A group of researchers from American, Australian, and Israeli universities has proposed a new side-channel attack technique to exploit Spectre-class vulnerabilities in browsers based on the Chromium engine. The attack, codenamed Spook.js, allows an attacker to bypass site isolation mechanisms through the execution of JavaScript code, enabling access to the entire address space of the current process. This means that data from pages opened in other tabs, but processed in the same process, can be read.
Since Chrome runs different sites in different processes, the potential for practical attacks is limited to services that allow different users to host their pages. This method enables an attacker to determine the presence of other pages that the user has open from the same site, from a page where they can embed their JavaScript code, and extract confidential information such as credentials or banking details auto-filled by the form-filling system. As a demonstration, it shows how one could attack someone else's blog on Tumblr if its owner opens an attacker’s blog in another tab hosted on the same service.
Another application of this method involves attacks on browser extensions, allowing an attacker-controlled extension to extract data from other extensions upon installation. As an example, it demonstrates how, by installing a malicious extension, one can retrieve sensitive information from the LastPass password manager.
Researchers have released a prototype exploit that works in Chrome 89 on systems with Intel i7-6700K and i7-7600U CPUs. The exploit was developed using previously published JavaScript code prototypes from Google for conducting Spectre-class attacks. It is noted that the researchers managed to prepare working exploits for systems based on Intel and Apple M1 processors, allowing memory reading at a speed of 500 bytes per second with 96% accuracy. It is assumed that the method is also applicable to AMD processors, but a fully functional exploit could not be prepared.
The attack is applicable to any browsers based on the Chromium engine, including Google Chrome, Microsoft Edge, and Brave. Researchers also believe that the method can be adapted to work with Firefox, but since the Firefox engine is significantly different from Chrome, work on creating a similar exploit has been left for the future.
To protect against browser attacks related to speculative execution of instructions, Chrome has implemented address space segmentation — sandbox isolation allows JavaScript to work only with 32-bit pointers and separates handler memory into non-overlapping 4GB heaps. To gain access to the entire address space of the process and bypass the 32-bit limitation, researchers utilized a technique called Type Confusion, which forces the JavaScript engine to process an object with an incorrect type, allowing for the formation of a 64-bit pointer based on a combination of two 32-bit values.
The essence of the attack is that when processing a specially crafted malicious object in the JavaScript engine, conditions are created that lead to speculative execution of instructions accessing an array. The object is crafted in such a way that the fields controlled by attackers are placed in a region that uses a 64-bit pointer. Since the type of the malicious object does not match the type of the processed array, such actions are usually blocked in Chrome by the code deoptimization mechanism used for array access. To address this issue, the code for the Type Confusion attack is moved into a conditional 'if' block that is not activated under normal conditions, but is executed in speculative mode when the processor incorrectly predicts the next branch.
As a result, the processor speculatively accesses the formed 64-bit pointer and rolls back the state after determining an unsuccessful prediction, but the execution traces remain in the shared cache and can be recovered using cache content determination methods through side channels that analyze the change in access times to cached and uncached data. To analyze cache contents under the insufficient accuracy of the timer available in JavaScript, Google proposed a method that deceives the cache eviction strategy used in processors, Tree-PLRU, allowing for a significant increase in the time difference when a value is present in the cache versus when it is not.
Source: opennet.ru
