4 ms·
This might sound dumb but.. with these Meltdown + Spectre bugs would an attacker be able to penetrate to gain full access only if a user downloads a native app
by tn_ 9y ago
This might sound dumb but.. with these Meltdown + Spectre bugs would an attacker be able to penetrate to gain full access only if a user downloads a native app or would it be possible through the browser/js?
- tibu 9y agoAs far I remember JS exploit is possible. That's why Mozilla patched Firefox already.
- neilsimp1 9y agoThis post, which I saw on HN yesterday, may answer some of that for you: https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/ https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-... Short answer: yes.
- MBCook 9y agoNot if their browser hasn’t been patched.
- anvandare 9y agoSpectre can give you read-access to the browser process via Javascript, yes, as they described in the original article: https://spectreattack.com/spectre.pdf https://spectreattack.com/spectre.pdf (section 4.3 on page 6). No write access, or access to the OS internals.