{"id":101262,"date":"2021-09-13T22:22:38","date_gmt":"2021-09-13T20:22:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome"},"modified":"2021-09-13T22:22:38","modified_gmt":"2021-09-13T20:22:38","slug":"novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","title":{"rendered":"Nou\u0103 tehnic\u0103 de exploatare a vulnerabilit\u0103\u021bilor de tip Spectre \u00een Chrome","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la universit\u0103\u021bi din SUA, Australia \u0219i Israel a propus o nou\u0103 tehnic\u0103 de atac prin canale laterale pentru a exploata vulnerabilit\u0103\u021bile din clasa Spectre \u00een browserele bazate pe motorul Chromium. Atacul, care a primit numele de cod Spook.js, permite, prin executarea codului JavaScript, s\u0103 ocoleasc\u0103 mecanismul de izolare a site-urilor \u0219i s\u0103 citeasc\u0103 con\u021binutul \u00eentregului spa\u021biu de adresare al procesului curent, adic\u0103 s\u0103 ob\u021bin\u0103 acces la datele paginilor deschise \u00een alte tab-uri, dar procesate \u00eentr-un singur proces. <\/p>\n

Deoarece Chrome ruleaz\u0103 diferite site-uri \u00een procese separate, posibilitatea de a efectua atacuri practice este limitat\u0103 la serviciile care permit utilizatorilor diferi\u021bi s\u0103-\u0219i plaseze paginile. Metoda permite, de pe pagina \u00een care atacatorul poate \u00eencorpora codul s\u0103u JavaScript, s\u0103 determine existen\u021ba altor pagini deschise de utilizator din acela\u0219i site \u0219i s\u0103 extrag\u0103 informa\u021bii confiden\u021biale din acestea, cum ar fi datele de autentificare sau informa\u021biile bancare introduse de sistemul de autocompletare \u00een formularele web. Ca demonstra\u021bie, s-a ar\u0103tat cum se poate ataca un blog str\u0103in pe serviciul Tumblr, dac\u0103 proprietarul s\u0103u deschide \u00eentr-un alt tab blogul atacatorului, g\u0103zduit \u00een acela\u0219i serviciu.

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

O alt\u0103 variant\u0103 de aplicare a metodei este atacul asupra extensiilor de browser, care permite, la instalarea unei extensii controlate de atacatori, extragerea de date din alte extensii. Ca exemplu, s-a demonstrat cum, instal\u00e2nd o extensie mali\u021bioas\u0103, se pot extrage informa\u021bii confiden\u021biale din managerul de parole LastPass.

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

Cercet\u0103torii au publicat un prototip de exploit care func\u021bioneaz\u0103 \u00een Chrome 89 pe sisteme cu CPU Intel i7-6700K \u0219i i7-7600U. La crearea exploit-ului au fost folosite prototipuri de cod JavaScript anterior publicate de compania Google pentru atacurile din clasa Spectre. Se men\u021bioneaz\u0103 c\u0103 cercet\u0103torilor le-a reu\u0219it s\u0103 preg\u0103teasc\u0103 exploit-uri func\u021bionale pentru sistemele bazate pe procesoare Intel \u0219i Apple M1, care permit organizarea citirii memoriei cu o vitez\u0103 de 500 de bi\u021bi pe secund\u0103 \u0219i o precizie de 96%. Se estimeaz\u0103 c\u0103 metoda este aplicabil\u0103 \u0219i pentru procesoarele AMD, dar nu s-a reu\u0219it preg\u0103tirea complet func\u021bional\u0103 a unui exploit. <\/p>\n

Atacul este aplicabil oric\u0103ror browsere bazate pe motorul Chromium, inclusiv Google Chrome, Microsoft Edge \u0219i Brave. Cercet\u0103torii consider\u0103, de asemenea, c\u0103 metoda poate fi adaptat\u0103 pentru a func\u021biona cu Firefox, dar din moment ce motorul Firefox difer\u0103 semnificativ de Chrome, lucr\u0103rile pentru crearea unui exploat similar au fost l\u0103sate pentru viitor. <\/p>\n

Pentru a proteja \u00eempotriva atacurilor realizate prin intermediul browser-ului care sunt legate de executarea speculativ\u0103 a instruc\u021biunilor, Chrome a implementat segmentarea spa\u021biului de adresare \u2014 izolarea sandbox permite rularea JavaScript-ului doar cu indicatoare pe 32 de bi\u021bi \u0219i \u00eemparte memoria handler-ilor \u00een heapuri neintersectate de 4GB. Pentru a organiza accesul la \u00eentregul spa\u021biu de adresare al procesului \u0219i a ocoli limitarea de 32 de bi\u021bi, cercet\u0103torii au utilizat tehnica Type Confusion, care permite for\u021barea motorului JavaScript s\u0103 proceseze un obiect cu un tip gre\u0219it, ceea ce deschide posibilitatea de a forma un indicator pe 64 de bi\u021bi bazat pe combina\u021bia a dou\u0103 valori pe 32 de bi\u021bi. <\/p>\n

Esenta atacului const\u0103 \u00een faptul c\u0103, \u00een timpul proces\u0103rii unui obiect mali\u021bios special conceput \u00een motorul JavaScript, se creeaz\u0103 condi\u021bii care duc la executarea speculativ\u0103 a instruc\u021biunilor care acceseaz\u0103 un array. Obiectul este selectat astfel \u00eenc\u00e2t c\u00e2mpurile controlate de atacatori s\u0103 fie plasate \u00eentr-o zon\u0103 \u00een care este utilizat un indicator pe 64 de bi\u021bi. Deoarece tipul obiectului mali\u021bios nu corespunde tipului array-ului procesat, \u00een condi\u021biile normale, astfel de ac\u021biuni sunt blocate \u00een Chrome de mecanismul de deoptimizare a codului, aplicat pentru accesul la array-uri. Pentru a rezolva aceast\u0103 problem\u0103, codul pentru atacul Type Confusion este mutat \u00eentr-un bloc condi\u021bional 'if', care nu se activeaz\u0103 \u00een condi\u021bii normale, dar se execut\u0103 \u00een mod speculativ, \u00een cazul unei predic\u021bii gre\u0219ite a ramific\u0103rii de c\u0103tre procesor. <\/p>\n

\u00cen final, procesorul acceseaz\u0103 speculativ un pointer de 64 de bi\u021bi generat \u0219i \u00ee\u0219i revine dup\u0103 ce determin\u0103 o prognoz\u0103 e\u0219uat\u0103, dar urmele execu\u021biei r\u0103m\u00e2n \u00een cache-ul general \u0219i pot fi recuperate prin metode de determinare a con\u021binutului cache-ului prin canale externe, care analizeaz\u0103 modific\u0103rile timpului de acces pentru datele pe care le are \u00een cache \u0219i cele care nu sunt \u00een cache. Pentru analiza con\u021binutului cache-ului \u00een condi\u021biile unei precizii insuficiente a temporizatorului disponibil \u00een JavaScript, se aplic\u0103 metoda propus\u0103 de Google, care p\u0103c\u0103le\u0219te strategia de \u00eenlocuire a datelor din cache Tree-PLRU folosit\u0103 \u00een procesoare \u0219i permite, prin cre\u0219terea num\u0103rului de cicluri, s\u0103 se augmenteze semnificativ diferen\u021ba de timp \u00eentre prezen\u021ba \u0219i absen\u021ba valorii \u00een cache.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445, \u0430\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0445 \u0438 \u0438\u0437\u0440\u0430\u0438\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0434\u0432\u0438\u0436\u043a\u0430 Chromium. \u0410\u0442\u0430\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Spook.js, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u043f\u0443\u0441\u043a JavaScript-\u043a\u043e\u0434\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0432\u0441\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0442.\u0435. \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101262","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Noua tehnic\u0103 de exploatare a vulnerabilit\u0103\u021bilor din clasa Spectre \u00een Chrome | ProHoster","description":"Un grup de cercet\u0103tori de la universit\u0103\u021bi din Statele Unite, Australia \u0219i Israel a propus o nou\u0103 tehnic\u0103 de atac prin canale externe pentru a exploata vulnerabilit\u0103\u021bile din clasa Spectre \u00een browserele bazate pe motorul Chromium.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 Chrome | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445, \u0430\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0445 \u0438 \u0438\u0437\u0440\u0430\u0438\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0434\u0432\u0438\u0436\u043a\u0430 Chromium.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-13T20:22:38+00:00","article:modified_time":"2021-09-13T20:22:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101262","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-13 21:00:47","updated":"2022-10-04 03:17:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101262"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101262\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}