3 ms·
Not much. We've yet to see any live Spectre exploits (that I know of), and I'd be surprised if the first one is a remote exploit.
by Filligree 7y ago
Not much. We've yet to see any live Spectre exploits (that I know of), and I'd be surprised if the first one is a remote exploit.
- londons_explore 7y agoGood point... I wonder why? The proof of concept code works so well for some variants.
- kllrnohj 7y agoBecause most channels for delivering untrusted code have already been fixed. There's really only 2 channels for delivering code these days to attack consumers - app stores & web browsers. Web browsers had crude mitigations immediately (disable SharedArrayBuffer), and have improved since then (full site isolation https://v8.dev/blog/spectre https://v8.dev/blog/spectre ) As for app stores there's typically easier malware attack vectors if you manage to get an app installed & past the scanners in place with that typical back & forth escalation game. And those run in process-level sandboxes with clamped down syscalls. You can't exploit a spectre BPF attack if you can't use BPF at all due to selinux rules, for example. Moving past consumer what else are you really going to attack? Sure you could rent some virtual hosting somewhere and hope you get lucky attacking a neighboring VM, but what's really your end goal there to justify the time & risk? It's not like you can reliably pick a target with that, you just have to go fishing and react to what you may or may not find.
- Symmetry 7y agoI can see how a local Meltdown exploit would be useful but what would be the point of a local Spectre exploit?