Meltdown, Spectre, and the Costs of Unchecked Innovation

Posted on Mar 18, 2018

Meltdown, Spectre, and the Costs of Unchecked Innovation

Both attacks rely on using high-speed timing measurements to detect sensitive information, so somewhat counterintuitively, the patches had to decrease the speed of seemingly mundane computations. The first change was to slow down the performance API for web browsers, which had previously been able to analyze the behavior of a page at speeds fast enough to be used in an attack; the second change removed SharedArrayBuffer, a new kind of data structure atop which similar timers could be trivially rebuilt. Similar changes were also soon also implemented by Microsoft for Internet Explorer and Edge browsers and also by WebKit, a tool for viewing the web that is used to build Safari, Mobile Safari, Android Browser, and the dedicated browsers embedded on many other devices.

As of this writing, SharedArrayBuffer is now disabled in all major browsers.

Source: wired.com