Google yakavhurwa mazuva mazhinji apfuura dzakasiyana siyana dzinoshandisa prototypes izvo zvinoratidza mukana wekushandisa zvisizvo yeiyo Specter kirasi paunenge uchiita JavaScript kodhi mubrowser, usingapfuure nenzira dzekuchengetedza dzakawedzerwa pamusoro.
Zviitiko zvinogona kushandiswa kuwana ndangariro dzechiitiko iri kugadzirisa zvemukati zvewebhu mune yazvino tebhu. Kuti uedze mashandisiro ezvekushandisa, iyo webhusaiti yeiyo peji rinodonha yakavhurwa uye kodhi inotsanangura pfungwa yekushanda yakaburitswa paGitHub.
Iyo prototype yakarongedzerwa yakagadzirirwa kurwisa masisitimu ane Intel Core i7-6500U processor mukati meLinux uye Chrome 88 nharaunda, kunyangwe izvi zvisinga sarure kuti shanduko dzinogona kuitwa kushandisa kushandisa mune dzimwe nharaunda.
Maitiro ekushanda haana kujeka ku ma processor Intel: mushure mekugadziriswa kwakakodzera, Iko kushandisa kwakasimbiswa kushanda pane masisitimu ane wechitatu-bato maCCU, kusanganisira iyo Apple M1 yakavakirwa pakuvakwa kweARM. Mushure mekushomeka tudiki, iko kushandisa kunoshandawo kune mamwe masisitimu anoshanda uye mamwe mabhurawuza anoenderana neiyo Chromium injini.
Munharaunda yakavakirwa pane yakajairwa Chrome 88 uye Intel Skylake processors, isu takawana kudonhedza dhata kubva kuhurongwa hunotarisira kupa webhu zvemukati mune yazvino Chrome tebhu (kupa nzira) nekumhanya kwe1 kilobyte pasekondi. Uye zvakare, dzimwe prototypes dzakagadzirwa, semuenzaniso, kushandisa kunobvumidza, pamutengo wekudzikama kugadzikana, kuwedzera mwero wekudonha kusvika ku8kB / s kana uchishandisa mashandiro .now () timer ine kunyatsoita 5 microseconds (0.005 milliseconds ). Musiyano wakagadzirwawo unoshanda pamwe nekuita timer kweye millisecond rimwe, iro rinogona kushandiswa kuronga kupinda mukurangarira kweimwe nzira pachiyero chemakumi matanhatu emabheti pasekondi.
Iyo yakaburitswa demo kodhi ine zvikamu zvitatu:
- Chikamu chekutanga calibrate iyo timer yekufungidzira iyo inomhanya nguva yekuvhiya kunodiwa kutora iyo data inosara mune processor cache semhedzisiro yekufungidzira kuitiswa kweiyo CPU mirairo.
- Chikamu chechipiri Inotsanangura mamiriro ekurangarira anoshandiswa kana uchigovera JavaScript array
- Chikamu chechitatu inonyatsoshandisa iko kushushikana kweSpecter kuona zvemukati zvemukati yemaitirwo azvino nekuda kwekugadzirwa kwemamiriro ekufungidzira kuitiswa kweimwe mashandiro, mhedzisiro yacho inoraswa neprosesa mushure mekuona fungidziro yakakundikana, asi nzira dzekuuraya dzinogadziriswa mune yakagovaniswa cache uye inogona kudzoreredzwa uchishandisa nzira dzeKusarudza zvirimo mune cache uchishandisa yechitatu-bato nzira dzinoongorora shanduko munguva yekuwana kune yakachengetwa uye isina-cached dhata.
Iyo yakarongedzerwa nzira yekushandisa inobvisa yakakwira-chaiyo nguva inowanikwa kuburikidza ne performance.now () API uye isina rutsigiro rweiyo SharedArrayBuffer mhando, iyo inokutendera iwe kuti ugadzire arrays mune yakagovaniswa ndangariro.
Iko kushandisa kunosanganisira iyo Specter mudziyo, iyo inokonzeresa inofungidzirwa yekufungidzira kodhi kuitisa, uye yeparutivi chiteshi leak analyzer, iyo inotara kuti ndeipi data yakachengetwa panguva yekufungidzira kuuraya.
Iyo gadget inoitwa uchishandisa JavaScript JavaScript, umo kuyedza kunoitwa kuwana nzvimbo iri kunze kwemiganhu yebhafa, iyo inokanganisa mamiriro ebazi rekufanotaura block nekuda kwekuvapo kweye buffer saizi cheki yakawedzerwa neiye compiler (processor inofungidzira inoita kuwana pamberi penguva, asi inodzosera iyo nyika mushure mekutarisa).
Kuti uongorore zviri mukachechi pasi pemamiriro ekushaya kukwana kwetimer, nzira yakarongedzwa iyo inonyengerera iyo Tree-PLRU cache dhata yekudzinga dhata inoshandiswa mumaprosesa uye inobvumira, nekuwedzera huwandu hwenzvimbo, kuwedzera zvakanyanya mutsauko nguva kana kukosha inodzoserwa kubva kune cache uye mukushaikwa kweiyo kukosha mune cache.
Google yakaburitsa prototype yechisimba kuratidza kugona kwekurwiswa uchishandisa Specter kirasi kushomeka uye kukurudzira vagadziri vewebhu kuti vashandise maitiro anoderedza njodzi dzekurwiswa kwakadai.
Panguva imwecheteyo, Google inotenda kuti pasina kudzokororwa kwakakosha kwechimisikidzo chakarongwa, hazvigoneke kuumba zviwanikwa zvepasi rose zvakagadzirira kwete kuratidzira chete, asi nekushandiswa kwakawanda.
mabviro: https://security.googleblog.com