How a researcher hacked his own computer and found 'worst' chip flaw

Re:How a researcher hacked his own computer and found 'worst... by seanalltogether on Thursday January 04, 2018 @03:05PM (#16073574)

> “When I saw my private website addresses from Firefox being dumped by the tool I wrote, I was really shocked,” Gruss told Reuters in an email interview, describing how he had unlocked personal data that should be secured.

I wish I knew how to interpret this comment. Did he manage to output his own firefox memory using client side javascript? Or perhaps a local script running in terminal? or is it totally different and hes describing running a process on his own webhost that broke the vm container and printed out other hosted websites ip addresses?

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by gefh on Thursday January 04, 2018 @03:42PM (#16073885)

I'm pretty sure he's running an unprivileged binary on his local machine, that shouldn't be able to see Firefox's memory, but can with this attack. I don't know of any js exploit - this attack relies on specific machine code instructions that would be very difficult to get a js engine to generate.

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by Klathmon on Thursday January 04, 2018 @03:46PM (#16073917)

>I don't know of any js exploit - this attack relies on specific machine code instructions that would be very difficult to get a js engine to generate.

The Spectre paper outlines that this is not only possible to do in javascript, but they included a Proof-of-concept of it working in javascript to read anything from that process's memory.

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by GunlogAlm on Thursday January 04, 2018 @04:07PM (#16074093)

Their proof-of-concept only reads memory from the browser it's running within, right? Violating browser sandboxing, yes, but does that mean it would also (theoretically) be able to access the memory of other programs?

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by Klathmon on Thursday January 04, 2018 @04:13PM (#16074144)

As far as I understand it, the JavaScript PoC only allows you to read memory from the same process. Meaning if all processes are isolated, you can't read anything other than your own tab's memory. However many browsers don't do process isolation, and just about none of them do it completely (Even Chrome won't have mitigations to this that prevent iframes from other origins doing this attack for a week or 2).

And while that alone might seem pretty innocuous, think of things that are kept in memory for a specific tab. This could make XSS attacks able to grab HTTP-Only cookies, or be able to read some autofill data or potentially password autofill information. I don't know enough about the architecture of those things to know if they are kept in the same process, but if they are it's possible.

That being said, I didn't read any specific reason why that JavaScript PoC couldn't be expanded to work on other processes just like the rest of the Spectre attack. And personally I'm assuming it's only a matter of time before it is figured out.

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by trendia on Thursday January 04, 2018 @06:40PM (#16075148)

> Even Chrome won't have mitigations to this that prevent iframes from other origins doing this attack for a week or 2

You can enable (experimental) Chrome process separation here:

chrome://flags/#enable-site-per-process

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by gefh on Thursday January 04, 2018 @07:04PM (#16075303)

Well, shit.

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by rasz on Thursday January 04, 2018 @05:17PM (#16074604)

https://mobile.twitter.com/misc0110/status/94870638749178675...

upper window is firefox

[ Parent | on HN ]

Re:How a researcher hacked his own computer and found 'worst... by cptroot on Thursday January 04, 2018 @07:03PM (#16075300)

Just to be clear, the upper window is a custom GTK app. Theoretically it could be firefox, but that's not what this images is illustrating.

https://twitter.com/misc0110/status/948869631313399809

[ Parent | on HN ]