutes, and you can see a sped-up version via the video Trujillo posted to YouTube.

Trujillo and Yan identified the exact point at which they needed to inject their interruptions to poison the RSB, and through a series of attacks broke Linux’s kernel address space layout randomization (KASLR), which allowed them to locate specific secrets such as etc/shadow, which contains the root password hash.

Across ten total runs, the researchers were able to break KASLR every time, although they were only able to successfully locate and leak the contents of etc/shadow in five of these.

“It’s definitely not a simple attack, but we show that it’s practical with our end-to-end exploit on AMD Zen 2,” Trujillo told The Register. 

“Our demonstration does not assume anything special from the system: we use a stock Linux kernel version, no inserted modules, and all default mitigations. Any time you’d execute unprivileged code with timer availability on a system while sharing the kernel with a victim, this attack would be an issue.

“For example, multi-tenant container platforms would fall in this category, allowing ordinary user space programs to leak memory from the shared kernel.”

The researchers hope that their work will inspire further investigations into interrupt injections and TONTOU attacks, and to help develop more robust mitigations against Spectre-style exploits.

They engaged Intel, Arm, and AMD after gathering their results, but only the latter committed to address the issue via kernel patches.

Intel told the pair that it won’t be working up any other mitigations since real-world exploits are subject to too many factors, such as the availability of disclosure gadgets, although it awarded a prize from its bug bounty program in the hundreds of dollars.

Arm said TONTOU’s interrupt injections fall under “passive leakage,” which it does not “actively protect against.” ®