Meltdown has enough merits to shake up the computing world, but the bad news is that it is not alone. It came accompanied by Spectre, a vulnerability that essentially affects almost all processors with speculative execution support, and that has security experts tearing their hair out. As if that were not enough, Spectre gives rise to a whole new series of attacks, including one via JavaScript. So how vulnerable are browsers? A new online tool from Tencent helps us find out.
The long road to mitigation
The industry will have to work for years to mitigate, contain, and finally eliminate the effects of Meltdown and Spectre. Both vulnerabilities can be contained to a certain extent with patches, but the price is a loss of performance in specific work environments. Lasting solutions will require new architectures and new hardware, so the priority of everyone responsible is to minimize the impact on speed. From a technical standpoint, Spectre is harder to exploit than Meltdown, and harder to neutralize. One available strategy is to target the major Spectre-based exploits with hotfixes, and some web browsers have started adopting them.
The problem is that not all browsers are up to date in every case, and if we interpret the information about Spectre correctly, it affects computers, servers, mobile devices, and IoT platforms that often lag far behind when it comes to updates. One way to verify your status is to visit the Tencent XuanWu Lab portal and click the button. The check is almost instantaneous, but the official description forces us to take the result with a grain of salt. If the tool reports that the browser is "vulnerable", that is definitely true; however, the announcement of "not vulnerable" does not make it so at all, since there could be other unknown exploits out there.
Patches and progressive protections
In general, protections against Spectre are a work in progress. Google will distribute the first round of patches for Google Chrome starting on January 23, but there is also the option to enable the experimental "Strict Site Isolation" mode. On the Firefox side, the standard build has already received adjustments, while the ESR edition will have its own update on the 23rd. Patience.
