Where to find more in-depth explanations of secuirty flaws

[Watchwork]

I always find security flaws and malware very interesting, but I struggle to find in-depth explanations on how a system is being exploited by an attacker. For example, Tom's Hardware's article on the new Spectre flaw published today doesn't tell you more than there is some exploit to a processor's speculative instruction execution that allows for buffer overflow attacks.

Ideally, I would love to read something about how the out-of-order execution nature of these processors is exploited. How is the TLB overflowed? What is an example of assembly code that would overflow the TLB and how does the state of the TLB change through each line?

I'm really not looking for how to recreate the exploit (although it may sound like it lol), just something that could describe these flaws in a more academic sense. Do you guys know any websites, bloggers, journals, etc. that go into more details on security flaws like Spectre v.1,2 or WannaCry or the WPA2 exploit?

 

[TJ Hooker]

https/spectreattack.com/spectre.pdf

I just googled "spectre exploit documentation"

 

[luckymatt42]

Don't have exact websites for you, but the documents you're looking for are typically called "White Papers", so you can include that in a google search. The white papers are typically fully technical explanations, test methodologies, etc.

 

[Watchwork]

I think looking for an academic understanding was asking for a little too much. I generally don't have the time or the understanding to read 20+ page white papers written by Ph.Ds or Postdocs.

I know I'm being picky, but ideally I'm looking for a singular source that provides up to date analysis on current security vulnerabilities with commentary directed at people with an intermediate understanding. The way I see it is the example post from Tom's Hardware is the basic understanding and the white paper is the advanced understanding. I'm Goldilocks trying to find something in the middle. Something I could add to my morning routine to get caught up on security news.

 

[TJ Hooker]

I don't really know what you're expecting, but various vendors seem to have pages that they're updating (to one extent or another) as new spectre/meltdown news comes out.

https/www.amd.com/en/corporate/security-updates
https/www.intel.com/content/www/us/en/architecture-and-technology/facts-about-side-channel-analysis-and-intel-products.html
https/portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
etc.

This seems like a decent repository on info, but doesn't seem to post updates: https/meltdownattack.com/

Even Wikipedia might be an adequate reference, unfortunately it's not obvious as to how up to date it is.

 

[Watchwork]

Thanks for the advice. I wanted to share with you guys one of the best websites I found that kind of exemplifies what I'm looking for.

https/stratechery.com/ by Ben Thompson has some amazing articles that provide a great level of depth and knowledgeable commentary into a host of tech topics from Intel chip manufacturing to the Android vs. the EU case. Unfortunately, he only posts articles once every week or so, but you can subscribe for a daily update. Something like Stratechery, but security focused, would be ideal. Once again, I know I'm being picky, but isn't that what forums on the internet are for.

Anyway, I recommend checking out the site, and if you guys find anything else like it please post on here and let us all know.