TONTOU: The Trick That Reads Your Linux Passwords 5 Bytes at a Time — And Beat EVERY Patch
TONTOU: The Trick That Reads Your Linux Passwords 5 Bytes at a Time — And Beat EVERY PatchOKAY SO two researchers just walked on stage at the biggest hacker conference on Earth and basically said “yeah, that thing every computer chip has been patched against since 2018? we un-patched it.”
A regular non-admin program leaked secret kernel memory at 5.47 bytes/second with 91.97% accuracy — and pulled the Linux password file in 5 out of 10 tries, with every default defense turned ON.
Works on both Intel AND AMD chips. Named TONTOU. Shown off at Black Hat this week. A fix already shipped — but only if you actually update. (BleepingComputer has the full breakdown)
WAIT. Let me back up, because this is genuinely one of the wildest “the fix didn’t fix it” stories I’ve seen in a while. Your computer’s brain (the chip) has a habit of guessing what you’ll do next so it feels faster. Back in 2018 hackers figured out you could trick that guessing to spill secrets — they called it Spectre. Everyone patched it. Case closed, right?
Nope. Two people from MIT’s computer science lab found a tiny timing gap inside the patch itself and drove a truck through it. That’s the whole story and it’s bonkers.
🧩 Dumb Mode Dictionary (read this first, everything clicks)
| Scary Term | What It Actually Means |
|---|---|
| Speculative execution | Your chip guessing your next move to save time (like autocomplete for the CPU) |
| Spectre | The 2018 discovery that you can trick that guessing into leaking secrets. Wiki here |
| Side-channel | Spying on a computer through side effects (how long something takes) instead of the front door |
| Kernel | The boss program that runs your entire computer and holds all the keys |
| /etc/shadow | The Linux file that stores everyone’s password locks. What it is |
| Mitigation | A patch. A band-aid. A “we fixed it (mostly)” |
| Interrupt | A tap on the chip’s shoulder yelling “handle THIS right now” |
📖 How we got here (the 30-second history)
- 2018: Spectre drops. The whole industry panics. Chips get “guess safely” band-aids that isolate or wipe the guessing part before the risky moment. Everyone exhales.
- The band-aid’s flaw: there’s a split-second gap between “we cleaned the guessing” and “we actually use it.” The researchers named that gap TONTOU — Time-Of-Neutralization To Time-Of-Use. Fancy name, simple idea: they strike in the blink between “safe” and “go.”
- The move: a normal program (no admin powers!) schedules a shoulder-tap (interrupt) at the exact wrong microsecond, forcing the chip to use dirty guesses. The Hacker News explains the injection trick.
- Where it dropped: live on stage at Black Hat USA 2026, by Daniël Trujillo and Mengjia Yan. Full paper coming to USENIX Security.
📊 The receipts (the numbers are almost funny)
| Thing | Number |
|---|---|
| Test machine | AMD Zen 2, Linux 6.14, every default defense ON |
| Leak speed | 5.47 bytes per second (yes, bytes. it’s slow AF) |
| Accuracy | 91.97% |
| Grabbed the password file (/etc/shadow) | 5 out of 10 attempts |
| Chips affected | Intel and AMD (anything using “clean the guesser” style fixes) |
5 bytes a second sounds adorably slow — like reading a book one letter every two seconds. But here’s the thing: it doesn’t need the whole hard drive. It just needs the tiny file with your password hashes. Patience beats a locked door. (SC Media’s writeup)
🗣️ What the timeline's saying
- Privacy folks went straight to the doom headline: “Spectre is Back: CPU Mitigations Found To Be Ineffective.”
- The calmer take: it’s slow, it needs code already running on the box, and a real fix already shipped. Not the sky falling — but a loud reminder that “patched in 2018” doesn’t mean “safe forever.”
- The spicy take from sysadmins: “cool, so every un-updated shared server and cheap VPS on the planet is now a slow-drip password faucet.” (they’re not wrong)
🔧 Am I cooked? (the actual fix)
Good news: the kernel folks moved fast. The patch has a beautiful commit message — “x86/bugs: Make Safe-RET robust against interrupt injection” — and it already shipped in the stable Linux lines: 6.18, 6.6, 6.1, and the 5.15 / 5.10 long-term branches.
Translation for humans:
- On Linux? Run your update command (
apt update && apt upgrade,dnf upgrade, whatever your distro uses), then reboot. A kernel patch does nothing until you restart. This is the #1 thing people skip. - Not sure what version you’re on? Open a terminal, type
uname -r, and check it against the safe versions above. Grab the latest kernel here. - Not running Linux servers? You’re basically a spectator on this one. Enjoy the show.
Cool. A Chip Bug Is Slowly Leaking Passwords… Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°)
Here’s the part nobody tells you: a scary-sounding CPU bug isn’t really a hacking opportunity for you (unless you own a supercomputer and 6 months). The REAL opportunity is the panic gap — that 2-4 week window where the fix exists but 90% of small servers haven’t rebooted yet. Everybody’s scared, nobody knows what to do, and that confusion is worth money. Let’s go.
🪟 The Patch Window Sprint
The fix exists. Almost nobody’s applied it. That gap is your paycheck. Small indie founders and tiny hosting resellers run servers they set up once and never touched — they have NO idea a reboot is now urgent. You become the calm person who fixes it before the scary blog posts scare their customers.
The play: DM small SaaS founders and web studios, offer a flat-fee “TONTOU health check + safe patch + reboot” package. The actual work is uname -r, an update command, and a scheduled restart. You’re not selling labor — you’re selling “I made the scary thing go away.”
Example: A 24-year-old freelance sysadmin in Lahore, Pakistan DMs 40 indie founders on X who post about their side-project servers. Charges $75 per server for a check-patch-reboot with a one-page “you’re safe now” report. 11 said yes in week one = ~$800 for evenings of work.
Timeline: First paying client in 3-5 days while the fear is fresh. Dries up in ~4 weeks once auto-updates and big hosts catch everyone up. Sprint, don’t jog.
🧩 The 'Am I Cooked?' Checker
When a scary bug drops, the #1 thing people Google is “am I affected?” — and right now there’s no dead-simple answer for a non-nerd. Build a one-page site where someone pastes their uname -r output and it instantly says SAFE or PATCH NOW with a big green or red box. That’s it. No login, no fluff.
Why it works: it becomes the link everyone shares in group chats and forums when they’re panicking. First-mover grabs the search traffic for “TONTOU kernel check.” Monetize with a single “too scared to do it yourself? we’ll patch it — $60” button at the bottom.
Example: A student in Nairobi, Kenya builds it as a free static page in an afternoon — just a text box and a list of safe version numbers in the code. Posts it to r/linux and a few Discord servers. 4,000 visits in a week, 30 clicked the “fix it for me” upsell.
🛠️ Sell the Shovel (the one-command report)
Everyone’s freaking out — but the boring tool that checks and proves you’re safe is where the quiet money is. Package a single copy-paste script that checks the kernel version, confirms the patch, and spits out a clean PDF-ish report a freelancer can hand to THEIR client. You’re selling the picks and shovels, not digging for gold.
Why it works: freelance sysadmins and tiny IT shops need to show clients “look, I checked, you’re good.” They’ll happily pay for a ready-made report generator instead of writing one. Sell it on Gumroad for a few bucks a pop, infinite copies.
Example: A DevOps hobbyist in Manila, Philippines wraps a 20-line bash script + a nice template, sells it as “TONTOU Client Report Kit” on Gumroad for $9. 60 sales to other freelancers in three weeks = $540 for one evening of packaging.
📡 The Detection-Rule Dealer
The attack works by spamming weird shoulder-taps (interrupts) at the chip. That’s a pattern — and patterns can be caught. Write a detection rule for free monitoring tools like Falco or Wazuh that flags a program going nuts scheduling timer interrupts. Sell rule packs to small managed-IT shops who can’t afford a research team.
Why it works: tiny MSPs (the local “we run your office network” companies) want to tell clients “we detect the new stuff” but have zero time to write rules. You’re the person who did the homework. Grey-hat energy, fully white-hat wallet.
Example: A security nerd in Warsaw, Poland writes one solid Wazuh rule + a plain-English “what this catches” note, bundles 5 recent-threat rules together, sells the pack to small IT shops on LinkedIn for €40. Lands 8 shops the first month.
🔍 The Reboot Nag (recurring, not one-off)
Here’s the deep truth this whole story exposes: patches don’t work until people REBOOT, and people never reboot. So don’t sell one patch — sell the “we watch and remind you forever” service. Set up a dead-simple monthly check that pings a client’s server, reads the kernel version, and emails them “you’re behind, want us to fix it?”
Why it works: it turns a one-time $75 job into a $15/month babysitting fee across 30 servers. Boring. Recurring. Beautiful. The TONTOU scare is just your foot in the door — the real product is “you’ll never have to think about this again.”
Example: A 26-year-old in São Paulo, Brazil offers “Server Reboot Watch” — a monthly kernel-version check + reminder email — to local web agencies at $12/server/month. Signs 3 agencies (~35 servers) = ~$420/month recurring for a script and 20 minutes a week.
🛠️ Follow-Up Actions
| Move | Do This Now |
|---|---|
| Check your own box | Terminal → uname -r → compare to 6.18 / 6.6 / 6.1 / 5.15 / 5.10 |
| Patch it | apt upgrade or dnf upgrade → then reboot (this part is mandatory) |
| Read the source | BleepingComputer’s full report |
| Understand the roots | Spectre explained (Wikipedia) |
| Go deep | The Hacker News technical writeup |
Quick Hits
| You Want To… | Do This |
|---|---|
 Know if you’re at risk |
Type uname -r, check against 6.18 / 6.6 / 6.1 / 5.15 / 5.10 |
 Actually fix it |
Update your kernel, then reboot (skipping reboot = still cooked) |
 Make money off the panic |
Offer flat-fee “check + patch + reboot” to tiny hosting shops |
 Understand the whole thing |
Read the BleepingComputer breakdown |
| Sound smart at the party |
“The patch had a gap between cleaning and using the chip’s guesses. They struck in the gap.” |
The bug was never the scary part. The scary part is how many servers will never, ever hit reboot.
!