6 ms·

Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://w

Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://www.zdnet.com/article/google-this-spectre-proof-of-concept-shows-how-dangerous-these-attacks-can-be/ https://www.zdnet.com/article/google-this-spectre-proof-of-c... Additionally, the passwords and keys on your local dev box are very valuable for further attacks, like supply chain attacks.

netr0ute 5y ago
That's what JavaScript blockers like NoScript and uBlock Origin are for.
- diegocg 5y ago
  Ad blockers can not know if a JavaScript algorithm is dangerous or not
  - netr0ute 5y ago
    People do, and the JS algorithms will get added to adblocker lists in no time.
  - a1369209993 5y ago
    It doesn't matter if it's dangerous or not if it doesn't get to run in the first place.
reader_mode 5y ago
How long would you have to run JavaScript on your desktop to leak sensitive information and has there been any known exploits in the wild ?
- mhh__ 5y ago
  https://leaky.page/ https://leaky.page/ I don't know about the wild, but if this were tuned (i.e. this requires a lot of work for the first byte, the rest are easy) for a HVT you wouldn't know.
  - magila 5y ago
    The problem is that PoC is extracting data which the PoC itself created specifically to facilitate said extraction. AFAIK no one has created a PoC which can extract specific data which hasn't been constructed to facilitate the PoC.
  - ggreer 5y ago
    On my laptop's Core i5-10210U with mitigations=off, the demo just prints "[!] error: could not infer memory layout" until it runs out of retries. This is on Chromium 91.0.4472.106 and kernel 5.12.11-arch1-1. lscpu shows vulnerabilities: Itlb multihit: KVM: Mitigation: VMX disabled L1tf: Not affected Mds: Not affected Meltdown: Not affected Spec store bypass: Vulnerable Spectre v1: Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers Spectre v2: Vulnerable, IBPB: disabled, STIBP: disabled Srbds: Mitigation; TSX disabled Tsx async abort: Not affected
    - diveanon 5y ago
      I got the same result on a pretty similar system.
christophilus 5y ago
Yes, but your fans would start spinning like mad. I kill any browser that does that. You’d have to execute a successful attack within a few seconds to pull it off. I think that’s a risk I’ll take.
- xrisk 5y ago
  I don’t think that’s a good safety heuristic.
  - hjek 5y ago
    I agree that it's not good, yet anecdotally I've realized that a device has been compromised by running `top`, on Windows and on Linux. It's not a good heurestic because it's only disvoverable post-compromise.
    - jtbayly 5y ago
      I’ve discovered a compromise before because of the fans going full speed on a server.
- mhh__ 5y ago
  Why would you fans start spinning? You can extract data at at least hundreds of MB/s with these exploits, you wouldn't know.
  - formerly_proven 5y ago
    That's the first time I have heard a number this high for these exploits. All prior numbers I've heard were many orders of magnitude smaller, more like byte/s. The article linked above cites 1 kB/s as novel.
    - mhh__ 5y ago
      That was a number I heard (Meltdown pre-mitigations) when the "oh shit" papers started dropping a few years ago, could be misremembering. I'm also still slightly inebriated so thank you for nerdsniping me (Lit Review time!)
hjek 5y ago
> Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. Per-process Spectre mitigations could be helpful there, but I don't understand the technical details to know whether that would be possible to implement. It would be nice to disable mitigations on a video editor and for gaming.
- pjmlp 5y ago
  If gaming implies a MMO, a possible attack vector is attacking users to get hold of their gaming account details and do as they please.
  - usrusr 5y ago
    The way I understand it (not that well, admittedly), per-process mitigations would be all about keeping that process from reading other memory areas, not about protecting that process from others. Which is better than the reverse if your intention is to allow some processes to run random js.
    - pjmlp 5y ago
      Yeah, but in the context of games, most likely it means threaded code written in C or C++. If anything Spectre has shown us that the only real mitigation is to go back to multiprocessing with IPC, with the extra hardware resources it entails, as the exploit exists regardless of the language for in-process memory.
    - genmud 5y ago
      The problem with spectre/meltdown is they don't use standard calls to ask for memory of other processes... that is the vulnerability. If you were do to do per process mitigation it would need to prevent certain process execution flows from happening, because the vulnerability is a problem with the CPU pulling memory from the way speculative execution works. This actually impacts things that are typically protected and is much more impactful than people think... for example, because the bug allows reading from nearly any memory address space, you could also pull in things like crypto keys from the OS or passwords from memory.
treis 5y ago
I thought the browsers had put in their own mitigations that stop spectre/meltdown attacks.
- eloff 5y ago
  They tried. The V8 team eventually gave up and said it was unwinnable. What they did do is move tabs to their own process so they can take average of the operating systems protections. Yes you can read the memory of the process hosting the JavaScript, but now there isn't anything interesting in it. Google's security team released a proof of concept attack that can read the memory in the renderer in many systems.
  - jacquesm 5y ago
    average -> advantage
    - eloff 5y ago
      Man mobile keyboards suck. Any idiot knows the word average doesn't work there (at minimum you'd have to preface it with the word "the"), so why can't my keyboard run an ML model that's not an idiot?
    - richrichardsson 5y ago
      Didn't even notice until reading this comment! I think my brain said, "starts with an A, got a V near the beginning, ends in AGE, must be ADVANTAGE in this context."
FunnyLookinHat 5y ago
Yeah no disagreement there. I had totally forgotten about the JS POC - ugh! The JavaScript argument is interesting to me in that it's already flawed. I suppose I'd rather focus on the security issues with browsers running code on my computer more than anything else since it's effectively the "but what about ___" answer to so many threads like this one. I've seen a few other comments suggesting per-process rules to enable or disable branch protections. That's an interesting thought, especially considering you could apply it to either "trusted" or "untrusted" code depending on it's source.
- fiddlerwoaroof 5y ago
  With Arm big.little architectures, it could start making sense to have dedicated in-order cores for running JavaScript and other “untrusted” code. Also, I wonder if disabling mitigations on the desktop and running the browser in a VM with mitigations enabled would be effective.
  - saagarjha 5y ago
    People want their websites to load fast, though.
krylon 5y ago
I've never thought about this, but how big are the performance penalties for Spectre mitigations vs not having Javascript JIT? (Just to be clear, I'm perfectly happy with the performance of my old-ish machine, so I have no motivation to disable those mitigations.)

netr0ute 5y ago

That's what JavaScript blockers like NoScript and uBlock Origin are for.

diegocg 5y ago
Ad blockers can not know if a JavaScript algorithm is dangerous or not
- netr0ute 5y ago
  People do, and the JS algorithms will get added to adblocker lists in no time.
- a1369209993 5y ago
  It doesn't matter if it's dangerous or not if it doesn't get to run in the first place.

reader_mode 5y ago

How long would you have to run JavaScript on your desktop to leak sensitive information and has there been any known exploits in the wild ?

mhh__ 5y ago
https://leaky.page/ https://leaky.page/ I don't know about the wild, but if this were tuned (i.e. this requires a lot of work for the first byte, the rest are easy) for a HVT you wouldn't know.
- magila 5y ago
  The problem is that PoC is extracting data which the PoC itself created specifically to facilitate said extraction. AFAIK no one has created a PoC which can extract specific data which hasn't been constructed to facilitate the PoC.
- ggreer 5y ago
  On my laptop's Core i5-10210U with mitigations=off, the demo just prints "[!] error: could not infer memory layout" until it runs out of retries. This is on Chromium 91.0.4472.106 and kernel 5.12.11-arch1-1. lscpu shows vulnerabilities: Itlb multihit: KVM: Mitigation: VMX disabled L1tf: Not affected Mds: Not affected Meltdown: Not affected Spec store bypass: Vulnerable Spectre v1: Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers Spectre v2: Vulnerable, IBPB: disabled, STIBP: disabled Srbds: Mitigation; TSX disabled Tsx async abort: Not affected
  - diveanon 5y ago
    I got the same result on a pretty similar system.

christophilus 5y ago

Yes, but your fans would start spinning like mad. I kill any browser that does that. You’d have to execute a successful attack within a few seconds to pull it off. I think that’s a risk I’ll take.

xrisk 5y ago
I don’t think that’s a good safety heuristic.
- hjek 5y ago
  I agree that it's not good, yet anecdotally I've realized that a device has been compromised by running `top`, on Windows and on Linux. It's not a good heurestic because it's only disvoverable post-compromise.
  - jtbayly 5y ago
    I’ve discovered a compromise before because of the fans going full speed on a server.
mhh__ 5y ago
Why would you fans start spinning? You can extract data at at least hundreds of MB/s with these exploits, you wouldn't know.
- formerly_proven 5y ago
  That's the first time I have heard a number this high for these exploits. All prior numbers I've heard were many orders of magnitude smaller, more like byte/s. The article linked above cites 1 kB/s as novel.
  - mhh__ 5y ago
    That was a number I heard (Meltdown pre-mitigations) when the "oh shit" papers started dropping a few years ago, could be misremembering. I'm also still slightly inebriated so thank you for nerdsniping me (Lit Review time!)

hjek 5y ago

> Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. Per-process Spectre mitigations could be helpful there, but I don't understand the technical details to know whether that would be possible to implement. It would be nice to disable mitigations on a video editor and for gaming.

pjmlp 5y ago
If gaming implies a MMO, a possible attack vector is attacking users to get hold of their gaming account details and do as they please.
- usrusr 5y ago
  The way I understand it (not that well, admittedly), per-process mitigations would be all about keeping that process from reading other memory areas, not about protecting that process from others. Which is better than the reverse if your intention is to allow some processes to run random js.
  - pjmlp 5y ago
    Yeah, but in the context of games, most likely it means threaded code written in C or C++. If anything Spectre has shown us that the only real mitigation is to go back to multiprocessing with IPC, with the extra hardware resources it entails, as the exploit exists regardless of the language for in-process memory.
  - genmud 5y ago
    The problem with spectre/meltdown is they don't use standard calls to ask for memory of other processes... that is the vulnerability. If you were do to do per process mitigation it would need to prevent certain process execution flows from happening, because the vulnerability is a problem with the CPU pulling memory from the way speculative execution works. This actually impacts things that are typically protected and is much more impactful than people think... for example, because the bug allows reading from nearly any memory address space, you could also pull in things like crypto keys from the OS or passwords from memory.

treis 5y ago

I thought the browsers had put in their own mitigations that stop spectre/meltdown attacks.

eloff 5y ago
They tried. The V8 team eventually gave up and said it was unwinnable. What they did do is move tabs to their own process so they can take average of the operating systems protections. Yes you can read the memory of the process hosting the JavaScript, but now there isn't anything interesting in it. Google's security team released a proof of concept attack that can read the memory in the renderer in many systems.
- jacquesm 5y ago
  average -> advantage
  - eloff 5y ago
    Man mobile keyboards suck. Any idiot knows the word average doesn't work there (at minimum you'd have to preface it with the word "the"), so why can't my keyboard run an ML model that's not an idiot?
  - richrichardsson 5y ago
    Didn't even notice until reading this comment! I think my brain said, "starts with an A, got a V near the beginning, ends in AGE, must be ADVANTAGE in this context."

FunnyLookinHat 5y ago

Yeah no disagreement there. I had totally forgotten about the JS POC - ugh! The JavaScript argument is interesting to me in that it's already flawed. I suppose I'd rather focus on the security issues with browsers running code on my computer more than anything else since it's effectively the "but what about ___" answer to so many threads like this one. I've seen a few other comments suggesting per-process rules to enable or disable branch protections. That's an interesting thought, especially considering you could apply it to either "trusted" or "untrusted" code depending on it's source.

fiddlerwoaroof 5y ago
With Arm big.little architectures, it could start making sense to have dedicated in-order cores for running JavaScript and other “untrusted” code. Also, I wonder if disabling mitigations on the desktop and running the browser in a VM with mitigations enabled would be effective.
- saagarjha 5y ago
  People want their websites to load fast, though.

krylon 5y ago

I've never thought about this, but how big are the performance penalties for Spectre mitigations vs not having Javascript JIT? (Just to be clear, I'm perfectly happy with the performance of my old-ish machine, so I have no motivation to disable those mitigations.)