LWN: Comments on "Remote Spectre exploits demonstrated"

Remote Spectre exploits demonstrated

timokokk — Thu, 02 Aug 2018 08:16:39 +0000

Something that probably makes a difference in the real world is the network latency. I didn't read the paper with too much care, but it caught my eye that in their setup they had ~15us average latency and they used a million samples per bit to distinguish ones and zeroes from each other. In real life the latency to any random server is at least in the range of milliseconds and varies much more. You basically need to be in the same LAN in order to reliably exploit the flaw, otherwise your bits will get lost in the noise. So we are nowhere near where you could just pick up random net servers and extract data off it just by measuring the response latency variance.

Remote Spectre exploits demonstrated

rweikusat2 — Mon, 30 Jul 2018 11:27:21 +0000

Not necessarily. The only hard requirment is that 'uncontrolled fluctuations' in machine state are random, IOW, cancel each other out when enough measured values are averaged. OTOH, the more 'noisy' the environment is, the lower the achievable transmission rate will be and 15 bits/ hour isn't exactly a high bandwidth to begin with.

Remote Spectre exploits demonstrated

jk — Mon, 30 Jul 2018 07:54:46 +0000

I would have thought so too, but:

> We used `stress -i 1 -d 1` for the experiments, to simulate a
> realistic environment. Although we would have expected our attack
> to work best on a completely idle server, we did not see any negative
> effects from the moderate server loads. In fact, they even slightly
> improved the attack performance

(section 6.3)

Remote Spectre exploits demonstrated

jcm — Fri, 27 Jul 2018 23:26:21 +0000

@Jon: technically they can exploit other variants remotely also, just they use v1 for simplicity

Remote Spectre exploits demonstrated

jcm — Fri, 27 Jul 2018 16:31:50 +0000

Not strictly required, we've seen in reproduced in a range of environments.

Remote Spectre exploits demonstrated

martin.langhoff — Fri, 27 Jul 2018 14:48:54 +0000

From a quick read, the network and target machine need to be very "quiet" for this to work...