JavaScript code that can escape a web browser’s security sandbox

This is pretty crazy times we live in:

"Three security researchers released a paper describing a proof of concept exploit they developed. They?ve called it Rowhammer.js, and it?s a piece of JavaScript code that can escape a web browser?s security sandbox and gain access to the physical memory of your computer.


The bad news is that if your computer is vulnerable, it?s a hardware issue, and there?s very little you personally can do about it. No software patches are coming to the rescue any time soon. The good news is that this hack is so complicated to pull off, you?re probably safe just from its level of difficulty alone.


So what exactly is Rowhammer.js? While it still needs to be tested further, the researchers claimed it is the ?first remote software-induced hardware-fault attack? in existence, written entirely in JavaScript. In other words, it?s scalable, powerful, takes more than a little luck to pull off, and if you understand how it works, it?s the most clever thing you?ll see all week"

And here is the paper:


And the code:

Enjoy

Interesting read , one thing sticks out in particular is the fact is you can use this to easily read memory particular cookies
it makes services like hitleap and url redirection extremely dangerous since most of them have browser exploits already.

Yes it can be used for a lot of sick stuff.
Don't know if this works on any mobile-device - but think about all "secure" stuff we have there also.

Thanks for the share, going to read into this.

Very nice, good to see you back. Looking forward to seeing what else you have. :drinking2

From an academic standpoint, the article is an exceptionally interesting read, at least as far as the technical details and explanations of how they pulled off the rowhammer technique using pure JavaScript go.

That being said, I feel the paper's authors are being somewhat alarmist, and their claims that it could be more or less "readily" exploited in today's typical computing environment(s) extremely exaggerated.

I'm not going to be losing any sleep over this, and neither should anybody else. Here is why (from the article): "In a second step we build an inverted page table for the Firefox process. We then resolve the physical addresses we want to hammer to offsets within the JavaScript array. These offsets are then pasted into a field in the webpage to start hammering on the JavaScript array."

Very specific foreknowledge of the particular environment in which the JavaScript is executing must be available in order to actually turn this into something which could be called an attack or exploit.

Basically, this technique, while very much so a definite theoretical possibility, would be *more* difficult (on several orders of magnitude) to pull off than smashing the stack on a machine protected with a decent NX data pages + ASLR memory layout implementation (which is quickly becoming standard first-line protection, if not considered to be so already).

We're all going to be just fine now...

I am talking about using it to your advantage

pixeltech said:

We're all going to be just fine now...

Click to expand...

Anyone using this?

hah fun this is exploiting bit flipping (aka bitsquatting) i wrote a little article about that once to use it for seo purposes as bitflipping in domain names happens too and you can predict+register the right domains
aaanyways like pixeltech said, while this is a interesting/fun hack its not practical especially not easily exploitable on a wide scale (though not impossible with enough research and possible combined attack vectors).