Meltdown/Spectre and the Web
The recently-released [Meltdown][] and [Spectre][] CPU timing attacks
affect virtually every user in some way;
the consequences are profound.
There are plenty of good write-ups on the topic,
so I don't feel the need to re-iterate the technical details here.
(See an easily digestible one [from the Raspberry Pi][rpi] project, and an
in-depth analysis [from Project Zero][zero].)
What I do want to draw attention to is that these attacks [are exploitable
via web browsers][mozilla].
The reason for this is that your web browser,
by default,
automatically downloads and executes programs without your knowledge or
consent.
Most commonly,
web pages embed software in the form of JavaScript code.
Because of the features available in modern JavaScript environments,
CPU cache timing attacks are possible.
[I spoke about the security issues][lp2016] of running these programs in your web
browser back in 2016---it
was a bad idea then,
and it's still a bad idea now.
[I spoke further of privacy issues][lp2017] last year at LibrePlanet 2017.
I encourage you to use extensions like [NoScript][] to block the execution of
JavaScript by default,
and stop random people from treating your computer as a puppet to do
their own bidding.
[Meltdown]: https://meltdownattack.com/
[Spectre]: https://spectreattack.com/
[rpi]: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/
[zero]: https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
[mozilla]: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
[lp2016]: https://media.libreplanet.org/u/libreplanet/collection/restore-online-freedom/
[lp2017]: https://media.libreplanet.org/u/libreplanet/m/the-surreptitious-assault-on-privacy-security-and-freedom/
[NoScript]: http://noscript.net/
master
parent
cc0c4fcb58
commit
a985435866
GPG Key ID:
8C917B7F5DC51BA2