5 ms·

The article states in Section 4.5 (Page 20): As part of our offensive work, we developed proofs of concept in C++, JavaScript, and WebAssembly for all the repo

The article states in Section 4.5 (Page 20): As part of our offensive work, we developed proofs of concept in C++, JavaScript, and WebAssembly for all the reported vulnerabilities. We were able to leak over 1KB/s from variant 1 gadgets in C++ using rdtsc with 99.99% accuracy and over 10B/s from JavaScript using a low resolution timer.

icedchai 8y ago
This is nice, but is there a real world exploit, not a POC? Example: pulling session cookies for another site, or extracting an SSH private key?
- xenadu02 8y ago
  What are you basing this unearned confidence on? We've seen this same pattern repeat thousands of times: 1. This might be a vulnerability in theory but there's no POC 2. Well it's just a POC, no one has actually weaponized this. 3. Sure someone weaponized this but it is very difficult to pull off. 4. Oh the script-kiddie toolkits can build exploits for this automatically. Who could have seen it coming?!? (Step #2 is probably where the various governmental spying agencies start deploying the exploit in targeted ways) Perhaps this time things are different but it seems unlikely.
  - icedchai 8y ago
    Reading 10B/sec from JS, which is under ideal conditions, does not sound like a fast path to exploitation. I agree it is a concern, but I think it is overblown, similar to pcwalton below.
- jnordwick 8y ago
  There has not been an instance of a real world exploit being run (e.g, you don't know what memory address you are attacking and the system is running under a real world load), and I saw a release by a con sec company (can't remember which one) that said they haven't seen any indication anybody was trying this in the wild either. There is so much that needs to line up to get Specter to work in Javascript that I'm at the point that I don't think it is possible. Everybody keep saying that the POC shows it is possible and that a real world exploit is easy after that. But Specter has been around for a year now, and nobody has yet to even get close to make a working exploit that didn't require some large leaps of faith. And every time you bring this up, you get voted into the floor in HN. I get it. Specter is very cool, almost magical, but coolness doesn't make it any more likely to work.

icedchai 8y ago

This is nice, but is there a real world exploit, not a POC? Example: pulling session cookies for another site, or extracting an SSH private key?

xenadu02 8y ago
What are you basing this unearned confidence on? We've seen this same pattern repeat thousands of times: 1. This might be a vulnerability in theory but there's no POC 2. Well it's just a POC, no one has actually weaponized this. 3. Sure someone weaponized this but it is very difficult to pull off. 4. Oh the script-kiddie toolkits can build exploits for this automatically. Who could have seen it coming?!? (Step #2 is probably where the various governmental spying agencies start deploying the exploit in targeted ways) Perhaps this time things are different but it seems unlikely.
- icedchai 8y ago
  Reading 10B/sec from JS, which is under ideal conditions, does not sound like a fast path to exploitation. I agree it is a concern, but I think it is overblown, similar to pcwalton below.
jnordwick 8y ago
There has not been an instance of a real world exploit being run (e.g, you don't know what memory address you are attacking and the system is running under a real world load), and I saw a release by a con sec company (can't remember which one) that said they haven't seen any indication anybody was trying this in the wild either. There is so much that needs to line up to get Specter to work in Javascript that I'm at the point that I don't think it is possible. Everybody keep saying that the POC shows it is possible and that a real world exploit is easy after that. But Specter has been around for a year now, and nobody has yet to even get close to make a working exploit that didn't require some large leaps of faith. And every time you bring this up, you get voted into the floor in HN. I get it. Specter is very cool, almost magical, but coolness doesn't make it any more likely to work.