A Spectre proof-of-concept for a Spectre-proof web
security.googleblog.com
A Spectre proof-of-concept for a Spectre-proof web
1–10 of 33 posts
Re: A Spectre proof-of-concept for a Spectre-proof web
#2If you're just interested in the PoC, it's available here: https://leaky.page/ and looks like the code is at https://github.com/google/security-research-pocs/tree/master...
Re: A Spectre proof-of-concept for a Spectre-proof web
#3> in our tests the attack was successful on several other processors, including the Apple M1 ARM CPU, without any major changes.
Interesting!
Re: A Spectre proof-of-concept for a Spectre-proof web
#4If you're just interested in the PoC, it's available here: https://leaky.page/ and looks like the code is at https://github.com/google/security-research-pocs/tree/master...
I have `mitigations=off` and the PoC didn't work for me on Chrome / i7-3770.
Re: A Spectre proof-of-concept for a Spectre-proof web
#5Re: A Spectre proof-of-concept for a Spectre-proof web
#6If you're just interested in the PoC, it's available here: https://leaky.page/ and looks like the code is at https://github.com/google/security-research-pocs/tree/master...
Tried it in Firefox, but the timing result in the first step was already quite noisy (the two peaks overlapped to about 60%), and the second step didn't complete after 3 minutes of dismissing repeated "a website is slowing the page down" prompts.
That doesn't mean Firefox is safe, to be clear. Just that this PoC doesn't work well for my combination of browser and CPU.
Re: A Spectre proof-of-concept for a Spectre-proof web
#7[deleted]
Re: A Spectre proof-of-concept for a Spectre-proof web
#8If you're just interested in the PoC, it's available here: https://leaky.page/ and looks like the code is at https://github.com/google/security-research-pocs/tree/master...
Tried it in Firefox, but the timing result in the first step was already quite noisy (the two peaks overlapped to about 60%), and the second step didn't complete after 3 minutes of dismissing repeated "a website is slowing the page down" prompts. That doesn't mean Firefox is safe, to be clear. Just that this PoC doesn't work well for my combination of browser and CPU.
It may not work in Firefox due to the restricted resolution of performance.now() there; per the demo page, that is 5μs in desktop Chrome - Firefox meanwhile rounds to the nearest millisecond, per https://developer.mozilla.org/en-US/docs/Web/API/Performance....
That said, the demo also mentions a paper [1] on high-resolution timing channels available in Javascript without needing to rely on the performance API. I don't know how well a Spectre attack relying on such a timing method would fare in any browser.
Looking at that paper's abstract and code samples, I think most if not all of the timing channels it describes rely entirely on tight loops, so one or more of them being attempted would explain the high CPU usage you noticed.
[1] https://pure.tugraz.at/ws/portalfiles/portal/17611474/fantas...
Re: A Spectre proof-of-concept for a Spectre-proof web
#9If you're just interested in the PoC, it's available here: https://leaky.page/ and looks like the code is at https://github.com/google/security-research-pocs/tree/master...
The memory dump demo seemed to work for my computer.
Does that mean I am missing some spectre mitigation stuff? I thought this was already fixed a few years ago? How do I stop this demo from working? (linux, intel i7, chrome 89)
Re: A Spectre proof-of-concept for a Spectre-proof web
#10Really? Their proposed mitigations are various Cross Origin Resource restrictions?
That's the equivalent of saying "just don't run bad JS code". It's not workable. Have they given up?