# TONTOU Beats Every Spectre Patch to Read Linux Passwords — 5.47 Bytes at a Time **URL:** https://onehack.st/t/tontou-beats-every-spectre-patch-to-read-linux-passwords-5-47-bytes-at-a-time/324637 **Category:** News & Articles **Tags:** hacking, privacy, tips-tricks, operating-system, news **Created:** [August 10, 2026, 2:38pm UTC](https://onehack.st/t/tontou-beats-every-spectre-patch-to-read-linux-passwords-5-47-bytes-at-a-time/324637 "2026-08-10T14:38:59Z") **Posts on this page:** 1 **Page:** 1
### Author: ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid) #### Post date: [August 10, 2026, 2:38pm UTC](https://onehack.st/t/tontou-beats-every-spectre-patch-to-read-linux-passwords-5-47-bytes-at-a-time/324637/1 "2026-08-10T14:38:59Z")
# 🧠 TONTOU: The Trick That Reads Your Linux Passwords 5 Bytes at a Time — And Beat EVERY Patch _OKAY SO two researchers just walked on stage at the biggest hacker conference on Earth and basically said “yeah, that thing every computer chip has been patched against since 2018? we un-patched it.”_ **A regular non-admin program leaked secret kernel memory at 5.47 bytes/second with 91.97% accuracy — and pulled the Linux password file in 5 out of 10 tries, with every default defense turned ON.** Works on both Intel AND AMD chips. Named TONTOU. Shown off at Black Hat this week. A fix already shipped — but only if you actually update. ([BleepingComputer has the full breakdown](https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/)) ![CPU chip glowing](https://media.giphy.com/media/jVOI15nhYUjc810w60/giphy.gif) WAIT. Let me back up, because this is genuinely one of the wildest “the fix didn’t fix it” stories I’ve seen in a while. Your computer’s brain (the chip) has a habit of _guessing what you’ll do next_ so it feels faster. Back in 2018 hackers figured out you could trick that guessing to spill secrets — they called it Spectre. Everyone patched it. Case closed, right? Nope. Two people from [MIT’s computer science lab](https://www.csail.mit.edu/) found a tiny timing gap _inside the patch itself_ and drove a truck through it. That’s the whole story and it’s bonkers. > **🧩 Dumb Mode Dictionary (read this first, everything clicks)** > > | Scary Term | What It Actually Means | > | --- | --- | > | **Speculative execution** | Your chip guessing your next move to save time (like autocomplete for the CPU) | > | **Spectre** | The 2018 discovery that you can trick that guessing into leaking secrets. [Wiki here](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)) | > | **Side-channel** | Spying on a computer through side effects (how _long_ something takes) instead of the front door | > | **Kernel** | The boss program that runs your entire computer and holds all the keys | > | **/etc/shadow** | The Linux file that stores everyone’s password locks. [What it is](https://en.wikipedia.org/wiki/Passwd#Shadow_file) | > | **Mitigation** | A patch. A band-aid. A “we fixed it (mostly)” | > | **Interrupt** | A tap on the chip’s shoulder yelling “handle THIS right now” | > **📖 How we got here (the 30-second history)** > > - **2018:** Spectre drops. The whole industry panics. Chips get “guess safely” band-aids that isolate or wipe the guessing part before the risky moment. Everyone exhales. > - **The band-aid’s flaw:** there’s a _split-second gap_ between “we cleaned the guessing” and “we actually use it.” The researchers named that gap **TONTOU** — _Time-Of-Neutralization To Time-Of-Use_. Fancy name, simple idea: they strike in the blink between “safe” and “go.” > - **The move:** a normal program (no admin powers!) schedules a shoulder-tap (interrupt) at the _exact_ wrong microsecond, forcing the chip to use dirty guesses. [The Hacker News explains the injection trick](https://thehackernews.com/2026/08/new-interrupt-injection-attack-can.html). > - **Where it dropped:** live on stage at [Black Hat USA 2026](https://www.blackhat.com/), by Daniël Trujillo and Mengjia Yan. Full paper coming to [USENIX Security](https://www.usenix.org/conference/usenixsecurity26). > **📊 The receipts (the numbers are almost funny)** > > | Thing | Number | > | --- | --- | > | Test machine | AMD Zen 2, Linux 6.14, **every** default defense ON | > | Leak speed | **5.47 bytes per second** (yes, bytes. it’s slow AF) | > | Accuracy | **91.97%** | > | Grabbed the password file (/etc/shadow) | **5 out of 10 attempts** | > | Chips affected | Intel **and** AMD (anything using “clean the guesser” style fixes) | > > 5 bytes a second sounds adorably slow — like reading a book one letter every two seconds. But here’s the thing: it doesn’t need the whole hard drive. It just needs the _tiny_ file with your password hashes. Patience beats a locked door. ([SC Media’s writeup](https://www.scworld.com/brief/researchers-bypass-spectre-v2-mitigations-leak-data-from-linux-machines)) > **🗣️ What the timeline's saying** > > - Privacy folks went straight to the doom headline: [_“Spectre is Back: CPU Mitigations Found To Be Ineffective.”_](https://www.privacyguides.org/news/2026/08/07/spectre-is-back-cpu-mitigations-found-to-be-ineffective/) > - The calmer take: it’s slow, it needs code already running on the box, and **a real fix already shipped.** Not the sky falling — but a loud reminder that “patched in 2018” doesn’t mean “safe forever.” > - The spicy take from sysadmins: _“cool, so every un-updated shared server and cheap VPS on the planet is now a slow-drip password faucet.”_ (they’re not wrong) > **🔧 Am I cooked? (the actual fix)** > > Good news: the kernel folks moved fast. The patch has a beautiful commit message — **“x86/bugs: Make Safe-RET robust against interrupt injection”** — and it already shipped in the stable Linux lines: **6.18, 6.6, 6.1, and the 5.15 / 5.10 long-term branches.** > > Translation for humans: > > - On Linux? Run your update command (`apt update && apt upgrade`, `dnf upgrade`, whatever your distro uses), then **reboot.** A kernel patch does nothing until you restart. This is the #1 thing people skip. > - Not sure what version you’re on? Open a terminal, type `uname -r`, and check it against the safe versions above. [Grab the latest kernel here](https://www.kernel.org/). > - Not running Linux servers? You’re basically a spectator on this one. Enjoy the show. * * * #### Cool. A Chip Bug Is Slowly Leaking Passwords… Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°) ![vault door opening](https://media.giphy.com/media/el1coMZO4BR6tdua6F/giphy.gif) Here’s the part nobody tells you: a scary-sounding CPU bug isn’t really a hacking opportunity for you (unless you own a supercomputer and 6 months). The REAL opportunity is the **panic gap** — that 2-4 week window where the fix exists but 90% of small servers haven’t rebooted yet. Everybody’s scared, nobody knows what to do, and _that confusion is worth money._ Let’s go. > **🪟 The Patch Window Sprint** > > The fix exists. Almost nobody’s applied it. That gap is your paycheck. Small indie founders and tiny hosting resellers run servers they set up once and never touched — they have NO idea a reboot is now urgent. You become the calm person who fixes it before the scary blog posts scare their customers. > > The play: DM small SaaS founders and web studios, offer a flat-fee “TONTOU health check + safe patch + reboot” package. The actual work is `uname -r`, an update command, and a scheduled restart. You’re not selling labor — you’re selling _“I made the scary thing go away.”_ > > 🧠 _Example:_ A 24-year-old freelance sysadmin in Lahore, Pakistan DMs 40 indie founders on X who post about their side-project servers. Charges **$75 per server** for a check-patch-reboot with a one-page “you’re safe now” report. 11 said yes in week one = ~$800 for evenings of work. > > > 📈 **Timeline:** First paying client in 3-5 days while the fear is fresh. Dries up in ~4 weeks once auto-updates and big hosts catch everyone up. Sprint, don’t jog. > **🧩 The 'Am I Cooked?' Checker** > > When a scary bug drops, the #1 thing people Google is _“am I affected?”_ — and right now there’s no dead-simple answer for a non-nerd. Build a one-page site where someone pastes their `uname -r` output and it instantly says **SAFE** or **PATCH NOW** with a big green or red box. That’s it. No login, no fluff. > > Why it works: it becomes the link everyone shares in group chats and forums when they’re panicking. First-mover grabs the search traffic for “TONTOU kernel check.” Monetize with a single “too scared to do it yourself? we’ll patch it — $60” button at the bottom. > > 🧠 _Example:_ A student in Nairobi, Kenya builds it as a free [static page](https://pages.github.com/) in an afternoon — just a text box and a list of safe version numbers in the code. Posts it to r/linux and a few Discord servers. 4,000 visits in a week, 30 clicked the “fix it for me” upsell. > > > 📈 **Timeline:** Traffic spike days 1-14 while it’s front-page news. Long tail as an SEO anchor for months if you keep the version list updated. > **🛠️ Sell the Shovel (the one-command report)** > > Everyone’s freaking out — but the boring tool that _checks and proves you’re safe_ is where the quiet money is. Package a single copy-paste script that checks the kernel version, confirms the patch, and spits out a clean PDF-ish report a freelancer can hand to THEIR client. You’re selling the picks and shovels, not digging for gold. > > Why it works: freelance sysadmins and tiny IT shops need to show clients “look, I checked, you’re good.” They’ll happily pay for a ready-made report generator instead of writing one. Sell it on [Gumroad](https://gumroad.com/) for a few bucks a pop, infinite copies. > > 🧠 _Example:_ A DevOps hobbyist in Manila, Philippines wraps a 20-line bash script + a nice template, sells it as “TONTOU Client Report Kit” on Gumroad for **$9**. 60 sales to other freelancers in three weeks = $540 for one evening of packaging. > > > 📈 **Timeline:** Sales pop for 2-3 weeks. Turn it into a reusable “server health report” tool for the _next_ CPU bug and it never stops earning. > **📡 The Detection-Rule Dealer** > > The attack works by spamming weird shoulder-taps (interrupts) at the chip. That’s a _pattern_ — and patterns can be caught. Write a detection rule for free monitoring tools like [Falco](https://falco.org/) or [Wazuh](https://wazuh.com/) that flags a program going nuts scheduling timer interrupts. Sell rule packs to small managed-IT shops who can’t afford a research team. > > Why it works: tiny MSPs (the local “we run your office network” companies) want to tell clients “we detect the new stuff” but have zero time to write rules. You’re the person who did the homework. Grey-hat energy, fully white-hat wallet. > > 🧠 _Example:_ A security nerd in Warsaw, Poland writes one solid Wazuh rule + a plain-English “what this catches” note, bundles 5 recent-threat rules together, sells the pack to small IT shops on [LinkedIn](https://www.linkedin.com/) for **€40**. Lands 8 shops the first month. > > > 📈 **Timeline:** Steady, not explosive. First sales in a week or two, and detection packs _compound_ — every new CVE is another rule to add and re-sell to the same buyers. > **🔍 The Reboot Nag (recurring, not one-off)** > > Here’s the deep truth this whole story exposes: patches don’t work until people REBOOT, and people never reboot. So don’t sell one patch — sell the _“we watch and remind you forever”_ service. Set up a dead-simple monthly check that pings a client’s server, reads the kernel version, and emails them “you’re behind, want us to fix it?” > > Why it works: it turns a one-time $75 job into a $15/month babysitting fee across 30 servers. Boring. Recurring. Beautiful. The TONTOU scare is just your _foot in the door_ — the real product is “you’ll never have to think about this again.” > > 🧠 _Example:_ A 26-year-old in São Paulo, Brazil offers “Server Reboot Watch” — a monthly kernel-version check + reminder email — to local web agencies at **$12/server/month**. Signs 3 agencies (~35 servers) = ~$420/month recurring for a script and 20 minutes a week. > > > 📈 **Timeline:** Slow start (recurring always is), first clients in 2-3 weeks. But this one doesn’t dry up — it _grows_ with every scary headline that comes after TONTOU. > **🛠️ Follow-Up Actions** > > | Move | Do This Now | > | --- | --- | > | Check your own box | Terminal → `uname -r` → compare to 6.18 / 6.6 / 6.1 / 5.15 / 5.10 | > | Patch it | `apt upgrade` or `dnf upgrade` → **then reboot** (this part is mandatory) | > | Read the source | [BleepingComputer’s full report](https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/) | > | Understand the roots | [Spectre explained (Wikipedia)](https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)) | > | Go deep | [The Hacker News technical writeup](https://thehackernews.com/2026/08/new-interrupt-injection-attack-can.html) | * * * **⚡ Quick Hits** | You Want To… | Do This | | --- | --- | | 🔍 Know if you’re at risk | Type `uname -r`, check against 6.18 / 6.6 / 6.1 / 5.15 / 5.10 | | 🔧 Actually fix it | Update your kernel, then **reboot** (skipping reboot = still cooked) | | 💰 Make money off the panic | Offer flat-fee “check + patch + reboot” to tiny hosting shops | | 📖 Understand the whole thing | Read the [BleepingComputer breakdown](https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/) | | 🧠 Sound smart at the party | “The patch had a gap between _cleaning_ and _using_ the chip’s guesses. They struck in the gap.” | _The bug was never the scary part. The scary part is how many servers will never, ever hit reboot._