body { -ms-overflow-style: scrollbar; overflow-y: scroll; overscroll-behavior-y: none; } .errorContainer { background-color: #FFF; color: #0F1419; max-width: 600px; margin: 0 auto; padding: 10%; font-family: Helvetica, sans-serif; font-size: 16px; } .errorButton { margin: 3em 0; } .errorButton a { background: #1DA1F2; border-radius: 2.5em; color: white; padding: 1em 2em; text-decoration: none; } .errorButton a:hover, .errorButton a:focus { background: rgb(26, 145, 218); } .errorFooter { color: #657786; font-size: 80%; line-height: 1.5; padding: 1em 0; } .errorFooter a, .errorFooter a:visited { color: #657786; text-decoration: none; padding-right: 1em; } .errorFooter a:hover, .errorFooter a:active { text-decoration: underline; } #placeholder, #react-root { display: none !important; } body { background-color: #FFF !important; }

JavaScript is not available.

We’ve detected that JavaScript is disabled in this browser. Please enable JavaScript or switch to a supported browser to continue using twitter.com. You can see a list of supported browsers in our Help Center.

Terms of Service Privacy Policy Cookie Policy Imprint Ads info © 2023 X Corp.

Conversation

Michael Schwarz

Using #Meltdown to steal passwords in real time #intelbug #kaiser #kpti /cc

meltdownattack.com

Embedded video

GIF

12:03 AM · Jan 4, 2018

12

Bookmarks

Michael Schwarz

Our #Meltdown proof-of-concept is now also online, so you can play around with that:

GitHub - IAIK/meltdown: This repository contains several applications, demonstrating the Meltdown...

This repository contains several applications, demonstrating the Meltdown bug. - GitHub - IAIK/meltdown: This repository contains several applications, demonstrating the Meltdown bug.

3

70

97

Charles Forsyth

@charles_forsyth

What else was happening on the machine at the time?

1

3

Michael Schwarz

Full Ubuntu was running with Firefox in the background. No need to have a "quiet" system for #Meltdown. Interestingly, the more load we had one the system, the better it worked.

2

15

78

Show replies

s/real time/just in time/ Nevertheless. Wow. Are you going to publish demo code?

1

2

18

Michael Schwarz

Yes, we are publishing demo code as soon as patches are available, so I guess next week.

3

27

123

Show replies

Not so convincing. Which application is running the pwd popup and how do you guess the 0x3c8...?

1

9

Michael Schwarz

We did not want to show a specific application, so it is only a demo app (a simple GTK application on Linux). For brevity, we don't show how to get the address here. If you are not convinced, wait for the PoC code and try it yourself ;)

6

5

57

Show replies

can we show this demonstration in a report on swedish television? (TV4)

2

4

51

Michael Schwarz

Yes, there is also a higher-resolution version:

Meltdown demo - Spying on passwords

Demonstrating stealing of passwords using the Meltdown attack (https://meltdownattack.com/)

1

17

99

Show replies

Glenford Williams

does it require root privileges to work?

1

2

1

Michael Schwarz

No. With root privileges you could do that anyway.

1

4

44

Show replies