New Spectre Variant Can Remotely Target Systems

NetSpectre Allows Attacks Without Local Code

Late last year, Spectre and Meltdown came out as new side-channel attacks. Fortunately, the victim system had to run the malicious code, limiting the impact. This limited the attack surface exposed to malicious actors. A lot more research has gone into this area since the groundbreaking attacks. Following up, we now have a new version of Spectre that works without having to run any code at all. Researchers have dubbed the new Spectre, NetSpectre.

Spectre side-channel attacks work by exploiting the architectural behaviors of processors. By using malicious code to trigger CPU actions and timing them, data in the cache can be discerned. This attack requires that the victim run the specific code that triggers the CPU. With NetSpectre, the attacker just needs network access. Instead of measuring CPU response time, the new attack targets network response time. There are two new methods that attack either the cache or AVX2 units.

New Attack Makes Unpatched Systems More Vulnerable to Spectre

For the cache-attack, the attacker starts off a large download. Once the cache is filled up, the attacker determines based on response time if a certain bit was present or not. For the AVX2 attack, it is a lot more novel. Intel CPUs have AVX2 units that are either idle or not. There is a measurable performance difference between them. The attacker can discern information from the system, by calling AVX2 instructions and measuring the response time, based on their power state.

Luckily, these network attacks are quite slow. On a local network, the cache takes 30 minutes per byte and the AVX2, 8 minutes. For a remote system, it jumps up to 8 hours and 3 hours respectively. This means attacks have to very targeted at things like encryption keys since it takes so long to get usable data. Furthermore, Intel and Microsoft system patches should protect against this attack. This means most users shouldn’t have to worry. However, with growing side-channel awareness, more exploits are sure to come to light.