4 ms·
I even thought Meltdown/Spectre was overblown, and the average user will never see these attacks.
by yuhong 9y ago
I even thought Meltdown/Spectre was overblown, and the average user will never see these attacks.
- tptacek 9y agoThen you were wrong, since those attacks against unpatched, unhardened hosts are trivially weaponizable through browser Javascript.
- Lerc 9y agoCan you point to a javascript example? I can think of a number of approaches, but nothing I could catergorise as trivial.
- grub5000 9y agoFirst hit for googling "Spectre Javascript POC": https://github.com/ascendr/spectre-chrome https://github.com/ascendr/spectre-chrome
- therein 9y ago> Enable `#shared-array-buffer` in `chrome:///flags` under your own risk...
- tptacek 9y agoSharedArrayBuffer was disabled exactly because vulnerabilities like this are easily exploitable (but there are POCs that don't depend on it).
- mtgx 9y agoEvery single browser had to disable that feature because of those flaws.
- ComputerGuru 9y agoIt was only disabled as a mitigation to these specific attacks, in case you though it was an experimental or “at your own risk” type of thing.
- daira 9y agoDisabling SharedArrayBuffer is just stopping the most obvious method of exploitation; it's by no means a fix. Expect a slew of papers over the next few years on other methods of exploitation from JS.
- guelo 9y agoThey're weaponizable when using a small and rapidly shrinking percentage of unpatched browsers running JavaScript delivered by extremely uncommon websites.
- tptacek 9y agoThat's true because the vulnerability itself wasn't overblown, and was immediately patched.
- api 9y agoAttacks only get better.
- Buge 9y ago>JavaScript delivered by extremely uncommon websites All it takes it emailing them a slightly convincing link, and they're running javascript from one of those "extremely uncommon websites". It doesn't matter how common the website it, a single website can compromise millions of users.