4 ms·

Maybe a stupid question... For user machines running JavaScript in the browser is the most common case of running untrusted code. Since 2018 when Spectre becam

Maybe a stupid question... For user machines running JavaScript in the browser is the most common case of running untrusted code. Since 2018 when Spectre became public, has a single JavaScript program become public that exploits Spectre (whatever variant)? Unpatched user machines exist proably all the time. For the cloud where your neigbors might run whatever (bad) they come up with is this just a simple Linux vulnerability? (Or HW vulnerability Linux did not work-around well enough) Wouldn't you alway need to attack the hypervisor? Of course, that might be Linux, too. Has there been any piece of software published that just reads your neighbors memory? Of course major cloud providers patch at disclusure, but I'm sure there are smaller ones where it can take a long time. If yes, how could I miss that? If no, Linus hasn't been that wrong that the attacks are not feasible. Unless one assumes the NSA has been running them since 2018.

userbinator 4y ago
Yes, JS demos existed, but the usefulness of the data you can extract was limited. Making sense of the extracted data has always been the difficult part, as even if you manage to find a key and can recognise it as such, you still need to know what it's securing and also have access to do anything more.
zdragnar 4y ago
Google had a decent writeup and proof of concept for leaking via JavaScript: https://security.googleblog.com/2021/03/a-spectre-proof-of-concept-for-spectre.html https://security.googleblog.com/2021/03/a-spectre-proof-of-c... As for clouds, "retpoline" is (was?) a common measure taken against spectre v2, as seen in this fairly old post: https://cloud.google.com/blog/topics/inside-google-cloud/answering-your-questions-about-meltdown-and-spectre https://cloud.google.com/blog/topics/inside-google-cloud/ans... What retbleed means for this is anyone's guess, but I'd hazard a thought that it's not great.
- deleted 4y ago
  [deleted]

userbinator 4y ago

Yes, JS demos existed, but the usefulness of the data you can extract was limited. Making sense of the extracted data has always been the difficult part, as even if you manage to find a key and can recognise it as such, you still need to know what it's securing and also have access to do anything more.

zdragnar 4y ago

Google had a decent writeup and proof of concept for leaking via JavaScript: https://security.googleblog.com/2021/03/a-spectre-proof-of-concept-for-spectre.html https://security.googleblog.com/2021/03/a-spectre-proof-of-c... As for clouds, "retpoline" is (was?) a common measure taken against spectre v2, as seen in this fairly old post: https://cloud.google.com/blog/topics/inside-google-cloud/answering-your-questions-about-meltdown-and-spectre https://cloud.google.com/blog/topics/inside-google-cloud/ans... What retbleed means for this is anyone's guess, but I'd hazard a thought that it's not great.

deleted 4y ago
[deleted]