4 ms·

Don't think this is right on one detail. Spectre2 should allow malicious JavaScript to read data from other processes. Running browser tabs in separate proces

by javert 9y ago

Don't think this is right on one detail. Spectre2 should allow malicious JavaScript to read data from other processes. Running browser tabs in separate processes (e.g. Google Chrome's new Site Isolation) should protect data from Spectre1 alone but not Spectre2. See the table here: https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html https://security.googleblog.com/2018/01/more-details-about-m... If that's not right I'd love to be corrected. Probably no known exploit of this yet.

macawfish 9y ago
That's a pretty serious detail. Does that mean someone could read the clipboard?
- javert 9y ago
  I think so. But I'm just inferring that from Google's security blog posting; I can't say with real expertise. Would love for an expert to chime in.
- cookiecaper 9y ago
  Disclaimer: I'm not a CPU designer or a kernel developer so I'm not sure I've grokked this yet, but I think I did. Someone who knows, please correct me if I'm wrong. My understanding is that Spectre will allow an attacker to read any memory anywhere in userspace, so yes, that would include the clipboard. Meltdown is just an enhancement to Spectre that allows it to also read into kernel space (ring 0). Spectre is the systemic issue that accurately deduces memory values based on CPU cache heat. Meltdown is the implementation-specific issue, which affects many ARM SKUs and virtually all Intel SKUs, that makes privileged memory susceptible to the same.
philip_coinbase 9y ago
(blog author here) It's unclear but I doubt it is practical given the preconditions required in the Spectre paper. see https://spectreattack.com/spectre.pdf https://spectreattack.com/spectre.pdf, section 5 for the details of Spectre2 (aka branch target injection). Successful exploitation depends on the ability to predict the location of a useful gadget in target process memory and impact is limited to processes running on the same physical core. It also requires a branch mis-prediction training period which seems to be significantly easier to execute if you're running as an application and share a library with your target. Not saying it is impossible, but the bar to success seems way, way higher than with Spectre1.
- javert 9y ago
  Thanks for weighing in. Speaking as a layman: Running on the same physical core is a pretty common case on laptops. Sharing a library with your target is probably a very common case. For instance, libc.
- gesman 9y ago
  >> Let us know by filing a ticket ... Last few tickets I filed with Coinbase took days/weeks/never to get a response. Others seems to have a similar experience: https://www.reddit.com/r/Bitcoin/comments/735yqe/how_do_you_get_coinbase_to_respond_to_a_support/ https://www.reddit.com/r/Bitcoin/comments/735yqe/how_do_you_... >> However, there are a few actions you should take right now to limit your exposure ... None of the actions suggested includes the action of keeping cryptocurrency in user's own deterministic wallet to avoid any exposure from Coinbase side.
  - deleted 9y ago
    [deleted]
  - goldenkey 9y ago
    Coinbase is such a giant scam. Insider trading...questionable banning of users..the list goes on. Doing business with the devil is never pleasant!
helenius 9y ago
Friendly reminder to disable Javascript, at the very least, by default. Only run Javascript on domains you really need and trust, and even then the minimum amount required for the site to function. https://github.com/gorhill/uMatrix/ https://github.com/gorhill/uMatrix/
- iak8god 9y ago
  > Only run Javascript on domains you really need and trust, and even then the minimum amount required for the site to function. This is so inconvenient that practically no one is going to do it. I used to use NoScript but found I was just constantly clicking "temporarily allow."

by javert 9y ago

macawfish 9y ago

That's a pretty serious detail. Does that mean someone could read the clipboard?

javert 9y ago
I think so. But I'm just inferring that from Google's security blog posting; I can't say with real expertise. Would love for an expert to chime in.
cookiecaper 9y ago
Disclaimer: I'm not a CPU designer or a kernel developer so I'm not sure I've grokked this yet, but I think I did. Someone who knows, please correct me if I'm wrong. My understanding is that Spectre will allow an attacker to read any memory anywhere in userspace, so yes, that would include the clipboard. Meltdown is just an enhancement to Spectre that allows it to also read into kernel space (ring 0). Spectre is the systemic issue that accurately deduces memory values based on CPU cache heat. Meltdown is the implementation-specific issue, which affects many ARM SKUs and virtually all Intel SKUs, that makes privileged memory susceptible to the same.

philip_coinbase 9y ago

(blog author here) It's unclear but I doubt it is practical given the preconditions required in the Spectre paper. see https://spectreattack.com/spectre.pdf https://spectreattack.com/spectre.pdf, section 5 for the details of Spectre2 (aka branch target injection). Successful exploitation depends on the ability to predict the location of a useful gadget in target process memory and impact is limited to processes running on the same physical core. It also requires a branch mis-prediction training period which seems to be significantly easier to execute if you're running as an application and share a library with your target. Not saying it is impossible, but the bar to success seems way, way higher than with Spectre1.

javert 9y ago
Thanks for weighing in. Speaking as a layman: Running on the same physical core is a pretty common case on laptops. Sharing a library with your target is probably a very common case. For instance, libc.
gesman 9y ago
>> Let us know by filing a ticket ... Last few tickets I filed with Coinbase took days/weeks/never to get a response. Others seems to have a similar experience: https://www.reddit.com/r/Bitcoin/comments/735yqe/how_do_you_get_coinbase_to_respond_to_a_support/ https://www.reddit.com/r/Bitcoin/comments/735yqe/how_do_you_... >> However, there are a few actions you should take right now to limit your exposure ... None of the actions suggested includes the action of keeping cryptocurrency in user's own deterministic wallet to avoid any exposure from Coinbase side.
- deleted 9y ago
  [deleted]
- goldenkey 9y ago
  Coinbase is such a giant scam. Insider trading...questionable banning of users..the list goes on. Doing business with the devil is never pleasant!

helenius 9y ago

Friendly reminder to disable Javascript, at the very least, by default. Only run Javascript on domains you really need and trust, and even then the minimum amount required for the site to function. https://github.com/gorhill/uMatrix/ https://github.com/gorhill/uMatrix/

iak8god 9y ago
> Only run Javascript on domains you really need and trust, and even then the minimum amount required for the site to function. This is so inconvenient that practically no one is going to do it. I used to use NoScript but found I was just constantly clicking "temporarily allow."