5 ms·

Is there any evidence of anyone actually attempting such an attack outside a carefully controlled research scenario? The number of stars that have to align for

Is there any evidence of anyone actually attempting such an attack outside a carefully controlled research scenario? The number of stars that have to align for this theoretical attack to work in practice is so high that I don't think any normal desktop end-user has reason to worry about it. (Shared servers, co-hosted VMs, etc are a different story.)

garaetjjte 4y ago
I think there might be herd immunity effect to that: because mitigations are enabled by default, there isn't much focus for developing attacks for it.
totony 4y ago
Browser lowered timer resolution to mitigate most speculative execution attacks. Probably why there aren't useful exploits. I remember a js payload when the first spectre appeared.
Veliladon 4y ago
True there isn't at the moment but do you really want to be the first to find out because you left the back door open?
- renewiltord 4y ago
  I am going to tell you guys something magical. There are multiple hundreds of millions of cryptocurrency running on hardware with spectre/meltdown mitigations off. Go get them.
- coldpie 4y ago
  I'd liken it to refusing to leave your house because you're worried a meteor may strike you down. You're giving up a lot for not much reason.
  - staticassertion 4y ago
    Not quite. A meteor is an object with no drive or desire. Attackers are adversarial and thoughtful. You can't liken a random event to a purposeful act like this. It's more like saying "refusing to leave your house because you're worried you might get mugged", which might actually be very reasonable if you live in a bad neighborhood, you're a common target of crime, etc. It may not be reasonable for many others. But analogies are pretty rough in general.
    - coldpie 4y ago
      No, I think meteor is closer. Mugging is in the realm of possibility, this javascript driveby theoretical attack is wildly implausible. Like, take the time to spell it out: what sequence of events has to occur for this attack to be successfully pulled off?
      - staticassertion 4y ago
        Which attack are you referring to? There have already been POCs for many speculative execution attacks.
        coldpie 4y ago
        Whatever one Veliladon was referring to when they asserted one must run either mitigations or no javascript. My point is those POCs are not sufficient evidence that mitigations with real performance impact are justified for the typical desktop end-user. Again: > The number of stars that have to align for this theoretical attack to work in practice is so high that I don't think any normal desktop end-user has reason to worry about it.
        staticassertion 4y ago
        Oh ok. So, no, the stars don't have to align at all. The attack is straightforward, the POCs show that. The reason we don't see these attacks is because everyone patched the major issues immediately. Further, attackers don't need to really go for these sorts of attacks, there are more reliable, well-worn methods for attacking browsers.

garaetjjte 4y ago

I think there might be herd immunity effect to that: because mitigations are enabled by default, there isn't much focus for developing attacks for it.

totony 4y ago

Browser lowered timer resolution to mitigate most speculative execution attacks. Probably why there aren't useful exploits. I remember a js payload when the first spectre appeared.

Veliladon 4y ago

True there isn't at the moment but do you really want to be the first to find out because you left the back door open?

renewiltord 4y ago
I am going to tell you guys something magical. There are multiple hundreds of millions of cryptocurrency running on hardware with spectre/meltdown mitigations off. Go get them.
coldpie 4y ago
I'd liken it to refusing to leave your house because you're worried a meteor may strike you down. You're giving up a lot for not much reason.
- staticassertion 4y ago
  Not quite. A meteor is an object with no drive or desire. Attackers are adversarial and thoughtful. You can't liken a random event to a purposeful act like this. It's more like saying "refusing to leave your house because you're worried you might get mugged", which might actually be very reasonable if you live in a bad neighborhood, you're a common target of crime, etc. It may not be reasonable for many others. But analogies are pretty rough in general.
  - coldpie 4y ago
    No, I think meteor is closer. Mugging is in the realm of possibility, this javascript driveby theoretical attack is wildly implausible. Like, take the time to spell it out: what sequence of events has to occur for this attack to be successfully pulled off?
    - staticassertion 4y ago
      Which attack are you referring to? There have already been POCs for many speculative execution attacks.
      - coldpie 4y ago
        Whatever one Veliladon was referring to when they asserted one must run either mitigations or no javascript. My point is those POCs are not sufficient evidence that mitigations with real performance impact are justified for the typical desktop end-user. Again: > The number of stars that have to align for this theoretical attack to work in practice is so high that I don't think any normal desktop end-user has reason to worry about it.
        staticassertion 4y ago
        Oh ok. So, no, the stars don't have to align at all. The attack is straightforward, the POCs show that. The reason we don't see these attacks is because everyone patched the major issues immediately. Further, attackers don't need to really go for these sorts of attacks, there are more reliable, well-worn methods for attacking browsers.