4 ms·
Right. But it means that once the VM is fixed, assuming the customer does this, they are guarded from such attack right?
by oh-kumudo 9y ago
Right. But it means that once the VM is fixed, assuming the customer does this, they are guarded from such attack right?
- rurban 9y agoNot against Spectre, which can extract any memory via javascript or user applications. Eg your secret keys or passwords
- oh-kumudo 9y agoSpectre is a much more serious bug I feel, but it requires the VM to run the malicious code snippet inside itself and with the right context, not from other guest VM, that is how I understand this. The kinda bug that would totally destroy cloud as a business is the one that other guest VM can read your memory...which doesn't seem like to be the case, for now...
- rurban 9y agoSpectre is mostly about JavaScript extracting keys and passwords from the browser process. Install their ChromeZero extension for a start. Meltdown on the other hand can do everything. But only on Intel.