At the start of 2018 details were first published of the theoretical Spectre attack which exploits flaws in the design of modern CPU to allow data to be stolen from memory.  Now Google has published a working proof-of-concept.

Spectre is the name given to a number of attacks that are variations on a theme – abusing the speculative execution abilities of modern processors to leak data from memory that could be useful to an attacker.  To exploit Spectre, an attacker needs to be able to introduce their own malicious code onto the target computer – and the easiest way to do that today is through malicious JavaScript downloaded and executed by the target’s web browser.  This JavaScript could be introduced into a trusted website by a malicious advert or Cross Site Scripting for example.

The proof of concept released by Google’s security team runs on a current and fully patched version of Chrome – highlighting that Spectre cannot be mitigated by browser design or software alone.

By exploiting Spectre, the malicious Javascript is potentially able to access all of the memory for the browser process – revealing data of use to attackers including keys or passwords.  Over the last two years browser vendors have worked hard to isolate the rendering of each website into its own process – limiting the reach of Spectre attacks but not thwarting them fully.

Now the attention is turning to the design of Web applications to ensure the design of web pages gives enough detail to the browser to allow further segmentation and isolation of the elements of the webpage rendering into more individual processes to further limit the reach of Spectre attacks in JavaScript.

Google’s security team has blogged about these initiatives and Security Managers should engage with their colleagues who develop web applications to ensure that the new cross-origin protections available are enabled – as they are off by default.  This will not only help mitigate against Spectre but also other cross-origin attacks such as Cross Site Scripting and Cross Site Request Forgery.

A new guide is being published on Post-Spectre Web Development and is available on GitHub from the Google Chrome Security Team.