treewash

1. You design your CPU so whenever you execute an add instruction with $r1 = x, $r2 = y (say these are the add inputs), the next add instruction will switch to ring-0 mode and run code at address which is the result of the add.

2. You don't need access to the box. You just get the target to load a site with JS that sets x and y to those specfic values and adds them, and then adds zero to some address you want to execute (which you can aim to be shellcode in a JS string or something, but even if not there are a million tricks you can use to execute arbitrary code if you can run code at an arbitrary address).

3. Assuming the JS engine compiles sanely, you now have a way to control any computer and make it do anything via some JS on any web site. Ring-0 can totally bypass all virtualization and even the OS itself.

And this exploit is so simple and powerful that everything else is a waste of time. No need to use statistical and entropy tricks to leak keys. You can own any computer with JS on a web site and steal anything you want from memory, including keys. And you can probably do this without the target noticing anything.

I love the symbolism, where the mountain of cameras obscures the original purpose of having a clearly visible exit sign for safety.

Beautiful.