New NetSpectre Attack Can Steal CPU Secrets via Network
New NetSpectre Attack Leak CPU Data Over your Network
That was not end! Researcher at Graz University of Technology, have found a new attack dubbed as 'NetSpectre' which is very different from earlier disclosed vulnerability.
NetSpectre has a major advantage that attacker can exploit this vulnerability remotely. According to the researchers, NetSpectre allows an attacker to read the memory of a system without having to execute any code locally.
On the whitepaper published by the researcher reads-
NetSpectre is an application of Bounds Check Bypass (CVE-2017-5753), and is mitigated in the same manner – through code inspection and modification of software to ensure a speculation stopping barrier is in place where appropriate. We provide guidance for developers in our whitepaper, Analyzing Potential Bounds Check Bypass Vulnerabilities, which has been updated to incorporate this method. We are thankful to Michael Schwarz, Daniel Gruss, Martin Schwarzl, Moritz Lipp, & Stefan Mangard of Graz University of Technology for reporting their research.
We present NetSpectre: A remote Spectre attack without attacker-controlled code on the victim, and the first Spectre attack which works without the cache as covert channel. https://t.co/qEJ2YMROAh /cc @lavados @mlqxyz pic.twitter.com/5T1VzZDvOJ— Michael Schwarz (@misc0110) July 26, 2018
Academics achieved higher exfiltration speeds —of up to 60 bits/hour— with a variation of NetSpectre that targeted data processed via a CPU's AVX2 module, specific to Intel CPUs.
You can read all the details information about the new NetSpectre on this Whitepaper.