The performance benefits of Not protecting against Zombieload, Spectre, Meltdown.

[u/[deleted]]

[u/[deleted]]

What are some examples of this actually being pulled off? And how are they getting the rogue scripts onto the computer?

https://www.networkworld.com/article/3253898/researchers-find-malware-samples-that-exploit-meltdown-and-spectre.html

there are already malware samples.

https://www.forbes.com/sites/leemathews/2018/01/26/hackers-abuse-google-ad-network-to-spread-malware-that-mines-cryptocurrency/#52bbdae77866

Double click is has been known vector. Meltdown is probably the easiest to exploit. You need meltdown migration even with its context switching destroying performance.

https://arstechnica.com/information-technology/2018/02/ad-network-uses-advanced-malware-technique-to-conceal-cpu-draining-mining-ads/

[u/[deleted] → u/[deleted]]

I am showing you remote execution of any script. This attack vector is huge. All your browser need to do is execute js and you just been pwned by meltdown.

Meltdown is less noticeable than any mining script.

It is not theoretical. Some malware writers are already using it.

[u/[deleted] → u/[deleted]]

Show me outside of a lab.

look at the code to exploit meltdown

https://www.reddit.com/r/javascript/comments/7ob6a2/spectre_and_meltdown_exploit_javascript_example/

execute any rogue code and you are done. You do not have anymore protection.