Spook.js: Attacking Chrome Strict Site Isolation via Speculative Execution
The discovery of the Spectre attack in 2018 has sent shockwaves through the computer industry, affecting processor vendors, OS providers, programming language developers, and more. Because web browsers execute untrusted code while potentially accessing sensitive information, they were considered pri...
Uloženo v:
| Vydáno v: | Proceedings - IEEE Symposium on Security and Privacy s. 699 - 715 |
|---|---|
| Hlavní autoři: | , , , , , , |
| Médium: | Konferenční příspěvek |
| Jazyk: | angličtina |
| Vydáno: |
IEEE
01.05.2022
|
| Témata: | |
| ISSN: | 2375-1207 |
| On-line přístup: | Získat plný text |
| Tagy: |
Přidat tag
Žádné tagy, Buďte první, kdo vytvoří štítek k tomuto záznamu!
|
| Abstract | The discovery of the Spectre attack in 2018 has sent shockwaves through the computer industry, affecting processor vendors, OS providers, programming language developers, and more. Because web browsers execute untrusted code while potentially accessing sensitive information, they were considered prime targets for attacks and underwent significant changes to protect users from speculative execution attacks. In particular, the Google Chrome browser adopted the strict site isolation policy that prevents leakage by ensuring that content from different domains is not shared in the same address space. The perceived level of risk that Spectre poses to web browsers stands in stark contrast with the paucity of published demonstrations of the attack. Before mid-March 2021, there was no public proof-of-concept demonstrating leakage of information that is otherwise inaccessible to an attacker. Moreover, Google's leaky.page, the only current proof-of-concept that can read such information, is severely restricted to only a subset of the address space and does not perform cross-website accesses. In this paper, we demonstrate that the absence of published attacks does not indicate that the risk is mitigated. We present Spook.js, a JavaScript-based Spectre attack that can read from the entire address space of the attacking webpage. We further investigate the implementation of strict site isolation in Chrome, and demonstrate limitations that allow Spook.js to read sensitive information from other webpages. We further show that Spectre adversely affects the security model of extensions in Chrome, demonstrating leaks of usernames and passwords from the LastPass password manager. Finally, we show that the problem also affects other Chromium-based browsers, such as Microsoft Edge and Brave. |
|---|---|
| AbstractList | The discovery of the Spectre attack in 2018 has sent shockwaves through the computer industry, affecting processor vendors, OS providers, programming language developers, and more. Because web browsers execute untrusted code while potentially accessing sensitive information, they were considered prime targets for attacks and underwent significant changes to protect users from speculative execution attacks. In particular, the Google Chrome browser adopted the strict site isolation policy that prevents leakage by ensuring that content from different domains is not shared in the same address space. The perceived level of risk that Spectre poses to web browsers stands in stark contrast with the paucity of published demonstrations of the attack. Before mid-March 2021, there was no public proof-of-concept demonstrating leakage of information that is otherwise inaccessible to an attacker. Moreover, Google's leaky.page, the only current proof-of-concept that can read such information, is severely restricted to only a subset of the address space and does not perform cross-website accesses. In this paper, we demonstrate that the absence of published attacks does not indicate that the risk is mitigated. We present Spook.js, a JavaScript-based Spectre attack that can read from the entire address space of the attacking webpage. We further investigate the implementation of strict site isolation in Chrome, and demonstrate limitations that allow Spook.js to read sensitive information from other webpages. We further show that Spectre adversely affects the security model of extensions in Chrome, demonstrating leaks of usernames and passwords from the LastPass password manager. Finally, we show that the problem also affects other Chromium-based browsers, such as Microsoft Edge and Brave. |
| Author | Ronen, Eyal Genkin, Daniel Agarwal, Ayush Kim, Jason O'Connell, Sioli Yehezkel, Shaked Yarom, Yuval |
| Author_xml | – sequence: 1 givenname: Ayush surname: Agarwal fullname: Agarwal, Ayush email: ayushagr@umich.edu organization: University of Michigan – sequence: 2 givenname: Sioli surname: O'Connell fullname: O'Connell, Sioli email: sioli.oconnell@adelaide.edu.au organization: University of Adelaide – sequence: 3 givenname: Jason surname: Kim fullname: Kim, Jason email: nosajmik@gatech.edu organization: Georgia Institute of Technology – sequence: 4 givenname: Shaked surname: Yehezkel fullname: Yehezkel, Shaked email: shakedy@mail.tau.ac.il organization: Tel Aviv University – sequence: 5 givenname: Daniel surname: Genkin fullname: Genkin, Daniel email: genkin@gatech.edu organization: Georgia Institute of Technology – sequence: 6 givenname: Eyal surname: Ronen fullname: Ronen, Eyal email: eyal.ronen@cs.tau.ac.il organization: Tel Aviv University – sequence: 7 givenname: Yuval surname: Yarom fullname: Yarom, Yuval email: yval@cs.adelaide.edu.au organization: University of Adelaide |
| BookMark | eNotT9tOwzAUCwgktrEvgIf8QEtOkuXC2zRtMDQJpMLzlKWnkF2aqg0T_D2d2JNt2bLsIbmqY42E3APLAZh9KN6k4iBzzjjPrRFCA1yQsdUGlJpIEKDsJRlwoScZcKZvyLDrtoxxJqwckJeiiXGXb7tHOk3J-V2oP-nsq40HpEVqg0-0CAnpsot7l0Ks6TE4WjTov0_6iHT-0_OTc0uuK7fvcHzGEflYzN9nz9nq9Wk5m66yAGBSprjaCGTglVUlOMM4WClKYb3oN5fGb0y_2lTaq7ICL9Fa7MPoNTr0nIsRufvvDYi4btpwcO3v-nxd_AGA8087 |
| CODEN | IEEPAD |
| ContentType | Conference Proceeding |
| DBID | 6IE 6IH CBEJK RIE RIO |
| DOI | 10.1109/SP46214.2022.9833711 |
| DatabaseName | IEEE Electronic Library (IEL) Conference Proceedings IEEE Proceedings Order Plan (POP) 1998-present by volume IEEE Xplore All Conference Proceedings IEEE Electronic Library (IEL) IEEE Proceedings Order Plans (POP) 1998-present |
| DatabaseTitleList | |
| Database_xml | – sequence: 1 dbid: RIE name: IEEE Electronic Library (IEL) url: https://ieeexplore.ieee.org/ sourceTypes: Publisher |
| DeliveryMethod | fulltext_linktorsrc |
| Discipline | Computer Science |
| EISBN | 9781665413169 1665413166 |
| EISSN | 2375-1207 |
| EndPage | 715 |
| ExternalDocumentID | 9833711 |
| Genre | orig-research |
| GrantInformation_xml | – fundername: Air Force Office of Scientific Research funderid: 10.13039/100000181 – fundername: Defense Advanced Research Projects Agency funderid: 10.13039/100000185 – fundername: Israel Science Foundation funderid: 10.13039/501100003977 – fundername: Robert Bosch funderid: 10.13039/100011993 – fundername: National Science Foundation funderid: 10.13039/100000001 |
| GroupedDBID | 23M 29O 6IE 6IF 6IH 6IL 6IN AAJGR AAWTH ABLEC ACGFS ADZIZ ALMA_UNASSIGNED_HOLDINGS BEFXN BFFAM BGNUA BKEBE BPEOZ CBEJK CHZPO IEGSK IJVOP M43 OCL RIE RIL RIO RNS |
| ID | FETCH-LOGICAL-i118t-626b3e01c696d1a8021943d39c3781d8cb84138f7c6df1c4e99e1c6ec7eaec223 |
| IEDL.DBID | RIE |
| IngestDate | Wed Aug 27 02:37:20 EDT 2025 |
| IsPeerReviewed | false |
| IsScholarly | true |
| Language | English |
| LinkModel | DirectLink |
| MergedId | FETCHMERGED-LOGICAL-i118t-626b3e01c696d1a8021943d39c3781d8cb84138f7c6df1c4e99e1c6ec7eaec223 |
| PageCount | 17 |
| ParticipantIDs | ieee_primary_9833711 |
| PublicationCentury | 2000 |
| PublicationDate | 2022-May |
| PublicationDateYYYYMMDD | 2022-05-01 |
| PublicationDate_xml | – month: 05 year: 2022 text: 2022-May |
| PublicationDecade | 2020 |
| PublicationTitle | Proceedings - IEEE Symposium on Security and Privacy |
| PublicationTitleAbbrev | SP |
| PublicationYear | 2022 |
| Publisher | IEEE |
| Publisher_xml | – name: IEEE |
| SSID | ssj0020394 |
| Score | 2.2420275 |
| Snippet | The discovery of the Spectre attack in 2018 has sent shockwaves through the computer industry, affecting processor vendors, OS providers, programming language... |
| SourceID | ieee |
| SourceType | Publisher |
| StartPage | 699 |
| SubjectTerms | Browsers Codes Computer industry Computer languages Ecosystems Passwords Privacy |
| Title | Spook.js: Attacking Chrome Strict Site Isolation via Speculative Execution |
| URI | https://ieeexplore.ieee.org/document/9833711 |
| hasFullText | 1 |
| inHoldings | 1 |
| isFullTextHit | |
| isPrint | |
| link | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV3PS8MwFA5zePA0dROdP8jBo92aH2sSbyIbKjIGVdlttMkrTHAbWzf8833J6kTw4i20KYWXJu99r-97HyHXsc4zFXMXKSd5JHnGorwHRQTaSWuLBFSodn97VsOhHo_NqEZudlwYAAjFZ9Dxw_Av383t2qfKukYLoTyRd0-pZMvV2oGrWBhZUeNYbLrpSCac-aQJ553quV8CKsF_DBr_e_Mhaf0Q8eho52KOSA1mx6TxrcRAq43ZJE_pAoPlzvvqlt6VZWZ9_pv6vrcfQFPfg7-kKcaW9BG_tLAUdDPNqNeeD-pdG6D9Txz7Oy3yOui_3D9ElUpCNEVwUEaISHIBMbOJSRzLNDptI4UTxgqFwai2uUZHpQtlE1cwK8EYwMlgFWRgMTo4IfXZfAanhKoeHsOF8B15CskKBN3cOcQzCbd4FrHsjDS9aSaLbSOMSWWV9t-Xz8mBt_62OvCC1MvlGi7Jvt2U09XyKqzeFwtInAw |
| linkProvider | IEEE |
| linkToHtml | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV1LT8JAEN4QNNETKhjf7sGjhe6D7q43YzCgSEiKhhspu9MEE4FAIf58Z0vFmHjxtukjTWbanfmm881HyE2ox4kKuQuUkzyQPGHBuAlpANpJa9MIVN7t_tZVvZ4eDk2_RG63XBgAyJvPoO6X-b98N7MrXyprGC2E8kTeHa-cVbC1tvAqFEYW5DgWmkbclxFnvmzCeb2485eESh5BHiv_e_YBqf1Q8Wh_G2QOSQmmR6TyrcVAi0-zSp7iOabL9fflHb3PssT6Cjj1k28_gMZ-Cn9GY8wuaQfftdwZdD1JqFefz_W71kBbn7j2Z2rk9bE1eGgHhU5CMEF4kAWIScYCQmYjEzmWaAzbRgonjBUK01FtxxqtpVNlI5cyK8EYwIvBKkjAYn5wTMrT2RROCFVN3IhT4WfypJKlCLu5c4hoIm5xN2LJKal604zmm1EYo8IqZ38fviZ77cFLd9Tt9J7Pyb73xKZX8IKUs8UKLsmuXWeT5eIq9-QXXQefVQ |
| openUrl | ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=proceeding&rft.title=Proceedings+-+IEEE+Symposium+on+Security+and+Privacy&rft.atitle=Spook.js%3A+Attacking+Chrome+Strict+Site+Isolation+via+Speculative+Execution&rft.au=Agarwal%2C+Ayush&rft.au=O%27Connell%2C+Sioli&rft.au=Kim%2C+Jason&rft.au=Yehezkel%2C+Shaked&rft.date=2022-05-01&rft.pub=IEEE&rft.eissn=2375-1207&rft.spage=699&rft.epage=715&rft_id=info:doi/10.1109%2FSP46214.2022.9833711&rft.externalDocID=9833711 |