4 ms·

> The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. I

> The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/117337/ https://threatpost.com/inside-the-latest-apple-imessage-bug/...

mrunseen 9y ago
Maybe OS-wide blocker for malicious JS?
- Yetanfou 9y ago
  No thanks, just thinking about running 'Norton Anti-JS' (et al) on a server is enough to induce nausea. In other words, blocking 'malicious' code is reactive, not pro-active. Reactive solutions by definition end up solving yesterday's problems while being oblivious to today's - viz. liquids restriction in hand luggage.
Pilfer 9y ago
iMessage uses the WebKit rendering engine to run Javascript. The WebKit engine will be patched by its vendor Apple.
- ZenoArrow 9y ago
  Unless I'm missing something, Spectre isn't really a JS-based vulnerability. As far as I know, any code that runs directly on a computer with one of the affected CPUs could be used to perform the Spectre attack. Feel free to correct me if I'm wrong.
  - barrkel 9y ago
    There are two components: the branch prediction needs to be trained (to get it to speculatively execute the right instructions on context switch to the victim process) and precise timing needs to be available (to exfiltrate data using differences in what got cached). Without executing code, it's difficult to see how the two components could be triggered. Loading complex file formats is structurally similar to interpreting code; the output of the interpretation is some data structure, rather than some side effect, but otherwise it's very similar. There may be some loaders that are controllable and configurable enough to be programmed by data - perhaps something in the video decoding space that isn't offloaded to dedicated hardware or GPU - but I think it would be tough to find. JS or a downloadable game (which already lets people in the front door) of some kind are the best vectors.
    - ZenoArrow 9y ago
      Sure, JS was the most obvious attack vector, but my point was that it's not limited to JS. Any code that runs natively on an affected computer can exploit it. The only advantage JS has is that it's easier to get targets to run malicious code through a web browser. You seem to be in agreement with me on this.
- et-al 9y ago
  Ugh.. when Apple introduced apps and stickers into iMessage, I knew it could be a vector for attacks. Too bad Apple doesn't give users the option to have only "text-only" messages.
  - dogma1138 9y ago
    It does it’s called using SMS.

mrunseen 9y ago

Maybe OS-wide blocker for malicious JS?

Yetanfou 9y ago
No thanks, just thinking about running 'Norton Anti-JS' (et al) on a server is enough to induce nausea. In other words, blocking 'malicious' code is reactive, not pro-active. Reactive solutions by definition end up solving yesterday's problems while being oblivious to today's - viz. liquids restriction in hand luggage.

Pilfer 9y ago

iMessage uses the WebKit rendering engine to run Javascript. The WebKit engine will be patched by its vendor Apple.

ZenoArrow 9y ago
Unless I'm missing something, Spectre isn't really a JS-based vulnerability. As far as I know, any code that runs directly on a computer with one of the affected CPUs could be used to perform the Spectre attack. Feel free to correct me if I'm wrong.
- barrkel 9y ago
  There are two components: the branch prediction needs to be trained (to get it to speculatively execute the right instructions on context switch to the victim process) and precise timing needs to be available (to exfiltrate data using differences in what got cached). Without executing code, it's difficult to see how the two components could be triggered. Loading complex file formats is structurally similar to interpreting code; the output of the interpretation is some data structure, rather than some side effect, but otherwise it's very similar. There may be some loaders that are controllable and configurable enough to be programmed by data - perhaps something in the video decoding space that isn't offloaded to dedicated hardware or GPU - but I think it would be tough to find. JS or a downloadable game (which already lets people in the front door) of some kind are the best vectors.
  - ZenoArrow 9y ago
    Sure, JS was the most obvious attack vector, but my point was that it's not limited to JS. Any code that runs natively on an affected computer can exploit it. The only advantage JS has is that it's easier to get targets to run malicious code through a web browser. You seem to be in agreement with me on this.
et-al 9y ago
Ugh.. when Apple introduced apps and stickers into iMessage, I knew it could be a vector for attacks. Too bad Apple doesn't give users the option to have only "text-only" messages.
- dogma1138 9y ago
  It does it’s called using SMS.