3 ms·
Spectre and meltdown aren’t often used because of the mitigations in modern operating systems. The attacks are complex and the chance of finding a vulnerable ma
by josephg 5y ago
Spectre and meltdown aren’t often used because of the mitigations in modern operating systems. The attacks are complex and the chance of finding a vulnerable machine is low. But if instead windows users were all vulnerable, you bet all sorts of scammy websites would go after these vulnerabilities.
And the attacks are really bad - they can read arbitrary memory. What are the chances another browser tab has a bank website open with active auth cookies, or a valuable email account? Really really high.
- Wowfunhappy 5y ago> And the attacks are really bad - they can read arbitrary memory. But—and please tell me if I’m just totally wrong about this—my understanding was they can read random memory, right? The attacker can’t control what they get. Out of the gigabytes of memory on a system, I’d expect only a handful of bytes to be actually valuable, and only then if certain combinations can be retrieved together.
- josephg 5y agoThe term “Random memory access” is a horribly confusing misnomer from before I was born. It’s used as a contrast with sequential memory access, to mean memory can be accessed in any arbitrary order. My understanding is that these vulnerabilities allow reading the memory at arbitrary mapped pointers, from the perspective of the CPU, in kernel or user space. So you could use the kernel’s data structures to figure out what other programs are mapped, and where, and go read their memory.