4 ms·
None of these have ben shown to work with a real-world exploit in JS. There is just too much noise going on. I'm getting so tired over how oveblown this is get
by jnordwick 7y ago
None of these have ben shown to work with a real-world exploit in JS. There is just too much noise going on.
I'm getting so tired over how oveblown this is getting I was thinking of laying down a $1k bet if anybody will take me up on it, but I dont't think anybody would because it likely isnt possible.
Most of the hype seems to be drive by some Intel gotcha hate.
- viraptor 7y agoHere's a JS speculative read example straight from the original meltdown paper turned into a PoC checker: https://terjanq.github.io/meltdown-checker/app.js https://terjanq.github.io/meltdown-checker/app.js I accept PayPal ;-) (Of course this depend on your definition of a "real world exploit", but this does show that you can cross boundaries of a type system.)
- jnordwick 7y agoYou know exactly what you are looking for at that exact address, without nothing else running and polluting the cache, and you are given an extended amount of time to attack. "you can cross boundaries of a type system" is not even close. In no world could this cod be used to gather useful data on a running system. You are literally just reading from an array you had setup.
- geofft 7y agoIt is well known in the academic literature that attacks "mitigated" by "there's too much noise, you'll have to try too many times, you can attack it in the lab but not on a real machine" are not mitigated at all. See for instance https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf . A practical case where you have an extended amount of time to attack are when you're an ad in a background tab of a website with interesting credentials.