Re:CPU Backdoors
by TheLoneWolfling on Thursday February 05, 2015 @11:03AM
(#9003891)
If you're really being nasty you can potentially do this even without JS - say, by using CSS layout.
[ Parent
| on HN ]
But can one predict how CSS will look to the CPU? Or do you assume a memcpy will happen at some point, and catch it then?
Re:CPU Backdoors
by TheLoneWolfling on Thursday February 05, 2015 @03:51PM
(#9005980)
memcpy is one route.
But, given that (almost) everyone runs browsers for which the binaries, at least, are avaliable, it's relatively straightforward to come up with something that triggers the vulnerability.
And even if you don't know what browser they are using, you can make guesses. For example - if you have an image that's 102px wide and immediately to the right of an image that's 57px wide, at some point the CPU will probably add 57 and 102. Things like that.