security-research-pocs

> This effort, along with a move to prevent timing attacks, led to JavaScript engines intentionally making timing inaccurate, so hackers can’t get precise measurements of the current computers performance or how expensive a certain operation is. The primary motivation for limiting timer resolution was the rise of speculative execution attacks (Spectre / Meltdown), where high-resolution timers are integral for differentiating between timings within the memory hierarchy. https://github.com/google/security-research-pocs/tree/master... If you look at when various browsers changed their timer resolutions, it's entirely a response to Spectre. https://blog.mozilla.org/security/2018/01/03/mitigations-lan... https://issues.chromium.org/issues/40556716 (SSCA -> "speculative side channel attacks")

> Suppose I'm a typical desktop user, how is important information going to be stolen if I have mitigations turned off and JavaScript enabled? https://github.com/google/security-research-pocs/tree/master... I don't imagine I'm going to explain it better than the many others who have already done so. > What state does my browser have to be in, and what actions do I have to take (or not take) for the attack to succeed? Your browser would have to be pretty old/ outdated since they've been updated to mitigate these attacks. Otherwise it's just necessary that you visit the attacker controlled website. > What likelihood is it that someone has deployed an attack that meets those requirements? That's not a simple question. Threat landscapes change based on a lot of factors. As I said earlier, we won't see these attacks because people have already

That specific PoC page relied on performance.now() https://github.com/google/security-research-pocs/blob/d10780... Chrome has limited "performance.now" to have a relatively low resolution: https://chromium-review.googlesource.com/c/chromium/src/+/85... Also, "2018 install of win10", you might have already been patched during install. The chrome patch was Jan 2018. Microsoft also rolled out their first specture/meltdown mitigations at the OS level in January 2018.

If you're just interested in the PoC, it's available here: https://leaky.page/ and looks like the code is at https://github.com/google/security-research-pocs/tree/master...

That's a well researched problem, and is common in most JavaScript frameworks. In practice it makes it harder to protect applications using them against XSS. Check https://www.slideshare.net/mobile/x00mario/jsmvcomfg-to-ster... or script gadgets research https://github.com/google/security-research-pocs/blob/master... for more complete overview of the issue. Disclaimer: I'm one of the authors.

Here are some PCAPs of the PoCs from the GitHub repo: CVE-2017-14491.pcap: https://www.cloudshark.org/captures/016080cbeab5 CVE-2017-14492.pcap: https://www.cloudshark.org/captures/fd4bfa9403fc CVE-2017-14493.pcap: https://www.cloudshark.org/captures/1c30b56dc1d3 CVE-2017-14494.pcap: https://www.cloudshark.org/captures/657de976c0d1 Used this repo to generate these: https://github.com/google/security-research-pocs/tree/master...

Of the three RCEs, two of them are in the DHCP server subsystem, which means they can only be exploited by a device that successfully authenticates to your local network. The other RCE is in the DNS subsystem, and can apparently be exploited by making a PTR record lookup to an attacker-controlled DNS server: https://github.com/google/security-research-pocs/blob/master... My first question is: can you induce people to make PTR lookups? I don't think there's a way to make a browser do a PTR lookup, which may limit the remote exploitability of this vulnerability. My second question is: can the vulnerability be exploited with an A/AAAA record lookup instead? If so, that would open a very devastating remote attack vector, as a website would need only include a hidden image tag pointing to an attacker-controlled domain in order to get RCE on