2 ms·

The exploit comes from a hacked server, a bad ad, social engineering, etc. As for the attack, imagine a browser that encrypts local storage with a system key.

The exploit comes from a hacked server, a bad ad, social engineering, etc. As for the attack, imagine a browser that encrypts local storage with a system key. If I understand correctly, by storing different patterns of bits, Hertzbleed might be able to extract the system key from the timings to save data. This might sound very theoretical, but modern OS'es (and password managers) have lots of keys like that. There's a good chance one or more of them are reachable from Javascript. And that's just what popped in my mind in two minutes, I'm sure red teams will have better ideas. The scary part is that this is another attack in the same ugly class as Meltdown and Spectre, where the antidote is nearly as damaging as the poison.

lossolo 4y ago
> imagine a browser that encrypts local storage with a system key. If I understand correctly, by storing different patterns of bits, Hertzbleed might be able to extract the system key from the timings to save data. Don't you need precise clocks for this in JS? The ones that were disabled in browsers after Meltdown/Spectre.
- mintplant 4y ago
  A lot of that has since been rolled back as different mitigations have been deployed against Spectre.
  - slimsag 4y ago
    Source? The MDN is very clear about precise timing not being available due to Spectre mitigations.
thepangolino 4y ago
>by storing different patterns of bits, Hertzbleed might be able to extract the system key from the timings to save data. Isn't that practically impossible given the amount of random software running on a regular computer nowadays? This is not based on hdd write speeds but processor timings which are affected by every single cat video you are watching.