9 ms·

So given that the only mitigation to Spectre is to isolate each website into its own underlying OS process, it seems very important to know which browsers are d

by toomim 6y ago

So given that the only mitigation to Spectre is to isolate each website into its own underlying OS process, it seems very important to know which browsers are doing that. Chrome is doing it. What about Firefox and Safari? What about Edge? Do they implement site isolation?

Paul-ish 6y ago
The proof of concept is in Chrome, so it appears Chrome's mitigations are not sufficient.
- toomim 6y ago
  No, the POC only shows the script leaking memory into javascript running within the same process, and thus the same site. Chrome is still preventing the info from leaking across sites.
  - jeffbee 6y ago
    That's why there was the recent W3C draft about Spectre and the policies around which sites can frame other sites.
  - ddworken 6y ago
    The big caveat to this is that an attacker can generally get a browser to include a cross-site resource in their process. For example, `<img src="https://sensitive.com/myprofilepic.png https://sensitive.com/myprofilepic.png">` will cause the image to be loaded in the attacker's process where they can then potentially steal it. The article "Post-Spectre Web Development" goes into details on how sites can defend against this (and other vectors).
- eloff 6y ago
  No, the attack always works, whether there's an isolated process or not. In Chrome's design you shouldn't be able to access any data of value with the attack, that is data from other sites (like cookies) or privileged data. I don't know if that's indeed true or not in Chrome, but that's why it was designed that way.
  - ddworken 6y ago
    Chrome's design ensures that Spectre can only access resources that end up in an attacker controlled process. And this [1] post on "Post-Spectre Web Development" goes into detail about how a given website can ensure that its resources don't end up in an attacker controlled process. There are also a number of default protections against this like SameSite cookies and CORB that protect some resources by default. [1]: https://w3c.github.io/webappsec-post-spectre-webdev/ https://w3c.github.io/webappsec-post-spectre-webdev/
andrewla 6y ago
I may be wrong about this, and about specifically how exposed browsers are to Spectre, but the only real mitigation here, since protected memory can be accessed through the same mechanism, is disabling branch prediction and CPU caches, or barring those caches being reused across threads or execution contexts. Or completely redesigning those aspects of CPU behavior to remove the ability for similar timing attacks.
- swiley 6y ago
  Or just not accepting and evaling arbitrary code from every single website the user visits, including ones that should only be static documents or forms. That this is generally considered ok boggles the mind. That browser vendors have made it difficult for users to disable this is insane! Even MS Internet Explorer gave users at least that security tool!
  - emilsedgh 6y ago
    the modern web doesn't work without Javascript. It's as simple as that. People like you who want to turn js off are a very small niche. And you have better solutions. Run your browser in a remote server using rdp or vnc. I think it may be equally safe and you may actually have a larger chunk of web working for you.
    - paulryanrogers 6y ago
      Considering the increasing sandboxing and protections I think we're getting closer to browsers in VMs already. Someday I can see a permission prompt to allow performance sensitive sites lower level access.
    - astrobe_ 6y ago
      The "modern web" does not want to work without JS. It definitely could work without JS for the most part.
      - afavour 6y ago
JackMcMack 6y ago
Firefox reduced the timer precision, this demo does not work. https://developer.mozilla.org/en-US/docs/Web/API/Performance/now#reduced_time_precision https://developer.mozilla.org/en-US/docs/Web/API/Performance... On Chrome I have "too many false negatives" on 1st gen Ryzen.
- ddworken 6y ago
  It is worth noting that this POC was specifically targeted at Chromium based browsers. To quote the blog post, they also developed "a PoC which leaks data at 60B/s using timers with a precision of 1ms or worse". So Firefox's protection's are likely not sufficient to mitigate all Spectre attacks.
- NAR8789 6y ago
  I'm not able to get it to work in firefox either, but it feels like "reduced timer precision" shouldn't be sufficient to stop this particular attack. The authors of the demo here claim to be able to "amplify timing differences" by repeatedly hitting or missing cache and measuring the combined total time. My searching indicates firefox's performance.now precision is 20us, but the demo claims to be able to get timing differences of 2ms pretty easily. EDIT: 20us precision might be outdated... running this repeatedly on osx and linux, I'm distinctly getting my results "bucketed" into whatever the unit on the x-axis is. Based on that, I'm guessing timer precision on firefox is actually 1ms. Increasing the cache timer repetitions gets me to a smooth graph, but still no separation of the peaks. The fact that I can get the graph to go from discrete buckets to smooth normal curves makes me think this can indeed overcome reduced timer precision The fact that I can't get the peaks to separate makes me wonder if some other mitigation is protecting me.
ddworken 6y ago
Chromium has site-isolation (with some caveats around phones with limited resources) so both Chrome and Edge have site-isolation. Firefox is getting very close with Project Fission [1] and I predict they'll ship it relatively soon. Currently Safari doesn't have site-isolation and AFAIK they have not publicly committed to anything in terms of getting there. They have done some work in this space (search around for Process Swap on Navigation (PSON)) but it isn't complete. [1]: https://wiki.mozilla.org/Project_Fission https://wiki.mozilla.org/Project_Fission
- toomim 6y ago
  Oye. So that means that in Safari, it's possible for any site to run some Spectre Javascript to read the cookies and passwords for any other site that happens to be running in the user's browser, and then log in as that user on other sites. That's pretty bad.
capableweb 6y ago
Not sure if it's that simple. Chrome (89.0.4389.90 64-bit) runs the tests but leaks memory for me. Firefox (86.0 64-bit) runs the tests but every one of the tests fails. Brave (1.5.112 64-bit) doesn't even run the tests. I'm on Linux (5.11.4-arch1-1).

by toomim 6y ago

Paul-ish 6y ago

The proof of concept is in Chrome, so it appears Chrome's mitigations are not sufficient.

toomim 6y ago
No, the POC only shows the script leaking memory into javascript running within the same process, and thus the same site. Chrome is still preventing the info from leaking across sites.
- jeffbee 6y ago
  That's why there was the recent W3C draft about Spectre and the policies around which sites can frame other sites.
- ddworken 6y ago
  The big caveat to this is that an attacker can generally get a browser to include a cross-site resource in their process. For example, `<img src="https://sensitive.com/myprofilepic.png https://sensitive.com/myprofilepic.png">` will cause the image to be loaded in the attacker's process where they can then potentially steal it. The article "Post-Spectre Web Development" goes into details on how sites can defend against this (and other vectors).
eloff 6y ago
No, the attack always works, whether there's an isolated process or not. In Chrome's design you shouldn't be able to access any data of value with the attack, that is data from other sites (like cookies) or privileged data. I don't know if that's indeed true or not in Chrome, but that's why it was designed that way.
- ddworken 6y ago
  Chrome's design ensures that Spectre can only access resources that end up in an attacker controlled process. And this [1] post on "Post-Spectre Web Development" goes into detail about how a given website can ensure that its resources don't end up in an attacker controlled process. There are also a number of default protections against this like SameSite cookies and CORB that protect some resources by default. [1]: https://w3c.github.io/webappsec-post-spectre-webdev/ https://w3c.github.io/webappsec-post-spectre-webdev/

andrewla 6y ago

I may be wrong about this, and about specifically how exposed browsers are to Spectre, but the only real mitigation here, since protected memory can be accessed through the same mechanism, is disabling branch prediction and CPU caches, or barring those caches being reused across threads or execution contexts. Or completely redesigning those aspects of CPU behavior to remove the ability for similar timing attacks.

swiley 6y ago
Or just not accepting and evaling arbitrary code from every single website the user visits, including ones that should only be static documents or forms. That this is generally considered ok boggles the mind. That browser vendors have made it difficult for users to disable this is insane! Even MS Internet Explorer gave users at least that security tool!
- emilsedgh 6y ago
  the modern web doesn't work without Javascript. It's as simple as that. People like you who want to turn js off are a very small niche. And you have better solutions. Run your browser in a remote server using rdp or vnc. I think it may be equally safe and you may actually have a larger chunk of web working for you.
  - paulryanrogers 6y ago
    Considering the increasing sandboxing and protections I think we're getting closer to browsers in VMs already. Someday I can see a permission prompt to allow performance sensitive sites lower level access.
  - astrobe_ 6y ago
    The "modern web" does not want to work without JS. It definitely could work without JS for the most part.
    - afavour 6y ago

JackMcMack 6y ago

Firefox reduced the timer precision, this demo does not work. https://developer.mozilla.org/en-US/docs/Web/API/Performance/now#reduced_time_precision https://developer.mozilla.org/en-US/docs/Web/API/Performance... On Chrome I have "too many false negatives" on 1st gen Ryzen.

ddworken 6y ago
It is worth noting that this POC was specifically targeted at Chromium based browsers. To quote the blog post, they also developed "a PoC which leaks data at 60B/s using timers with a precision of 1ms or worse". So Firefox's protection's are likely not sufficient to mitigate all Spectre attacks.
NAR8789 6y ago
I'm not able to get it to work in firefox either, but it feels like "reduced timer precision" shouldn't be sufficient to stop this particular attack. The authors of the demo here claim to be able to "amplify timing differences" by repeatedly hitting or missing cache and measuring the combined total time. My searching indicates firefox's performance.now precision is 20us, but the demo claims to be able to get timing differences of 2ms pretty easily. EDIT: 20us precision might be outdated... running this repeatedly on osx and linux, I'm distinctly getting my results "bucketed" into whatever the unit on the x-axis is. Based on that, I'm guessing timer precision on firefox is actually 1ms. Increasing the cache timer repetitions gets me to a smooth graph, but still no separation of the peaks. The fact that I can get the graph to go from discrete buckets to smooth normal curves makes me think this can indeed overcome reduced timer precision The fact that I can't get the peaks to separate makes me wonder if some other mitigation is protecting me.

ddworken 6y ago

Chromium has site-isolation (with some caveats around phones with limited resources) so both Chrome and Edge have site-isolation. Firefox is getting very close with Project Fission [1] and I predict they'll ship it relatively soon. Currently Safari doesn't have site-isolation and AFAIK they have not publicly committed to anything in terms of getting there. They have done some work in this space (search around for Process Swap on Navigation (PSON)) but it isn't complete. [1]: https://wiki.mozilla.org/Project_Fission https://wiki.mozilla.org/Project_Fission

toomim 6y ago
Oye. So that means that in Safari, it's possible for any site to run some Spectre Javascript to read the cookies and passwords for any other site that happens to be running in the user's browser, and then log in as that user on other sites. That's pretty bad.

capableweb 6y ago

Not sure if it's that simple. Chrome (89.0.4389.90 64-bit) runs the tests but leaks memory for me. Firefox (86.0 64-bit) runs the tests but every one of the tests fails. Brave (1.5.112 64-bit) doesn't even run the tests. I'm on Linux (5.11.4-arch1-1).