45 lines
1.9 KiB
Markdown
45 lines
1.9 KiB
Markdown
|
# Meltdown/Spectre and the Web
|
|||
|
|
|
|||
|
|
The recently-released [Meltdown][] and [Spectre][] CPU timing attacks
|
|||
|
|
affect virtually every user in some way;
|
|||
|
|
the consequences are profound.
|
|||
|
|
There are plenty of good write-ups on the topic,
|
|||
|
|
so I don't feel the need to re-iterate the technical details here.
|
|||
|
|
(See an easily digestible one [from the Raspberry Pi][rpi] project, and an
|
|||
|
|
in-depth analysis [from Project Zero][zero].)
|
|||
|
|
|
|||
|
|
[Meltdown]: https://meltdownattack.com/
|
|||
|
|
[Spectre]: https://spectreattack.com/
|
|||
|
|
[rpi]: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/
|
|||
|
|
[zero]: https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
|
|||
|
|
|
|||
|
|
What I do want to draw attention to is that these attacks [are exploitable
|
|||
|
|
via web browsers][mozilla].
|
|||
|
|
|
|||
|
|
[mozilla]: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
|
|||
|
|
|
|||
|
|
<!-- more -->
|
|||
|
|
|
|||
|
|
The reason for this is that your web browser,
|
|||
|
|
by default,
|
|||
|
|
automatically downloads and executes programs without your knowledge or
|
|||
|
|
consent.
|
|||
|
|
Most commonly,
|
|||
|
|
web pages embed software in the form of JavaScript code.
|
|||
|
|
Because of the features available in modern JavaScript environments,
|
|||
|
|
CPU cache timing attacks are possible.
|
|||
|
|
|
|||
|
|
[I spoke about the security issues][lp2016] of running these programs in your web
|
|||
|
|
browser back in 2016---it
|
|||
|
|
was a bad idea then,
|
|||
|
|
and it's still a bad idea now.
|
|||
|
|
[I spoke further of privacy issues][lp2017] last year at LibrePlanet 2017.
|
|||
|
|
I encourage you to use extensions like [NoScript][] to block the execution of
|
|||
|
|
JavaScript by default,
|
|||
|
|
and stop random people from treating your computer as a puppet to do
|
|||
|
|
their own bidding.
|
|||
|
|
|
|||
|
|
[lp2016]: https://media.libreplanet.org/u/libreplanet/collection/restore-online-freedom/
|
|||
|
|
[lp2017]: https://media.libreplanet.org/u/libreplanet/m/the-surreptitious-assault-on-privacy-security-and-freedom/
|
|||
|
|
[NoScript]: http://noscript.net/
|