security

Timer interrupts reopen branch predictor poisoning window, with a working Zen 2 exploit to prove it

Two MIT researchers will present a new speculative execution attack at DEF CON 34 that uses precisely timed interrupts to bypass defenses against Spectre v2.

Daniël Trujillo and Mengjia Yan of MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) shared their paper [PDF] with The Register ahead of publication. Their attack targets mitigations designed to neutralize potentially hostile branch predictor states before sensitive code runs.

Such neutralization is an important defense against Spectre-style attacks. Depending on the mitigation, the processor or operating system isolates, clears, or safely retrains relevant predictor state when entering privileged code or shortly before a protected branch executes.

Different chipmakers deploy neutralization mitigations slightly differently. Intel’s eIBRS sanitizes branch predictors upon context switch, while AMD’s Safe RET, introduced after the Inception attack Trujillo co-authored in 2023, focuses on the point immediately before a protected branch is executed. Trujillo and Yan refer to these as entry neutralization and in-place neutralization respectively.

Crucially, the two classes share the same underlying assumption that attackers cannot alter branch predictor states within what’s known as a “post-neutralization window” – the period between state neutralization and the branch predictor being used.

The defense here relies on the assumption that everything between the point of neutralization and the usage by a victim branch is safe. Trujillo and Yan’s attack shows how attackers can re-poison the branch predictor during the post-neutralization window.

The researchers call the new class of attack TONTOU, for Time-of-Neutralization to Time-of-Use. They demonstrated that an attacker can exploit the post-neutralization window to re-poison branch predictor state on recent AMD and Intel processors.

To do this, they developed an attack primitive called “interrupt injection.” An unprivileged program schedules high-frequency timer interrupts in the hope that one will land during the often tiny post-neutralization window.

Being able to trigger interrupts during the post-neutralization window allows attackers to divert control flow so that an interrupt handler executes after the sanitization phase and before the victim branch is used. 

The interrupt handler can then re-poison predictor structures such as the return stack buffer (RSB) or branch history buffer (BHB), causing a protected branch to speculatively jump to a disclosure gadget that leaks kernel data through a side channel.

Practical attacks

The researchers said that their tests showed the TONTOU attacks worked on both Intel and AMD-based Linux systems.

They tested TONTOU on Intel Cascade Lake Refresh and Arrow Lake processors and AMD Zen 2 and Zen 4 chips. The researchers built a complete end-to-end exploit only for Zen 2, largely because the Intel attack requires specific software conditions.

Speculative side-channel attacks remain difficult to pull off, and you’re more likely to fall victim to ransomware than Spectre in the real world.

Another serious caveat is that each end-to-end attempt took about 18 minutes, and you can see a sped-up version via the video Trujillo posted to YouTube.

Trujillo and Yan identified the exact point at which they needed to inject their interruptions to poison the RSB, and through a series of attacks broke Linux’s kernel address space layout randomization (KASLR), which allowed them to locate specific secrets such as etc/shadow, which contains the root password hash.

Across ten total runs, the researchers were able to break KASLR every time, although they were only able to successfully locate and leak the contents of etc/shadow in five of these.

“It’s definitely not a simple attack, but we show that it’s practical with our end-to-end exploit on AMD Zen 2,” Trujillo told The Register. 

“Our demonstration does not assume anything special from the system: we use a stock Linux kernel version, no inserted modules, and all default mitigations. Any time you’d execute unprivileged code with timer availability on a system while sharing the kernel with a victim, this attack would be an issue.

“For example, multi-tenant container platforms would fall in this category, allowing ordinary user space programs to leak memory from the shared kernel.”

The researchers hope that their work will inspire further investigations into interrupt injections and TONTOU attacks, and to help develop more robust mitigations against Spectre-style exploits.

They engaged Intel, Arm, and AMD after gathering their results, but only the latter committed to address the issue via kernel patches.

Intel told the pair that it won’t be working up any other mitigations since real-world exploits are subject to too many factors, such as the availability of disclosure gadgets, although it awarded a prize from its bug bounty program in the hundreds of dollars.

Arm said TONTOU’s interrupt injections fall under “passive leakage,” which it does not “actively protect against.” ®

from the here-goes dept

When Erica Schwartz was first nominated for Director of the CDC, you could almost hear both a gasp of surprise and a collective sigh of relief from healthcare providers throughout the country. Schwartz is well qualified for the role, after all, and many took her nomination as a sign that the White House was attempting to rein in RFK Jr. Then came Schwartz’s confirmation hearings. While there was some good in Schwartz’s performance during those hearings, there was a lot of bad. The kind of bad that suddenly has a whole bunch of people who were previously sighing in relief suddenly nervous, and even pulling their endorsements. The biggest issue was Schwartz not affirming that she would refuse Kennedy’s influence and desires in favor of good science.

Well, Schwartz is now the confirmed Director of the CDC, so it seems what she did to ruin her reputation with a whole lot of people didn’t matter in the end.

Perhaps the most disturbing aspect of Schwartz’s testimony came when senators repeatedly asked her what she would do if (or when) she’s put in the same position as Monarez. Schwartz responded as if it hadn’t happened and would never happen. “I do not believe that the president or the secretary would ever do what you just mentioned,” she told Sen. Bernie Sanders (I-Vt.) at one point, prompting him to reply: “Really?”

While senators expressed their disappointment with her responses, health experts dropped their endorsements.

And if you want to get really, really pissed off, allow me to tell you how Bill Cassidy was a key and potentially deciding vote when it came to Schwartz’s confirmation. Cassidy has the ear of other reasonable GOP senators in these hearings and in Senate generally when it comes to health-related concerns. And it may start to sound familiar when I tell you that Cassidy first indicated he was very troubled by Schwartz’s response in her confirmation hearings, but had been assured privately afterwards that his concerns were unfounded.

Critical to Schwartz’s confirmation was support from self-proclaimed vaccine advocate Sen. Bill Cassidy (R-La.), who also cast a critical vote to confirm Kennedy as health secretary. While Cassidy called Schwartz’s performance in the confirmation hearing “disappointing,” he later said he had been reassured. He said he had spoken with her more after the hearing as well as with her former colleagues. “I’m confident that she knows what she is doing,” he said, according to Stat News.

If I dialed the clock back to 2025 and replaced Schwartz’s name with Kennedy’s, it’d be the exact same story.

I hope I’m wrong. I hope that Schwartz’s qualifications rule the day and she can resist Kennedy’s nonsense and make good, scientifically sound decisions and hires. But so long as Kennedy is at the helm, I have my doubts.

Filed Under: bernie sanders, bill cassidy, cdc, erica schwartz, health & human services, rfk jr.

IT Search’s David Shanahan explores how modern technologies are impacting the age-old recruitment process.

Artificial intelligence has impacted almost every job known to man. Not just in how the work is engaged with and carried out, but even in how roles are discovered and applied for in the first place. And it isn’t just employees using AI shortcuts, employers too are frequently turning to advanced tech to ease a heavy workload. 

“AI is now being used across every stage of the recruitment process”, explained David Shanahan, a director at Irish recruitment agency IT Search, which is a member of the Vertical Markets Group.

He said, “Candidates are using it to tailor CVs, create cover letters, prepare for interviews and process job applications at scale. Employers are using AI to write job descriptions, support sourcing outreach and screen and rank applications.”

Shanahan finds currently he is hearing more negatives than positives about the use of AI in the recruitment process, from clients and candidates, but it is important to remember that “AI is simply a tool”.

He said, “When used correctly, it can improve productivity, reduce administration and help both candidates and employers. Used poorly, it can create more noise, more applications and make it harder to assess genuine capability. The issue is not the technology itself but how it is used.”

Noting AI’s value in research, for summarising information, administrative tasks and data analysis, for Shanahan, the goal should be ensuring AI supports decision-making rather than replacing it. This is possible when employers establish clear guidelines around acceptable use, maintain human oversight and review outputs for accuracy and bias.

He said, “Transparency is essential. If employers are using AI for candidate screening, assessments or interview tools, candidates should be informed. Equally, candidates should feel comfortable raising concerns if they believe AI is having a negative impact on the process. 

“Clear expectations create trust and help ensure everyone understands how decisions are being made.”

A true test

As with any technology that moves from experimentation to mass implementation and popularity, there are going to be right and wrong ways of engaging. For Shanahan, the issue is not solely the use of AI by candidates during the application process.

Rather it is when AI masks a candidate’s true level of knowledge, judgement or experience. 

He explained, “There is nothing necessarily wrong with candidates using AI, the issue is when it ends up misrepresenting their experience. Employers should focus less on whether AI was used and more on how candidates approach problem solving, judgment and how this experience can be used in real-world environments.”

He has also noticed the increased use of AI tools by applicants in live interviews, which for hiring managers is becoming more and more frustrating. Products such as  Cluely, LockedIn AI and InterviewCoder can analyse questions in real time and provide responses during the interview, however, he is of the opinion that face to face interviews will always be preferable.

He added, “Rather than attempting to eliminate AI altogether, consider introducing a clear AI transparency policy that details whether AI is permitted during assessments, whether AI can be used for interview preparation, whether AI assistance during live interviews is prohibited and how authenticity and individual capability will be assessed.

For an employer or recruiter, one of the simplest measures would be to move away from questions based on a single ‘correct’ answer and instead focus on areas that require real judgement and critical thinking.  

“Rather than relying solely on question-and-answer interviews, ask candidates to solve problems in real time. People who genuinely understand a subject can explain their thinking, adapt when new information is introduced and justify their decisions. 

Concerned employers can also ask candidates to share their entire desktop rather than a single application or browser window, as many AI interview products are browser extensions, overlays or separate desktop applications.

Ultimately, it is often about finding a balance between embracing new technologies and respecting the processes and people that are already in place.

Shanahan said, “The real objective is to design hiring processes that consistently reveal a person’s genuine capability, regardless of whether AI is used. Recruitment is ultimately about people, judgement and relationships. The organisations that gain the greatest advantage from AI will be those that successfully combine technology with human insight.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

If your wireless charger is slow, the problem might be your case.

Avoid cases that don’t play nice with wireless power

Max Miller for Engadget

Pick an induction-friendly case

Max Miller for Engadget

The North Carolina Ports Authority has confirmed that a cyberattack disrupted IT systems and slowed operations at the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port.

The three facilities are all part of the port, constituting two principal commercial deepwater seaports and an inland hub.

The Port of Wilmington, which is the most significant of the three, has nine berths and a 600,000 TEU annual container capacity, handling an average of 5,000 container gate moves per week.

Wilmington and Morehead together handle 4.4 million short tons of bulk/breakbulk cargo yearly, serving as significant regional logistics hubs.

The attack was reportedly detected on August 4, and the authority responded by activating its cybersecurity contingency plan, beginning recovery on the morning of August 5.

The incident caused a systems-wide outage, forcing gates at all three facilities to open at 8 a.m. on August 5 and delaying port operations and truckers.

The authority did not attribute the attack to a known threat actor and didn’t specify whether any sensitive data had been stolen.

A notification on the port authority’s website indicates that operations are gradually returning to normal, but delays should still be expected, as work to restore affected systems and services is ongoing.

“Gates at the Port of Wilmington, the Port of Morehead City, and the Charlotte Inland Port will follow a normal operating schedule tomorrow, August 7,” reads the latest status update.

“Vessel activity will also proceed as scheduled. As our IT team continues assessing affected systems and restoring services, delays can be expected. We appreciate your patience.”

BleepingComputer has contacted the North Carolina Ports Authority to ask for more details about the incident, but we have not received a response as of publication.

At the time of writing, no threat groups have publicly assumed responsibility for the attack.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

When OnePlus announced its exit from North America and Europe last month, it also confirmed that all devices eligible for the next platform upgrade would switch from OxygenOS to ColorOS, marking an end to the Android skin that helped define the OnePlus brand for more than a decade. Although it did not share a definite timeline for this switch, OnePlus has now set things in motion by launching a closed ColorOS beta program for the OnePlus 15 and OnePlus 15R.

The beta skips the US and Europe for now

According to Android Authority, the closed beta is currently limited to Indian variants of both phones, so anyone in the US or Europe won’t be able to join this round. OnePlus has also capped the program at 300 testers per device, and applying takes more than just owning the right phone.

OnePlus requires you to have an active OnePlus Community account, sign a non-disclosure agreement, and be willing to participate in a Telegram group and interact with OnePlus’ software team. The application window is short too, open only on August 6 and August 7.

OnePlus hasn’t confirmed the Android version underneath, but Android 17 is the likely candidate, since reports say the company has been testing it internally on the OnePlus 15 since March.

This isn’t the first India-only beta from OnePlus

Last year’s OxygenOS 16 beta followed the same pattern, staying limited to Indian devices for its entire run before the stable release eventually reached other markets. So the chances of users in the US and Europe getting a beta release are slim.

OnePlus has been consistent about why it’s making this change. The company has previously said that the switch to ColorOS will help it combine engineering resources with parent company Oppo and speed up future updates. If speedy updates are indeed the real reason, you may not have to wait long to get stable ColorOS on your OnePlus 15 or 15R in the US or Europe.

from the anonymity-matters dept

Back in May I noted how the Trump FCC had unveiled a brand new plan to “stop robocalls.”

I also noted how the plan doesn’t actually stop robocalls because a well-lobbied U.S. government (1) refuses to hold big companies accountable or collect fines, (2) constantly embraces weak rules that make telemarketers and debt collectors happy through endless loopholes, and (3) has an unhealthy fixation with undermining regulatory oversight at the behest of large companies.

Worse; buried in the Trump FCC plan are several initiatives that would harm U.S. privacy and help ICE and other government domestic surveillance efforts. The biggest being a plan to crack down on burner phones by forcing telecoms (the ones bone-grafted to our domestic surveillance operations) to dramatically scale up the information they collect from consumers.

More specifically, the Trump FCC is planning to expand the agency’s Know Your Customer (KYC) requirements by imposing a requirement to “at a minimum, obtain and retain the name, physical address, government issued identification number, and an alternate telephone number of any new and renewing customer.”

That’s unsurprisingly raised concerns among privacy advocates and civil rights groups well aware that greater surveillance will be abused by the Trump administration and beyond. It also ignores that there’s often very good reasons why abuse victims, whistleblowers, journalists, refugees, and others might be seeking an anonymous prepaid burner phone.

On the off chance they might be able to sway Brendan Carr’s thinking, sixteen privacy groups including the Electronic Frontier Foundation have fired off a letter to the agency warning the FCC to avoid undermining public privacy:

“Beyond creating acute privacy risks for all subscribers, the proposal would endanger anonymous communications that have long protected whistleblowers, activists, journalists, and domestic violence survivors. A survivor of domestic violence fleeing an abuser should not have to create a record that leads back to their door in order to get a phone. Nor should a whistleblower or a survivor escaping a trafficking situation. Further, the FCC is responsible for protecting privacy of customer information through its telecom privacy provisions and laws like the Safe Connections Act. This proposal undercuts those protections.”

The additional requirements would also push anonymity out of reach for untold millions of unhoused
individuals, low-income Americans, older adults, foster youth, and others who need anonymity but may struggle to provide required identifiers. The groups note it also puts even greater private information in the hands of companies with some of the worst track records on privacy in America.

“In 2021, a T-Mobile breach exposed the Social Security numbers and driver’s license numbers of approximately 77 million people and, in 2024, an AT&T breach exposed the call and text records of nearly all its wireless customers (roughly 110 million subscribers).

Mandating that thousands of originating providers, including small carriers with limited resources to protect the privacy and security of such an extensive amount of information, collect and retain government IDs for the life of the customer relationship plus four years creates significant new exposure.”

Advertisement

Of course the Trump administration doesn’t really care about “fixing robocalls.” If it did, it would hold the biggest scam callers (large legitimate companies and debt collectors) accountable, actually follow through on penalties, stop embracing mindless deregulation, and take aim at the biggest domestic telecoms that have historically dragged their feet on enforcement (and adopting anti-spoofing authentication technology) because they’ve profited from the scams and harassment of their own customers.

Brendan Carr isn’t the type of guy who cares about holding large U.S. companies accountable for anything. He’s more into broadly gutting corporate oversight at the behest of monopolies, dismantling the First Amendment, and expanding domestic surveillance — especially of vulnerable populations being targeted and brutalized by ICE.

Filed Under: anonymity, authentication, domestic abuse, fcc, robocalls, shaken/stir, surveillance, telecom

Research showed that the device remained fully functional for up to 70 days with zero implant-related complications.

Researchers based at the University of Galway have developed a new implant that could better deliver next-generation therapies for ovarian cancer.

The project was carried out by a team at Cúram, the Research Ireland Centre for Medical Devices based at the Galway university, along with collaborators from the University of Minnesota, Massachusetts Institute of Technology and the Wyss Institute.

The implant, made out of a flexible biomaterial, conforms to the body’s internal contours and sits inside the peritoneal cavity – the space surrounding the abdominal organs of a person assigned female at birth where ovarian cancer predominantly occurs. The porous material and allows medicines to diffuse into the tissue surrounding the affected area.

The device is also connected to an external port through the skin, meaning therapies can be added as often as needed without further surgery or intrusion, and allows for continues monitoring to see how the disease responds. The team’s research was published earlier this year on the scientific journal Device.

“One of the most frustrating aspects of treating ovarian cancer is that we know localised delivery of therapy works better, but the tools we’ve had until now weren’t built for the job,” said Dr Aoibhín Sheedy, a PhD graduate with Cúram and the lead researcher on the project.

“We designed this implant with ovarian cancer patients in mind. We wanted an implant that can deliver living cell therapies repeatedly, reliably, and with real precision to the tumour site.”

Ovarian cancer is often diagnosed at late stages, the researchers say, with treatment often involving surgeries to remove as much of the tumour as possible. Currently, targeted treatment and ways to detect the cancer’s reoccurrence is impossible, they add.

Preclinical research was able to demonstrate that the team’s device remained fully functional for up to 70 days with zero implant-related complications compared to conventional treatments. The team thinks that the device can deliver a range of living cell or non-cell based therapies.

“The tricky part about working with novel therapies, such as immunotherapies, in the setting of ovarian cancer is that repeated delivery is done with outdated materials that are not designed for this setting,” said Dr Martin Felices, an associate professor in medicine at the University of Minnesota.

Dr Eimear Dolan’s lab at the University of Galway developed the delivery system for the implant. She is an associate professor in biomedical engineering at the University.

“What excites us most is the two-way nature of this approach. Clinicians could use this to track how the immune cells are performing, whether the tumour is responding, and then adapt treatment accordingly,” Dolan said.

“That kind of real-time intelligence is something we’ve never had access to before in this setting.”

“It is also very difficult to sample through these systems. The delivery system, created by Dr Dolan’s laboratory, allows for safer repeated delivery of cellular and biologic therapies in the context of the peritoneal cavity,” Felices added.

Last year, €28m was set aside to fund the second phase of Ireland’s largest cancer research programme involving top universities, charity and industrial partners.

Funding from the programme, and otherwise, has helped researchers in the country make numerous advancements in the field in recent months, including identifying specific enzymes that lead to better treatment outcomes and developing compounds capable of damaging cancer cell DNA.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.