Hacker News Reader

Comment by lisper | Hacker News Reader

Someone please correct me if I'm wrong, but both spectre and meltdown seem to me to be local root exploits, not remote vulns. They can be used to break out of (say) a VM into the host hypervisor, and thence into other VMs running on the same hardware, but cannot be used to break into a machine from outside its hardware perimeter. Is that right?

View on HN

Essentially yes, the exploits require code running on the machine that’s attacked. However, for example JavaScript runs on the local machine and is a demonstrated attack vector.

It’s also strictly speaking not a privilege escalation, it’s “see things you’re not supposed to.”, such as all sorts of secrets. The attacker does not gain any write or execution privileges, though.

> JavaScript ... is a demonstrated attack vector

OMG, I didn't know that. Thanks.

JS as an attack vector can be effectively mitigated by denying access to high-precision timers (and a few features that can be used to construct high-precision timers). At least Chrome and Firefox are doing this, so just make sure that you are keeping your browser up to date.

If you feel paranoid, you might also want to disable JS by default and only enable by whitelist on any machines that hold particularly sensitive or valuable data.

Keeping JavaScript from constructing high-precision timers is going to be a cat and mouse game.

See the "Fantastic Timers" paper. Link to HN discussion: https://news.ycombinator.com/item?id=16080235

Also: if you don’t have high precision timers, you probably could also go and increase the number of guesses to cancel out noise. After all, this is a statistical side channel attack. This will be fun for quite some time.

Doing that is harder than usual, because the time before rollback is very limited, reducing the amount of cache lines you can pull into the cache and you can measure a given cache line only once.

The attack is already pretty damn slow (1kB/s) in C, if you have to collect a statistically significant sample in JS it might well slow down enough to not really work properly.

It also consumes lots of CPU to scan memory this way, so just be on the lookout for webpages consuming lots of unexpected CPU.

In the age of fancy JavaScript webapps, this seems laughable. 2 or 3 tabs in Chrome is enough to turn my laptop into a space heater.

That describes most websites. I guess noscript might help, but it's a pain to manage the whitelist for that.

Yeah, it's possible to use to bypass same origin policy and read data across origins. Basic idea is that most browsers have multiple origins in the same process, meaning that the same speculative execution + optimistic caching can leak data to js from another origin in the same process.

> JavaScript […] is a demonstrated attack vector

Does that mean that we are soon going to be vulnerable to remote exploits via WASM as well? Do mitigation attempts such as reducing the JavaScript timing resolution aslo apply to WASM?

They do apply to WASM. However, these mitigations are hardly air tight. I'd expect new exploits anyways.

All that these mitigations did was disable all obvious precise timers. All you need for a new attack is a novel way to create a precise timer. And since it’s now known how valueable such a timer would be, I’m certain that minds more clever than me will take a shot at this.

If one of the secrets you see is the contents of a buffer containing a password, it might then be a privilege escalation.

Yes, but arbitrary code execution exploits are some of the most commonly found. If your system interacts with the outside world, or is a multi user system, I would consider it prudent to protect against both Meltdown and other Spectre class exploits whenever possible.

My understanding is that they require execution on the machine and even systems like node are vulnerable(https://react-etc.net/page/javascript-spectre-meltdown-faq) The big issues is that this is really hard to detect because it blends with what would be normal code patterns. I have read that AV will have trouble with this in heuristics but may pick up on specific strains of code that utilize it. Plus this is a whole new class of vulnerability that people have not thought about yet, it will be interesting, can I make your server do X to expose this(think Heartbleed)

Reply on news.ycombinator.com