{"id":101262,"date":"2021-09-13T22:22:38","date_gmt":"2021-09-13T20:22:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome"},"modified":"2021-09-13T22:22:38","modified_gmt":"2021-09-13T20:22:38","slug":"novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","title":{"rendered":"Nov\u00e1 technika exploatace zranitelnost\u00ed t\u0159\u00eddy Spectre v Chromu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z americk\u00fdch, australsk\u00fdch a izraelsk\u00fdch univerzit navrhla novou techniku \u00fatoku pomoc\u00ed bo\u010dn\u00edch kan\u00e1l\u016f pro zneu\u017eit\u00ed zranitelnost\u00ed t\u0159\u00eddy Spectre v prohl\u00ed\u017ee\u010d\u00edch zalo\u017een\u00fdch na enginu Chromium. \u00datok, kter\u00fd dostal k\u00f3dov\u00e9 jm\u00e9no Spook.js, umo\u017e\u0148uje prost\u0159ednictv\u00edm spu\u0161t\u011bn\u00ed JavaScriptov\u00e9ho k\u00f3du obej\u00edt mechanismus izolace str\u00e1nek a p\u0159e\u010d\u00edst obsah cel\u00e9ho adresn\u00edho prostoru aktu\u00e1ln\u00edho procesu, tedy z\u00edskat p\u0159\u00edstup k dat\u016fm str\u00e1nek spu\u0161t\u011bn\u00fdch v jin\u00fdch z\u00e1lo\u017ek\u00e1ch, ale zpracov\u00e1van\u00fdch v jednom procesu. <\/p>\n

Jeliko\u017e Chrome spou\u0161t\u00ed r\u016fzn\u00e9 str\u00e1nky v r\u016fzn\u00fdch procesech, je mo\u017enost prov\u00e1d\u011bn\u00ed praktick\u00fdch \u00fatok\u016f omezen\u00e1 slu\u017ebami, kter\u00e9 umo\u017e\u0148uj\u00ed r\u016fzn\u00fdm u\u017eivatel\u016fm umis\u0165ovat sv\u00e9 str\u00e1nky. Metoda umo\u017e\u0148uje ze str\u00e1nky, do kter\u00e9 m\u00e1 \u00fato\u010dn\u00edk mo\u017enost vlo\u017eit sv\u016fj JavaScriptov\u00fd k\u00f3d, zjistit p\u0159\u00edtomnost dal\u0161\u00edch otev\u0159en\u00fdch str\u00e1nek u\u017eivatele ze stejn\u00e9ho webu a extrahovat z nich citliv\u00e9 informace, nap\u0159\u00edklad p\u0159ihla\u0161ovac\u00ed \u00fadaje nebo bankovn\u00ed \u00fadaje, kter\u00e9 do syst\u00e9mu automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed pol\u00ed vypl\u0148uje syst\u00e9m. Jako demonstrace bylo uk\u00e1z\u00e1no, jak lze c\u00edlit na ciz\u00ed blog na platform\u011b Tumblr, pokud jeho vlastn\u00edk otev\u0159e v jin\u00e9 z\u00e1lo\u017ece blog \u00fato\u010dn\u00edk\u016f, um\u00edst\u011bn\u00fd na t\u00e9\u017ee platform\u011b.

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Dal\u0161\u00ed variantou pou\u017eit\u00ed metody je \u00fatok na roz\u0161\u00ed\u0159en\u00ed prohl\u00ed\u017ee\u010de, kter\u00fd umo\u017e\u0148uje p\u0159i instalaci roz\u0161\u00ed\u0159en\u00ed, kter\u00e9 je pod kontrolou \u00fato\u010dn\u00edk\u016f, z\u00edskat data z jin\u00fdch roz\u0161\u00ed\u0159en\u00ed. Jako p\u0159\u00edklad bylo uk\u00e1z\u00e1no, jak lze po nainstalov\u00e1n\u00ed \u0161kodliv\u00e9ho roz\u0161\u00ed\u0159en\u00ed extrahovat citliv\u00e9 informace z \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 hesel LastPass.

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

V\u00fdzkumn\u00edci zve\u0159ejnili prototyp exploit\u016f, kter\u00fd funguje v Chrome 89 na syst\u00e9mech s CPU Intel i7-6700K a i7-7600U. P\u0159i vytv\u00e1\u0159en\u00ed exploitu byly pou\u017eity d\u0159\u00edve zve\u0159ejn\u011bn\u00e9 prototypy JavaScriptov\u00e9ho k\u00f3du od spole\u010dnosti Google pro prov\u00e1d\u011bn\u00ed \u00fatok\u016f t\u0159\u00eddy Spectre. Uv\u00e1d\u00ed se, \u017ee v\u00fdzkumn\u00edk\u016fm se poda\u0159ilo p\u0159ipravit funk\u010dn\u00ed exploity pro syst\u00e9my zalo\u017een\u00e9 na procesorech Intel a Apple M1, kter\u00e9 umo\u017e\u0148uj\u00ed organizovat \u010dten\u00ed pam\u011bti rychlost\u00ed 500 bajt\u016f za sekundu a s p\u0159esnost\u00ed 96 %. P\u0159edpokl\u00e1d\u00e1 se, \u017ee metoda je pou\u017eiteln\u00e1 i pro procesory AMD, ale pln\u011b funk\u010dn\u00ed exploit se p\u0159ipravit nepoda\u0159ilo. <\/p>\n

\u00datok je pou\u017eiteln\u00fd na jak\u00e9koliv prohl\u00ed\u017ee\u010de zalo\u017een\u00e9 na enginu Chromium, v\u010detn\u011b Google Chrome, Microsoft Edge a Brave. V\u00fdzkumn\u00edci tak\u00e9 v\u011b\u0159\u00ed, \u017ee metodu lze p\u0159izp\u016fsobit pro Firefox, ale proto\u017ee se engine Firefox v\u00fdrazn\u011b li\u0161\u00ed od Chrome, pr\u00e1ce na vytvo\u0159en\u00ed podobn\u00e9ho exploitu byla odlo\u017eena na pozd\u011bji. <\/p>\n

Pro ochranu p\u0159ed \u00fatoky prov\u00e1d\u011bn\u00fdmi prost\u0159ednictv\u00edm prohl\u00ed\u017ee\u010de, kter\u00e9 souvisej\u00ed se spekulativn\u00edm vykon\u00e1v\u00e1n\u00edm instrukc\u00ed, bylo v Chromu implementov\u00e1no segmentov\u00e1n\u00ed adresn\u00edho prostoru \u2014 sandboxov\u00e1 izolace umo\u017e\u0148uje JavaScriptu pracovat pouze s 32bitov\u00fdmi ukazateli a odd\u011bluje pam\u011b\u0165 procesor\u016f do nep\u0159ekr\u00fdvaj\u00edc\u00edch se 4GB hald (heap). Aby byl zaji\u0161t\u011bn p\u0159\u00edstup do cel\u00e9ho adresn\u00edho prostoru procesu a obch\u00e1zelo se 32bitov\u00e9 omezen\u00ed, v\u00fdzkumn\u00edci pou\u017eili techniku typu Type Confusion, kter\u00e1 nut\u00ed JavaScriptov\u00fd engine zpracovat objekt s nespr\u00e1vn\u00fdm typem, co\u017e umo\u017e\u0148uje vytvo\u0159it 64bitov\u00fd ukazatel na z\u00e1klad\u011b kombinace dvou 32bitov\u00fdch hodnot. <\/p>\n

Podstatou \u00fatoku je to, \u017ee p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00e9ho \u0161kodliv\u00e9ho objektu v JavaScriptov\u00e9m enginu se vytv\u00e1\u0159ej\u00ed podm\u00ednky vedouc\u00ed k spekulativn\u00edmu vykon\u00e1v\u00e1n\u00ed instrukc\u00ed, kter\u00e9 z\u00edsk\u00e1vaj\u00ed p\u0159\u00edstup k poli. Objekt je vyb\u00edr\u00e1n tak, \u017ee pole ovl\u00e1dan\u00e1 \u00fato\u010dn\u00edky se nach\u00e1z\u00ed v oblasti, kde se pou\u017e\u00edv\u00e1 64bitov\u00fd ukazatel. Proto\u017ee typ \u0161kodliv\u00e9ho objektu neodpov\u00edd\u00e1 typu zpracov\u00e1van\u00e9ho pole, v norm\u00e1ln\u00edch podm\u00ednk\u00e1ch jsou podobn\u00e9 akce blokov\u00e1ny v Chromu mechanismem deoptimalizace k\u00f3du, kter\u00fd se pou\u017e\u00edv\u00e1 pro p\u0159\u00edstup k pol\u00edm. Aby se tato situace vy\u0159e\u0161ila, je k\u00f3d pro \u00fatok typu Type Confusion um\u00edst\u011bn do podm\u00edn\u011bn\u00e9ho bloku 'if', kter\u00fd nen\u00ed aktivov\u00e1n za norm\u00e1ln\u00edch podm\u00ednek, ale prov\u00e1d\u00ed se ve spekulativn\u00edm re\u017eimu p\u0159i nespr\u00e1vn\u00e9 predikci procesoru dal\u0161\u00edho v\u011btven\u00ed. <\/p>\n

Processor spekulativn\u011b p\u0159istupuje k vytvo\u0159en\u00e9mu 64-bitov\u00e9mu ukazateli a obnovuje stav pot\u00e9, co je ur\u010den ne\u00fasp\u011b\u0161n\u00fd odhad. Nicm\u00e9n\u011b stopy vykon\u00e1v\u00e1n\u00ed z\u016fst\u00e1vaj\u00ed v sd\u00edlen\u00e9 cache a mohou b\u00fdt obnoveny pomoc\u00ed metod ur\u010dov\u00e1n\u00ed obsahu cache prost\u0159ednictv\u00edm bo\u010dn\u00edch kan\u00e1l\u016f, kter\u00e9 analyzuj\u00ed zm\u011bny \u010dasu p\u0159\u00edstupu k ulo\u017een\u00fdm a neulo\u017een\u00fdm dat\u016fm. Pro anal\u00fdzu obsahu cache v podm\u00ednk\u00e1ch nedostate\u010dn\u00e9 p\u0159esnosti \u010dasova\u010de dostupn\u00e9ho v JavaScriptu se pou\u017e\u00edv\u00e1 Googlem navr\u017een\u00e1 metoda, kter\u00e1 obch\u00e1z\u00ed strategii vy\u0159azov\u00e1n\u00ed dat z cache Tree-PLRU a umo\u017e\u0148uje v\u00fdrazn\u011b zv\u00fd\u0161it rozd\u00edl v \u010dase mezi p\u0159\u00edtomnost\u00ed a nep\u0159\u00edtomnost\u00ed hodnoty v cache d\u00edky zv\u00fd\u0161en\u00ed po\u010dtu cykl\u016f.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445, \u0430\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0445 \u0438 \u0438\u0437\u0440\u0430\u0438\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0434\u0432\u0438\u0436\u043a\u0430 Chromium. \u0410\u0442\u0430\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Spook.js, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u043f\u0443\u0441\u043a JavaScript-\u043a\u043e\u0434\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0432\u0441\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0442.\u0435. \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101262","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nov\u00e1 technika vyu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed t\u0159\u00eddy Spectre v Chrome | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z americk\u00fdch, australsk\u00fdch a izraelsk\u00fdch univerzit p\u0159edstavila novou techniku \u00fatoku bo\u010dn\u00edmi kan\u00e1ly pro vyu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed t\u0159\u00eddy Spectre v prohl\u00ed\u017ee\u010d\u00edch zalo\u017een\u00fdch na enginu Chromium.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 Chrome | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445, \u0430\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0445 \u0438 \u0438\u0437\u0440\u0430\u0438\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0434\u0432\u0438\u0436\u043a\u0430 Chromium.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-13T20:22:38+00:00","article:modified_time":"2021-09-13T20:22:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101262","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-13 21:00:47","updated":"2022-10-04 03:17:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101262"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101262\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}