GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper published Tuesday.
The cross-origin attack allows a malicious website from one domain—say, example.com—to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains.
…
The security threats that can result when HTML is embedded in iframes on malicious websites have been well-known for more than a decade. Most websites restrict the cross-origin embedding of pages displaying user names, passwords, or other sensitive content through X-Frame-Options or Content-Security-Policy headers. Not all, however, do. One example is Wikipedia, which shows the usernames of people who log in to their accounts. A person who wants to remain anonymous while visiting a site they don’t trust could be outed if it contained an iframe containing a link to https://en.wikipedia.org/wiki/Main_Page.
Pixel stealing PoC for deanonymizing a user, run with other tabs open playing video. “Ground Truth” is the victim iframe (Wikipedia logged in as “Yingchenw”). “AMD” is the attack result on a Ryzen 7 4800U after 30 minutes, with 97 percent accuracy. “Intel” is the attack result for an i7-8700 after 215 minutes with 98 percent accuracy.
The researchers showed how GPU.zip allows a malicious website they created for their PoC to steal pixels one by one for a user’s Wikipedia username. The attack works on GPUs provided by Apple, Intel, AMD, Qualcomm, Arm, and Nvidia. On AMD’s Ryzen 7 4800U, GPU.zip took about 30 minutes to render the targeted pixels with 97 percent accuracy. The attack required 215 minutes to reconstruct the pixels when displayed on a system running an Intel i7-8700.
…
I wonder how long until facebook adds it to their surveillance stack.
Bet some overworked and underappreciated engineer is working on it right as we speak.
If that engineer is coding that they should not be appreciated. They are part of the problem. I don’t care about the pay or the status of being a facebook engineer. I really don’t respect any engineer that has worked for any of the FAANG companies. Those fuckers sold out their morals the second they typed the first character of the first line of code while employed there.
Seems like an unpopular opinion. I rather get your sentiment, but I don’t think it’s that black and white.
I’ve a friend who through Amazon (AWS) managed to leave his rather shitty country with an oppressive regime, for a much better place. I personally would never want to work at the ACRONYMCLUBS, but they do have a lot of money to swing around. If you’re from some shithole, I totally get doing some less than moral (yet still perfectly legal) work just to get yours on the dry.
I’m glad I’ve never been forced to make such a choice but still, I get why people do it.
In that situation I would view the person as self serving. Doing something to improve one’s own situation at the expense of others is not conducive to a good society. I care more about the group than one friend in a tough situation. I liken it to the trolly problem.
Writing a single line of code for Meta, Apple, Amazon, Netflix, or Google means you don’t have any morals? That’s a pretty extreme stance. Are you at least consistent about it? Let’s see.
By your logic, if a person has ever purchased anything from, viewed an ad served by, or used a service or product created by any of those companies, they’re part of the problem and unworthy of your respect. After all, their actions have increased their value even more directly than a developer’s actions did - and unlike the developer, they didn’t get paid for it.
Do you apply that logic to every other for-profit corporations, just these, or some subset of them? Are nonprofits safe? Is it just developers that you have a problem with? What about product managers, scrum masters, engineering managers, HR? What about Apple storefront employees, Amazon warehouse employees, Amazon delivery drivers, Customer Service for Netflix, or content moderators for Meta?
Most of what you typed is reductio ad absurdum and I will not entertain it.
To the part that is not I will say that yes I do apply the same standard to any business or employees that uses their size to to enshittify. It’s called Right Livelihood and if more people lived by it we would not have the current problems with mega corps.
While a bunch of NSA spies groan as (probably) a perfectly good vulnerability they paid top dollar for, dies.