News

New Spectre Variant Can Remotely Target Systems

NetSpectre Allows Attacks Without Local Code

Late last year, Spectre and Meltdown came out as new side-channel attacks. Fortunately, the victim system had to run the malicious code, limiting the impact. This limited the attack surface exposed to malicious actors. A lot more research has gone into this area since the groundbreaking attacks. Following up, we now have a new version of Spectre that works without having to run any code at all. Researchers have dubbed the new Spectre, NetSpectre.

Spectre side-channel attacks work by exploiting the architectural behaviors of processors. By using malicious code to trigger CPU actions and timing them, data in the cache can be discerned. This attack requires that the victim run the specific code that triggers the CPU. With NetSpectre, the attacker just needs network access. Instead of measuring CPU response time, the new attack targets network response time. There are two new methods that attack either the cache or AVX2 units.

New Attack Makes Unpatched Systems More Vulnerable to Spectre

For the cache-attack, the attacker starts off a large download. Once the cache is filled up, the attacker determines based on response time if a certain bit was present or not. For the AVX2 attack, it is a lot more novel. Intel CPUs have AVX2 units that are either idle or not. There is a measurable performance difference between them. The attacker can discern information from the system, by calling AVX2 instructions and measuring the response time, based on their power state.

Luckily, these network attacks are quite slow. On a local network, the cache takes 30 minutes per byte and the AVX2, 8 minutes. For a remote system, it jumps up to 8 hours and 3 hours respectively. This means attacks have to very targeted at things like encryption keys since it takes so long to get usable data. Furthermore, Intel and Microsoft system patches should protect against this attack. This means most users shouldn’t have to worry. However, with growing side-channel awareness, more exploits are sure to come to light.

Samuel Wan

Samuel joined eTeknix in 2015 after becoming engrossed in technology and PC hardware. With his passion for gaming and hardware, tech writing was the logical step to share the latest news with the world. When he’s not busy dreaming about the latest hardware, he enjoys gaming, music, camping and reading.

Disqus Comments Loading...

Recent Posts

Twitch Now Banning All Content Focusing On Intimate Body Parts

As by now, I'm sure you are aware Twitch has decided to go ahead and…

14 hours ago

Seconds Patch of “Operation Medic Bag” For Payday 3 Released

I doubt many of you have been keeping up with Payday 3 which is understandable…

16 hours ago

MSI Announces SPATIUM M580 FROZR With A Huge Cooler

Today MSI has announced a new Gen 5 SSD, the SPATIUM M580 FROZR which comes…

16 hours ago

LENRUE PC Speakers, USB/USB-C Powered Computer Speakers with Loud Stereo Sound

Stereo and Noiseless - Without any noise! After multiple debugging, suppress static. Become clearer and…

17 hours ago

HP M27f Ultraslim Monitor 27 Inch

PICTURE-PERFECT IMMERSION – Work or play on a monitor that redefines high definition with its…

17 hours ago

Govee LED Light Bars, Smart WiFi RGBIC TV Backlight

Syncs With Your Music: With an internal high-sensitivity mic, Govee Flow Plus LED light bars…

17 hours ago