Chrome Zero: A team of academics managed to create one extension of Chrome that can block side-channel attacks that use JavaScript code to leak data from a computer's RAM or CPU.
The name of the extension is Chrome Zero and is currently only available on GitHub and not through the official Chrome Web Store.
The researchers created the extension to rewrite and protect them functions, the properties and JavaScript objects most commonly used by any malicious JavaScript code aiming to leak data from the CPU or RAM.
Resolution
Experts report that there are currently eleven state-of-the-art side-channel attacks that can be executed through JavaScript executed in a browser.
Every attack is needed access to various local details, and uses JavaScript code to leak, retrieve, and aggregate the necessary information before starting with the actual attack from some side-channel.
After examining each of them, researchers have identified five main categories of data / features that are being exploited by side-channel JavaScript attacks: memory addresses retrieved by JS, exact timing information, web workers, data that shared between the JS code and data from the device sensors.
How Extension works
The Chrome Zero extension essentially violates the JavaScript code that is going to run through Chrome to rewrite some JavaScript features, attributes and objects by eliminating the negative effects of a side-channel attack.
Experts said that despite the intrusive behavior of the extension, testing showed little impact on browser performance by using only 1,54% of resources and causing a delay in loading the page ranging from 0,01064 to 0,08908 seconds depending on the number of policies applicable at the time of execution.
In addition, as a result of the protection measures of the expansion, the research team reports that Chrome Zero would be able to block the 50% of the Zero Day of Chrome that was detected from the Chrome 49 release onwards.
How to Install the Extension
As mentioned, the extension is not yet available through the Chrome Web Store. But you can easily install it:
Download the extension and from the Chrome Extensions Manager page (chrome: // extensions), by clicking on "Load Unpacked", select the "chromezero" folder from the extension source code.
More information is available in a paper entitled "JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks," presented end of February at the NDSS Symposium held in San Diego, California. The paper is available online from here The estate provides stunning sea views and offers a unique blend of luxury living and development potential here, while the presentation video in NDSS is below:
- Password Alert Additional protection from Google
- Publish tweets from the Chrome address bar
- Google Chrome: HTTP pages are unsafe in July
