Hello, welcome to the Friday, July 27th, 2018 edition of the Sansanet Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Hey, and imagine that we got a new variation of Spector, actually a new way to exploit Spector.

This particular exploitation technique can happen over

the network and does not require that the attacker has actual access, meaning being able to execute

code on the target system. It just needs some kind of network demon that will respond to packets and this again could be sort of any packet.

What this really relies on is just like the local specter attacks on speculative execution.

But the execution time depends on what happened before on the system and essentially leaks data from the cache. Now in this case

of course the execution time isn't as easy to measure because you have a lot of other

things that happen with network packets like for example inconsistent network

latency but overall this paper proved it can be done. The problem is

the speed isn't really all that impressive. You need hundreds of thousands of bytes to actually

extract one byte of cash. What they measured in sort of more or less real-world scenarios, meaning on a local network,

as well as in Google's cloud, is about 15 bits per hour. In another variation of the attack,

they got this up to 60 bits an hour. And this is the rate that you achieve if you actually sort of saturate

the network. Now, it doesn't sound like a lot of data, but still it's possible, but very noisy.

The authors of the paper from Cross University also point out that, for example, DDoS protections could be used to

protect yourself from this attack. So yes, it's probably yet another reason to vary into

patch specter, but other than that, I wouldn't really worry too much about this particular

exploit vector. One possible use of the attack that the authors propose is to use it to break address space

layout randomization.

Now of course this would make some other vulnerabilities easier to exploit.

...