Read 51 remaining paragraphs | Comments

Read 4 remaining paragraphs | Comments

La WWDC, le traditionnel événement d'Apple dédié aux développeurs, aura lieu du 10 au 14 juin. La marque devrait y dévoiler plusieurs mises à jour pour ses systèmes d'exploitation, en plus de nouveautés liées à l'intelligence artificielle.

It’s yet another hardware side-channel attack:

The threat resides in the chips’ data memory-dependent prefetcher, a hardware optimization that predicts the memory addresses of data that running code is likely to access in the near future. By loading the contents into the CPU cache before it’s actually needed, the DMP, as the feature is abbreviated, reduces latency between the main memory and the CPU, a common bottleneck in modern computing. DMPs are a relatively new phenomenon found only in M-series chips and Intel’s 13th-generation Raptor Lake microarchitecture, although older forms of prefetchers have been common for years.

[…]

The breakthrough of the new research is that it exposes a previously overlooked behavior of DMPs in Apple silicon: Sometimes they confuse memory content, such as key material, with the pointer value that is used to load other data. As a result, the DMP often reads the data and attempts to treat it as an address to perform memory access. This “dereferencing” of “pointers”—meaning the reading of data and leaking it through a side channel—­is a flagrant violation of the constant-time paradigm.

[…]

The attack, which the researchers have named GoFetch , uses an application that doesn’t require root access, only the same user privileges needed by most third-party applications installed on a macOS system. M-series chips are divided into what are known as clusters. The M1, for example, has two clusters: one containing four efficiency cores and the other four performance cores. As long as the GoFetch app and the targeted cryptography app are running on the same performance cluster—­even when on separate cores within that cluster­—GoFetch can mine enough secrets to leak a secret key.

The attack works against both classical encryption algorithms and a newer generation of encryption that has been hardened to withstand anticipated attacks from quantum computers. The GoFetch app requires less than an hour to extract a 2048-bit RSA key and a little over two hours to extract a 2048-bit Diffie-Hellman key. The attack takes 54 minutes to extract the material required to assemble a Kyber-512 key and about 10 hours for a Dilithium-2 key, not counting offline time needed to process the raw data.

The GoFetch app connects to the targeted app and feeds it inputs that it signs or decrypts. As its doing this, it extracts the app secret key that it uses to perform these cryptographic operations. This mechanism means the targeted app need not perform any cryptographic operations on its own during the collection period.

Note that exploiting the vulnerability requires running a malicious app on the target computer. So it could be worse. On the other hand, like many of these hardware side-channel attacks, it’s not possible to patch.

Slashdot thread .

The Motion Picture Association’s interest in file-hosting platform DoodStream first came to light in a submission to the USTR in October 2022 .

The MPA described DoodStream as a video hosting service offering free storage and premium services including priority encoding and an ad-free experience. Videos uploaded to the platform were embedded on many other streaming sites, the MPA reported, and as a result, traffic was booming.

The MPA estimated the site received 82.7 million visits in August 2022, while using the services of DDoS-Guard in Russia and OVH in France.

“DoodStream operates a partner program that offers financial remuneration, either per download or stream depending on the country of origin,” the MPA informed the USTR in its ‘notorious markets’ submission.

A year later in a new submission to the USTR, the MPA described DoodStream as a ‘top priority’ for its anti-piracy efforts.

DoodStream in the Spotlight

In its October 2023 submission to the USTR’s notorious markets report, the MPA’s cyberlocker and video streaming category listed DoodStream front and center as the priority problem. The MPA still believed the site was operating from OVH in France but also listed other companies as hosts, including Online S.A.S., Hetzner Online GmbH, and Interkvm Host10 SRL.

The MPA noted that the Delhi High Court had ordered ISPs to block DoodStream in 2023, a measure also handed down by a French court during the same year. The Paris court noted that the site “encouraged the infringement of copyright and related rights by setting up tools specifically designed for the mass and illicit sharing of protected content.”

“The operators are located in India,” the MPA informed the USTR.

Entertainment Giants Team Up Against DoodStream

Two months later, Karyn Temple, Senior Executive Vice President and MPA Global General Counsel referenced DoodStream before the House Judiciary Subcommittee on Courts, Intellectual Property and the Internet ( pdf ) . DoodStream continued, business as usual, until now.

In a lawsuit being heard at the High Court of Delhi, eight plaintiffs are listed as follows: Warner Bros. Entertainment Inc., Amazon Content Services LLC, Columbia Pictures Industries, Inc., Disney Enterprises, Inc., Netflix US, LLC, Paramount Pictures Corporation, Universal City Studios Productions LLP and Apple Video Programming.

A total of six defendants include the domains doodstream.com, doodstream.co, dood.stream and their underlying websites (defendants 1-3), plus a server (defendant 4) used by defendants 1 to 3 which allegedly facilitates storing and dissemination of illegal content. Defendants 5 and 6, neither of whom have been named, are reportedly site operators.

According to counsel for the plaintiffs, “rogue cyberlocker websites provide an infrastructure specifically designed to incentivize hosting, uploading, storing, sharing, streaming, and authorize the downloading of copyrighted material without obtaining authorization from the plaintiffs.

Claims Against The DoodStream Defendants

The plaintiffs allege that a massive amount of infringing content to which they have exclusive rights, is uploaded by users on the defendants’ websites.

“Counsel for plaintiffs say the studios approached defendants upon noticing this infringing content, first in June, 2023, after they discovered the identity as to who was operating these websites, who happen to be individuals based in Coimbatore, Tamil Nadu, India, arrayed as defendants nos. 5 and 6,” an order from the court reads.

“This, according to plaintiffs’ counsel, was achieved after some effort since the WHOIS details of defendant nos. 1 to 3 were masked.”

The court notes that the plaintiffs continuously pursued the defendants to take the infringing content down. However, despite promises to comply, a mechanism built in to the site simply generated new links whenever content was supposedly removed.

“Further, uploaded content would also generate a link which could be disseminated by the uploader and therefore, potentially could be disseminated through parallel websites. Thus, as per counsel for plaintiffs, the takedown itself was elusive and of no effect, since the system immediately permitted generation of a new link.”

The court notes that through this mechanism, DoodStream becomes a “hydra-headed monster” that is difficult to police through takedowns alone.

Plaintiffs Want DoodStream Shut Down

The plaintiffs submit that DoodStream should either be comprehensively blocked or a Local Commissioner should be appointed to take over the administration of the sites. However, counsel for the defendants told the court that their clients are prepared to “exhaustively and completely” remove the plaintiffs’ content from the platform.

Due to the link generation mechanism in operation on the site, the plaintiffs expressed concern that content taken down would nnot stay down. The defendants offered assurances that they would “change the features on their websites’ architecture” to ensure that once the process of takedown is complete, regeneration would not be allowed.

In view of this undertaking, the court ordered ( pdf ) all content belonging to the plaintiffs to be taken down within 24 hours, and ordered the defendants to hire a chartered accountant to disclose all revenue generated by the sites since their launch.

The case is listed for hearing on April 8, 2024.

From: TF , for the latest news on copyright battles, piracy and more.

Read 16 remaining paragraphs | Comments

Read 4 remaining paragraphs | Comments

Read 5 remaining paragraphs | Comments

Read 24 remaining paragraphs | Comments