NetSpectre attack can exploit CPUs to leak information remotely, researchers say

NetSpectre is an attack that can exploit CPUs to leak information remotely, unlike the original Spectre attack (but it's super slow).

Researchers now say it’s possible to use the infamous Spectre vulnerability in a way that does not require direct access to a victim’s device.

Researchers from the Graz University of Technology in Austria write in a paper published Thursday that they can exploit the Spectre flaw remotely without having to run code on the target machine. Such an attack, dubbed NetSpectre, would allow hackers to trick applications into leaking private information, albeit very slowly.

“The attacker only sends a series of crafted requests to the victim and measures the response time to leak a secret value from the victim’s memory,” the researchers explain.

Spectre is a CPU flaw affecting most modern computers that was revealed by researchers in January. It was originally thought that attackers trying to exploit it would need to somehow install malware on a victim’s device, either by tricking them into downloading malicious code or by running malicious JavaScript on a website the victim visited.

The big development with NetSpectre is that it doesn’t have those limitations.

The finding does come with a slight sigh of relief: The speed of data exfiltration made possible by the NetSpectre attack is really slow. In general, an attacker would only be able to leak data at 15 bits per hour from a victim. A variation of NetSpectre that’s specific to some Intel CPUs could crank the speed up to 60 bits per hour — still a snail’s pace. The slow speeds make the attack not so feasible for attackers who might want to seriously use it.

But the researchers say that demonstrating NetSpectre as a theoretical attack is significant.

“NetSpectre marks a paradigm shift for Spectre attacks, from local attacks to remote attacks,” the researchers write. “With our NetSpectre attacks, a much wider range and larger number of devices are exposed to Spectre attacks. Spectre attacks now must also be considered on devices which do not run any potentially attacker-controlled code at all.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure