45 lines
1.9 KiB
Markdown
45 lines
1.9 KiB
Markdown
# Meltdown/Spectre and the Web
|
||
|
||
The recently-released [Meltdown][] and [Spectre][] CPU timing attacks
|
||
affect virtually every user in some way;
|
||
the consequences are profound.
|
||
There are plenty of good write-ups on the topic,
|
||
so I don't feel the need to re-iterate the technical details here.
|
||
(See an easily digestible one [from the Raspberry Pi][rpi] project, and an
|
||
in-depth analysis [from Project Zero][zero].)
|
||
|
||
[Meltdown]: https://meltdownattack.com/
|
||
[Spectre]: https://spectreattack.com/
|
||
[rpi]: https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/
|
||
[zero]: https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
|
||
|
||
What I do want to draw attention to is that these attacks [are exploitable
|
||
via web browsers][mozilla].
|
||
|
||
[mozilla]: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
|
||
|
||
<!-- more -->
|
||
|
||
The reason for this is that your web browser,
|
||
by default,
|
||
automatically downloads and executes programs without your knowledge or
|
||
consent.
|
||
Most commonly,
|
||
web pages embed software in the form of JavaScript code.
|
||
Because of the features available in modern JavaScript environments,
|
||
CPU cache timing attacks are possible.
|
||
|
||
[I spoke about the security issues][lp2016] of running these programs in your web
|
||
browser back in 2016---it
|
||
was a bad idea then,
|
||
and it's still a bad idea now.
|
||
[I spoke further of privacy issues][lp2017] last year at LibrePlanet 2017.
|
||
I encourage you to use extensions like [NoScript][] to block the execution of
|
||
JavaScript by default,
|
||
and stop random people from treating your computer as a puppet to do
|
||
their own bidding.
|
||
|
||
[lp2016]: https://media.libreplanet.org/u/libreplanet/collection/restore-online-freedom/
|
||
[lp2017]: https://media.libreplanet.org/u/libreplanet/m/the-surreptitious-assault-on-privacy-security-and-freedom/
|
||
[NoScript]: http://noscript.net/
|