{"id":99420,"date":"2021-03-13T16:22:51","date_gmt":"2021-03-13T14:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-prodemonstriroval-ekspluatacziyu-uyazvimostej-spectre-cherez-vypolnenie-javascript-v-brauzere"},"modified":"2021-03-13T16:22:51","modified_gmt":"2021-03-13T14:22:51","slug":"google-prodemonstriroval-ekspluatacziyu-uyazvimostej-spectre-cherez-vypolnenie-javascript-v-brauzere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/google-prodemonstriroval-ekspluatacziyu-uyazvimostej-spectre-cherez-vypolnenie-javascript-v-brauzere","title":{"rendered":"Google demon\u0161troval zneu\u017e\u00edvanie zranite\u013enost\u00ed Spectre prostredn\u00edctvom vykon\u00e1vania JavaScriptu v prehliada\u010di","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Google zverejnila nieko\u013eko prototypov exploitov, ktor\u00e9 ukazuj\u00fa, ako je mo\u017en\u00e9 zneu\u017ei\u0165 zranite\u013enosti triedy Spectre pri vykon\u00e1van\u00ed JavaScriptov\u00e9ho k\u00f3du v prehliada\u010di, a to ob\u00edden\u00edm predt\u00fdm pridan\u00fdch ochrann\u00fdch met\u00f3d. Exploity m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 na z\u00edskanie pr\u00edstupu k pam\u00e4ti procesu, ktor\u00fd spracov\u00e1va webov\u00fd obsah na aktu\u00e1lnej karte. Na testovanie funk\u010dnosti exploitov bol spusten\u00fd web leaky.page a k\u00f3d s popisom logiky fungovania bol umiestnen\u00fd na GitHub. <\/p>\n

Navrhnut\u00fd prototyp je ur\u010den\u00fd na uskuto\u010dnenie \u00fatoku na syst\u00e9my s procesormi Intel Core i7-6500U v prostred\u00ed s Linuxom a Chrome 88. Na pou\u017eitie exploitov pre in\u00e9 prostredia s\u00fa potrebn\u00e9 \u00fapravy. Met\u00f3da zneu\u017eitia nie je \u0161pecifick\u00e1 pre procesory Intel \u2014 po pr\u00edslu\u0161nej adapt\u00e1cii bola potvrden\u00e1 funk\u010dnos\u0165 exploitu na syst\u00e9moch s CPU in\u00fdch v\u00fdrobcov, vr\u00e1tane Apple M1 na b\u00e1ze architekt\u00fary ARM. Po men\u0161\u00edch \u00faprav\u00e1ch je exploit tie\u017e funk\u010dn\u00fd v in\u00fdch opera\u010dn\u00fdch syst\u00e9moch a v in\u00fdch prehliada\u010doch na b\u00e1ze enginu Chromium. <\/p>\n

V prostred\u00ed so \u0161tandardn\u00fdm Chrome 88 a procesormi Intel Skylake sa podarilo dosiahnu\u0165 \u00fanik d\u00e1t z procesu zodpovedaj\u00faceho za spracovanie webov\u00e9ho obsahu na aktu\u00e1lnej karte Chrome (renderer process) r\u00fdchlos\u0165ou 1 kilobajt za sekundu. Okrem toho boli vyvinut\u00e9 alternat\u00edvne prototypy, napr\u00edklad exploit, ktor\u00fd umo\u017e\u0148uje za cenu zn\u00ed\u017eenia stability zv\u00fd\u0161i\u0165 r\u00fdchlos\u0165 \u00faniku na 8kB\/s pri pou\u017eit\u00ed \u010dasova\u010da performance.now() s presnos\u0165ou 5 mikrosek\u00fand (0.005 milisekundy). Pripraven\u00e1 bola aj verzia, ktor\u00e1 pracovala s presnos\u0165ou \u010dasova\u010da na \u00farovni jednej milisekundy, ktor\u00e1 mohla by\u0165 pou\u017eit\u00e1 na organizovanie pr\u00edstupu k pam\u00e4ti in\u00e9ho procesu s r\u00fdchlos\u0165ou pribli\u017ene 60 bajtov za sekundu. <\/p>\n

Zverejnen\u00fd demonstra\u010dn\u00fd k\u00f3d sa sklad\u00e1 z troch \u010dast\u00ed. Prv\u00e1 \u010das\u0165 vykon\u00e1va kalibr\u00e1ciu \u010dasova\u010da na odhad \u010dasu potrebn\u00e9ho na vykonanie oper\u00e1ci\u00ed potrebn\u00fdch na obnovu d\u00e1t, ktor\u00e9 zostali v cache procesora v d\u00f4sledku \u0161pekulat\u00edvneho vykon\u00e1vania in\u0161trukci\u00ed CPU. Druh\u00e1 \u010das\u0165 ur\u010duje rozlo\u017eenie pam\u00e4te pou\u017e\u00edvan\u00e9 pri umiest\u0148ovan\u00ed po\u013ea JavaScript. <\/p>\n

Tretia \u010das\u0165 priamo vykon\u00e1va zneu\u017eitie zranite\u013enosti Spectre na ur\u010denie obsahu pam\u00e4te aktu\u00e1lneho procesu vytvoren\u00edm podmienok na \u0161pekulat\u00edvne vykon\u00e1vanie ur\u010dit\u00fdch oper\u00e1ci\u00ed, ktor\u00fdch v\u00fdsledok procesor odmietne po zisten\u00ed ne\u00faspe\u0161nej predpovede, ale stopy vykon\u00e1vania zost\u00e1vaj\u00fa v spolo\u010dnej cache a m\u00f4\u017eu by\u0165 obnoven\u00e9 pomocou met\u00f3d ur\u010dovania obsahu cache cez bo\u010dn\u00e9 kan\u00e1ly analyzuj\u00facich zmenu \u010dasu pr\u00edstupu k cachovan\u00fdm a necachovan\u00fdm d\u00e1tam. <\/p>\n

Navrhnut\u00e1 technika zneu\u017eitia umo\u017e\u0148uje ob\u00eds\u0165 potrebu ve\u013emi presn\u00fdch \u010dasova\u010dov dostupn\u00fdch cez API performance.now() a bez podpory typu SharedArrayBuffer, ktor\u00fd umo\u017e\u0148uje vytv\u00e1ra\u0165 pole v zdie\u013eanej pam\u00e4ti. Exploit zah\u0155\u0148a gadget Spectre, ktor\u00fd sp\u00fa\u0161\u0165a kontrolovan\u00e9 \u0161pekulat\u00edvne vykon\u00e1vanie k\u00f3du, a analyz\u00e1tor \u00faniku d\u00e1t cez bo\u010dn\u00e9 kan\u00e1ly, ktor\u00fd identifikuje cachovan\u00e9 \u00fadaje z\u00edskan\u00e9 po\u010das \u0161pekulat\u00edvneho vykon\u00e1vania. <\/p>\n

Gadget je implementovan\u00fd prostredn\u00edctvom po\u013ea JavaScript, kde sa pok\u00fa\u0161a o pr\u00edstup do oblasti mimo hran\u00edc bufferu, \u010do vpl\u00fdva na stav bloku predpovedania prechodov kv\u00f4li pridanej kontrole ve\u013ekosti bufferu zo strany kompil\u00e1tora (procesor \u0161pekulat\u00edvne vykon\u00e1va pr\u00edstup, ale vracia stav sp\u00e4\u0165 po kontrole). Na anal\u00fdzu obsahu cache v podmienkach nedostato\u010dnej presnosti \u010dasova\u010da sa navrhuje met\u00f3da, ktor\u00e1 klame strat\u00e9gii odstra\u0148ovania d\u00e1t z cache Tree-PLRU a umo\u017e\u0148uje prostredn\u00edctvom zv\u00fd\u0161enia po\u010dtu cyklov v\u00fdrazne zv\u00fd\u0161i\u0165 \u010dasov\u00fd rozdiel pri z\u00edskavan\u00ed hodnoty z cache a pri absencii hodnoty v cache. <\/p>\n

Upozor\u0148uje sa, \u017ee spolo\u010dnos\u0165 Google zverejnila prototyp exploitu, aby uk\u00e1zala realistickos\u0165 \u00fatokov vyu\u017e\u00edvaj\u00facich zranite\u013enosti triedy Spectre a na povzbudenie webov\u00fdch v\u00fdvoj\u00e1rov k pou\u017e\u00edvaniu techn\u00edk minimalizuj\u00facich rizik\u00e1 z podobn\u00fdch \u00fatokov. Pri tom Google ver\u00ed, \u017ee bez v\u00fdznamnej rev\u00edzie navrhnut\u00e9ho prototypu nie je mo\u017en\u00e9 vytvori\u0165 univerz\u00e1lne exploity pripraven\u00e9 nielen na demon\u0161tr\u00e1ciu, ale aj na \u0161irok\u00e9 vyu\u017eitie. <\/p>\n

Aby sa zn\u00ed\u017eil riziko, sa vlastn\u00edkom webov\u00fdch str\u00e1nok odpor\u00fa\u010da pou\u017e\u00edva\u0165 ned\u00e1vno zaveden\u00e9 hlavi\u010dky Cross-Origin Opener Policy (COOP), Cross-Origin Embedder Policy (COEP), Cross-Origin Resource Policy (CORP), Fetch Metadata Request, X-Frame-Options, X-Content-Type-Options a SameSite Cookie. Tieto mechanizmy priamo nechr\u00e1nia pred \u00fatokmi, ale umo\u017e\u0148uj\u00fa izol\u00e1ciu \u00fadajov webovej str\u00e1nky pred \u00fanikom do procesov, v ktor\u00fdch m\u00f4\u017ee by\u0165 vykonan\u00fd JavaScriptov\u00fd k\u00f3d \u00fato\u010dn\u00edka (\u00fanik sa deje z pam\u00e4te aktu\u00e1lneho procesu, v ktorom okrem k\u00f3du \u00fato\u010dn\u00edka m\u00f4\u017eu by\u0165 spracov\u00e1van\u00e9 aj \u00fadaje inej str\u00e1nky otvorenej v tej istej karte). Hlavn\u00e1 my\u0161lienka je oddeli\u0165 v r\u00f4znych procesoch vykon\u00e1vanie k\u00f3du str\u00e1nky od cudz\u00edch k\u00f3dov z\u00edskan\u00fdch z nespolehliv\u00fdch zdrojov, ako je k\u00f3d zahrnut\u00fd cez iframe.

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0440\u0430\u043d\u0435\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b. \u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 web-\u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0432 \u0442\u0435\u043a\u0443\u0449\u0435\u0439 \u0432\u043a\u043b\u0430\u0434\u043a\u0435. \u0414\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0441\u0430\u0439\u0442 leaky.page, \u0430 \u043a\u043e\u0434 \u0441 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435\u043c \u043b\u043e\u0433\u0438\u043a\u0438 \u0440\u0430\u0431\u043e\u0442\u0430 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u043d\u0430 GitHub. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99420","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google demon\u0161troval zneu\u017eitie zranite\u013enost\u00ed Spectre prostredn\u00edctvom vykon\u00e1vania JavaScriptu v prehliada\u010di | ProHoster","description":"Spolo\u010dnos\u0165 Google zverejnila nieko\u013eko prototypov exploitov, ktor\u00e9 ukazuj\u00fa mo\u017enos\u0165 zneu\u017eitia zranite\u013enost\u00ed triedy Spectre pri vykon\u00e1van\u00ed JavaScriptov\u00e9ho k\u00f3du v prehliada\u010di obch\u00e1dzan\u00edm predt\u00fdm pridan\u00fdch met\u00f3d ochrany.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/google-prodemonstriroval-ekspluatacziyu-uyazvimostej-spectre-cherez-vypolnenie-javascript-v-brauzere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Spectre \u0447\u0435\u0440\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043b\u0430\u0441\u0441\u0430 Spectre \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0440\u0430\u043d\u0435\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/google-prodemonstriroval-ekspluatacziyu-uyazvimostej-spectre-cherez-vypolnenie-javascript-v-brauzere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-13T14:22:51+00:00","article:modified_time":"2021-03-13T14:22:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99420","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-13 14:24:19","updated":"2022-10-02 07:42:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=99420"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99420\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=99420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=99420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=99420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}