Chrome Zero: A team of academics has managed to create a Chrome extension that can block side-channel attacks that use JavaScript code to leak data from a computer's RAM or CPU.
The extension is called Chrome Zero and is currently only available on GitHub and not through the official Chrome Web Store.
The researchers created the extension to rewrite and protect the functions, properties, and JavaScript objects most commonly used by any malicious JavaScript code that aims to leak data from the CPU or RAM.
Analysis
Experts report that there are currently eleven state-of-the-art side-channel attacks that can be carried out via JavaScript code running in a browser.
Each attack requires access to various local details, and uses JavaScript code to leak, retrieve, and gather the necessary information before starting with the actual attack from a side-channel.
After examining each of them, the researchers were able to identify five main categories of data/features that side-channel JavaScript attacks try to exploit: memory addresses retrieved from JS, precise timing information (time difference), web workers, data shared between JS code, and data from device sensors.
How the extension works
The Chrome Zero extension essentially hacks the JavaScript code that is about to run through Chrome to rewrite certain JavaScript functions, properties, and objects, neutralizing the negative effects of a side-channel attack.
The experts stated that despite the extension’s intrusive behavior, tests showed minimal impact on browser performance, as it uses only 1.54% of resources and causes a page load delay ranging from 0.01064 to 0.08908 seconds, depending on the number of protection policies in effect at runtime.
Additionally, as a result of the extension’s protective measures, the research team says that Chrome Zero would be able to block 50% of Chrome Zero Days detected since the release of Chrome 49.
How to install the extension
As mentioned, the extension is not yet available through the Chrome Web Store. However, you can easily install it:
Download the extension from the Chrome extensions management page (chrome://extensions), by clicking “Load Unpacked”, select the “chromezero” folder from the extension’s source code.
More information is available in a paper titled “JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks,” presented in late February at the NDSS Symposium held in San Diego, California. The paper is available online from here and here, while the video of the NDSS presentation is below:
- Password Alert Extra protection from Google
- Post tweets from the Chrome address bar
- Google Chrome: HTTP pages will be insecure from July
