{"id":101262,"date":"2021-09-13T22:22:38","date_gmt":"2021-09-13T20:22:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome"},"modified":"2021-09-13T22:22:38","modified_gmt":"2021-09-13T20:22:38","slug":"novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","title":{"rendered":"Nov\u00e1 technika vyu\u017e\u00edvania zranite\u013enost\u00ed triedy Spectre v Chrome","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdskumn\u00edkov z americk\u00fdch, austr\u00e1lskych a izraelsk\u00fdch univerz\u00edt navrhla nov\u00fa techniku \u00fatoku cez bo\u010dn\u00e9 kan\u00e1ly na vyu\u017eitie zranite\u013enost\u00ed triedy Spectre v prehliada\u010doch zalo\u017een\u00fdch na eng\u00edne Chromium. \u00datok, ktor\u00fd z\u00edskal k\u00f3dov\u00e9 meno Spook.js, umo\u017e\u0148uje cez spustenie JavaScript k\u00f3du ob\u00eds\u0165 mechanizmus izol\u00e1cie str\u00e1nok a pre\u010d\u00edta\u0165 obsah cel\u00e9ho adresn\u00e9ho priestoru aktu\u00e1lneho procesu, t.j. z\u00edska\u0165 pr\u00edstup k \u00fadajom str\u00e1nok, ktor\u00e9 s\u00fa spusten\u00e9 v in\u00fdch kart\u00e1ch, ale spracov\u00e1van\u00e9 v jednom procese. <\/p>\n

Ke\u010f\u017ee Chrome sp\u00fa\u0161\u0165a r\u00f4zne str\u00e1nky v r\u00f4znych procesoch, mo\u017enos\u0165 uskuto\u010dnia praktick\u00fdch \u00fatokov je obmedzen\u00e1 slu\u017ebami, ktor\u00e9 umo\u017e\u0148uj\u00fa r\u00f4znym pou\u017e\u00edvate\u013eom umiestni\u0165 svoje str\u00e1nky. Met\u00f3da umo\u017e\u0148uje zo str\u00e1nky, do ktorej \u00fato\u010dn\u00edk m\u00e1 mo\u017enos\u0165 vlo\u017ei\u0165 svoj JavaScript k\u00f3d, ur\u010di\u0165 pr\u00edtomnos\u0165 \u010fal\u0161\u00edch str\u00e1nok, ktor\u00e9 pou\u017e\u00edvate\u013e otvoril s tej istej str\u00e1nky, a z\u00edska\u0165 z nich d\u00f4vern\u00e9 inform\u00e1cie, ako napr\u00edklad pou\u017e\u00edvate\u013esk\u00e9 \u00fadaje alebo bankov\u00e9 inform\u00e1cie, ktor\u00e9 s\u00fa automaticky doplnen\u00e9 syst\u00e9mom na webov\u00fdch formul\u00e1roch. Ako uk\u00e1\u017eka bolo predveden\u00e9, ako mo\u017eno napadn\u00fa\u0165 cudz\u00ed blog na slu\u017ebe Tumblr, ak jeho majite\u013e otvor\u00ed v inej karte blog \u00fato\u010dn\u00edkov, umiestnen\u00fd v tej istej slu\u017ebe.

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

\u010eal\u0161ou variantou pou\u017eitia met\u00f3dy je \u00fatok na prehliada\u010dov\u00e9 doplnky, ktor\u00fd umo\u017e\u0148uje pri in\u0161tal\u00e1cii doplnku, ktor\u00fd je pod kontrolou \u00fato\u010dn\u00edkov, z\u00edska\u0165 d\u00e1ta z in\u00fdch doplnkov. Ako pr\u00edklad bolo uk\u00e1zan\u00e9, ako po nain\u0161talovan\u00ed \u0161kodliv\u00e9ho doplnku mo\u017eno z\u00edska\u0165 d\u00f4vern\u00e9 inform\u00e1cie z mana\u017e\u00e9ra hesiel LastPass.

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

V\u00fdskumn\u00edci publikovali prototyp exploit-u, ktor\u00fd funguje v Chrome 89 na syst\u00e9moch s CPU Intel i7-6700K a i7-7600U. Pri vytv\u00e1ran\u00ed exploit-u boli pou\u017eit\u00e9 predt\u00fdm publikovan\u00e9 prototypy JavaScript k\u00f3du spolo\u010dnos\u0165ou Google na uskuto\u010dnenie \u00fatokov triedy Spectre. Uv\u00e1dza sa, \u017ee v\u00fdskumn\u00edkom sa podarilo pripravi\u0165 funk\u010dn\u00e9 exploity pre syst\u00e9my zalo\u017een\u00e9 na procesoroch Intel a Apple M1, ktor\u00e9 umo\u017e\u0148uj\u00fa organizova\u0165 \u010d\u00edtanie pam\u00e4te r\u00fdchlos\u0165ou 500 bajtov za sekundu a presnos\u0165ou 96 %. Predpoklad\u00e1 sa, \u017ee met\u00f3da je pou\u017eite\u013en\u00e1 aj pre procesory AMD, ale plne funk\u010dn\u00fd exploit sa pripravi\u0165 nepodarilo. <\/p>\n

\u00datok je aplikovate\u013en\u00fd na ak\u00e9ko\u013evek prehliada\u010de zalo\u017een\u00e9 na eng\u00edne Chromium, vr\u00e1tane Google Chrome, Microsoft Edge a Brave. V\u00fdskumn\u00edci sa domnievaj\u00fa, \u017ee met\u00f3du je mo\u017en\u00e9 prisp\u00f4sobi\u0165 na pr\u00e1cu s Firefoxom, ale preto\u017ee sa eng\u00edn Firefox v\u00fdrazne l\u00ed\u0161i od Chromu, pr\u00e1ca na vytv\u00e1ran\u00ed podobn\u00e9ho exploit sa odklad\u00e1 na bud\u00facnos\u0165. <\/p>\n

Na ochranu pred \u00fatokmi realizovan\u00fdmi prostredn\u00edctvom prehliada\u010da, ktor\u00e9 s\u00fa spojen\u00e9 so \u0161pekulat\u00edvnym vykon\u00e1van\u00edm in\u0161trukci\u00ed, Chrome implementoval segment\u00e1ciu adresn\u00e9ho priestoru \u2014 sandbox izol\u00e1cia umo\u017e\u0148uje JavaScriptu pracova\u0165 iba s 32-bitov\u00fdmi ukazovate\u013emi a del\u00ed pam\u00e4\u0165 spracovate\u013eov do nes\u00favisl\u00fdch 4GB hrom\u00e1d (heap). Aby sa organizoval pr\u00edstup k cel\u00e9mu adresn\u00e9mu priestoru procesu a obch\u00e1dzali 32-bitov\u00e9 obmedzenie, vedci vyu\u017eili techniku Type Confusion, ktor\u00e1 n\u00fati JavaScriptov\u00fd motor spracova\u0165 objekt s nespr\u00e1vnym typom, \u010do umo\u017e\u0148uje vytvori\u0165 64-bitov\u00fd ukazovate\u013e na z\u00e1klade kombin\u00e1cie dvoch 32-bitov\u00fdch hodn\u00f4t. <\/p>\n

Podstatou \u00fatoku je, \u017ee pri spracovan\u00ed \u0161peci\u00e1lne form\u00e1tovan\u00e9ho \u0161kodliv\u00e9ho objektu v JavaScriptovom engine sa vytv\u00e1raj\u00fa podmienky, ktor\u00e9 ved\u00fa k \u0161pekulat\u00edvnemu vykon\u00e1vaniu in\u0161trukci\u00ed, umo\u017e\u0148uj\u00facich pr\u00edstup k poli. Objekt je vybran\u00fd tak, \u017ee polia ovl\u00e1dan\u00e9 \u00fato\u010dn\u00edkmi s\u00fa umiestnen\u00e9 v oblasti, kde sa pou\u017e\u00edva 64-bitov\u00fd ukazovate\u013e. Ke\u010f\u017ee typ \u0161kodliv\u00e9ho objektu nezodpoved\u00e1 typu spracov\u00e1van\u00e9ho po\u013ea, v norm\u00e1lnych podmienkach s\u00fa tak\u00e9to akcie blokovan\u00e9 v Chrome mechanizmom deoptimaliz\u00e1cie k\u00f3du, ktor\u00fd sa pou\u017e\u00edva na pr\u00edstup k poliam. Na vyrie\u0161enie tohto probl\u00e9mu je k\u00f3d \u00fatoku Type Confusion presunut\u00fd do podmiene\u010dnej blokovej kon\u0161trukcie \u201eif\u201c, ktor\u00e1 sa neaktualizuje za norm\u00e1lnych podmienok, ale vykon\u00e1 sa v \u0161pekulat\u00edvnom re\u017eime, ak procesor nespr\u00e1vne predpoklad\u00e1 \u010fal\u0161ie rozvetvenie. <\/p>\n

Procesor sa v kone\u010dnom d\u00f4sledku \u0161pekulat\u00edvne obracia na vytvoren\u00fd 64-bitov\u00fd ukazovate\u013e a vracia stav po ur\u010den\u00ed ne\u00faspe\u0161nej predpovede, av\u0161ak stopy vykon\u00e1vania zost\u00e1vaj\u00fa v spolo\u010dnej cache a m\u00f4\u017eu by\u0165 obnoven\u00e9 pomocou met\u00f3d zistenia obsahu cache prostredn\u00edctvom ved\u013eaj\u0161\u00edch kan\u00e1lov, ktor\u00e9 analyzuj\u00fa zmenu \u010dasu pr\u00edstupu k vyrovn\u00e1vac\u00edm a nevyrovn\u00e1vac\u00edm d\u00e1tam. Pre anal\u00fdzu obsahu cache za podmienok nedostato\u010dnej presnosti \u010dasova\u010da, ktor\u00fd je dostupn\u00fd v JavaScripte, sa vyu\u017e\u00edva met\u00f3da od Google, ktor\u00e1 klame strat\u00e9giu vyhadzovania d\u00e1t z cache Tree-PLRU v procesoroch a umo\u017e\u0148uje v\u00fdrazne zv\u00fd\u0161i\u0165 rozdiel v \u010dase pri pr\u00edtomnosti a nepr\u00edtomnosti hodnoty v cache zv\u00fd\u0161en\u00edm po\u010dtu cyklov.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445, \u0430\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0445 \u0438 \u0438\u0437\u0440\u0430\u0438\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0434\u0432\u0438\u0436\u043a\u0430 Chromium. \u0410\u0442\u0430\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Spook.js, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u043f\u0443\u0441\u043a JavaScript-\u043a\u043e\u0434\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0432\u0441\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0442.\u0435. \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101262","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nov\u00e1 technika zneu\u017e\u00edvania zranite\u013enost\u00ed triedy Spectre v Chrome | ProHoster","description":"Skupina v\u00fdskumn\u00edkov z americk\u00fdch, austr\u00e1lskych a izraelsk\u00fdch univerz\u00edt navrhla nov\u00fa techniku \u00fatoku cez ved\u013eaj\u0161ie kan\u00e1ly na zneu\u017eitie zranite\u013enost\u00ed triedy Spectre v prehliada\u010doch zalo\u017een\u00fdch na jadre Chromium.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 Chrome | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0445, \u0430\u0432\u0441\u0442\u0440\u0430\u043b\u0438\u0439\u0441\u043a\u0438\u0445 \u0438 \u0438\u0437\u0440\u0430\u0438\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u043e\u0432 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 \u0434\u0432\u0438\u0436\u043a\u0430 Chromium.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/novaya-tehnika-ekspluataczii-uyazvimostej-klassa-spectre-v-chrome","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-13T20:22:38+00:00","article:modified_time":"2021-09-13T20:22:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101262","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-13 21:00:47","updated":"2022-10-04 03:17:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=101262"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101262\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=101262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=101262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=101262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}