I started a Spectre/Meltdown documentation and resource collection repo. Please share and contribute PRs!https://github.com/marcan/speculation-bugs/blob/master/README.md …
-
Variation 1 remote attack is not hard. Crypto libraries purposely jitter network responses exactly to prevent this type of attacks (particularly leaking private keys)
Sure, but a lot of things need to line up beyond typical crypto attacks. You need to be able to trigger reads from the buffer or clashing cache lines, besides having a service with the vulnerable code path to begin with. I will be impressed if someone finds an exploitable service