Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>The original attacks worked in javascript that could be delivered by a browser to your single-user PC

no they didnt, otherwise there would be a demo page you could use right now to check if you are susceptible



Yes they did. Here is one such demo: https://leaky.page/


I have never patched even once 2018 install of win10 running chrome on intel Haswell, this demo fails to do anything.


That specific PoC page relied on performance.now() https://github.com/google/security-research-pocs/blob/d10780...

Chrome has limited "performance.now" to have a relatively low resolution: https://chromium-review.googlesource.com/c/chromium/src/+/85...

Also, "2018 install of win10", you might have already been patched during install. The chrome patch was Jan 2018.

Microsoft also rolled out their first specture/meltdown mitigations at the OS level in January 2018.


The associated March 2021 blog post mentioned implementing multiple PoCs abusing different timers; the one chosen was verified "on Chrome 88 on an Intel Skylake CPU", which was released January 2021.

A cursory search did not find what further mitigations have been implemented since 2021.


So in the end it turns out there doesnt exist "a demo page you could use right now to check if you are susceptible" after all because browsers removed attack surface (precise timers).


> So in the end it turns out there doesnt exist "a demo page you could use right now to check if you are susceptible" after all because browsers removed attack surface

The original claim you made was "[the original attacks] didn't [work in javascript], otherwise there would be a demo page".

We have shown you such a page. You are not susceptible to that original attack anymore. Congrats. Isn't that all you were asking for? How have we not proven exactly that exists?

We haven't shown you that you are still presently susceptible to anything of course, but that's not what you were claiming.

And it's of course impossible to prove that you are not susceptible to any bug whatsoever, though I don't think many people would be surprised if there were still sources of accurate timing left in the browser


The linked page is not js, its js deferring actual attack to wasm. It doesnt work on 2018 system despite the demo being released in 2021.


Your browser will run WebAssembly about as happily as it will run JavaScript. What's the distinction here?


    delete WebAssembly
uBlock can inject this to every webpage you visit. The distinction is you can disable WebAssembly and >99.99% of the web will run like nothing happened.


In March 2021 Google released proof of concept for something patched since 4 years?


Browsers have since added their own mitigations. Chrome has certainly come up with their own set of mitigations [0].

Nonetheless, a lot of hardware still remains unpatched and vulnerable. Do you install games? Do you install mods to your games? Do you fully trust every game author and mod author? Pro tip: you shouldn't; games can do it even easier. Don't do your business or finances on your gaming PC.

[0]: https://developer.chrome.com/blog/meltdown-spectre/


Games don’t run in a sandbox, they can already access all user data as is.


Mods might be sandboxed though - for instance by only allowing mods via a built in script interpreter.


some games have anti-cheat softeare that runs in admin mode 24/7


Like, super mega admin mode -- many run in the kernel nowadays!


Out of curiosity is it also using a circa-2018 chrome install? There have been mitigations pushed to Chrome and V8.


June build Chrome/102.xxx. I just tried 96.xx and

[!] error: could not infer memory layout [] retrying. (2 retries left) [!] error: could not infer memory layout [] retrying. (1 retries left) [!] error: could not infer memory layout [!] no retries left

Btw some parts (maybe whole thing??) uses WebAssembly and not just js.


Wasm is trivially accessible from JavaScript, so it's not unreasonable to conflate the two, even if its technically incorrect. Wasm also can't do anything that JS couldn't already do; it's simply more convenient in many cases (and maybe somewhat faster at runtime) to write code in C/C++/Rust/whatever and compile it to Wasm than to write the code in JS. You could (and still can) compile these languages to asm.js instead, in which case the code would actually be JS, albeit a particularly weird dialect.

The site pretty clearly says it works on Chrome 88, on Linux. Chrome 91 reduced the resolution of performance.now significantly, which likely broke this website (https://developer.chrome.com/blog/cross-origin-isolated-hr-t...). You're also trying this out on Windows, which is also not supported by the demo page in its default configuration.

But also: this was a demo page put together by a random security researcher on their own, based on a vulnerability from a year ago. It's not a reflection of what a motivated attacker could do with a sufficiently powerful exploitation primitive (say, this Retbleed attack).


So are we in agreement that there doesnt exist a _working_ javascript demo/exploit for any of the Spectre attacks?


I can't speak to what that error is but Chrome 96 appears to be from Nov '21 at the earliest which would include a large number of these mitigations.

w.r.t. js vs web asm: I could be wrong but I think V8 is the engine involved with webassembly as well so I'm not sure the wa vs js distinction matters here, but even so my main point is that there were significant software mitigations put into place in the browser. I'd expect reproducing this attack today would be difficult.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: