New Attack Shows Risks of Browsers Giving Websites Access to GPU

A team of researchers from the Graz University of Technology in Austria and the University of Rennes in France has demonstrated a new graphics processing unit attack impacting several popular browsers and graphics cards.
The research focused on WebGPU, an API that enables web developers to use the underlying system's GPU to carry out high-performance computations in a web browser.
By leveraging this API, they have demonstrated an attack that works entirely from the web browser using JavaScript.
This makes it easier to carry out remotely, but also limits the potential impact compared to previous attacks that require access to native GPU APIs.
The academic researchers described their work as one of the first GPU cache side-channel attacks from within a browser.
The showed how the method can be leveraged for remote attacks, by getting the targeted user to access a website hosting malicious WebGPU code and stay on the site for several minutes while the exploit is being executed.
The exploit can be executed while the victim is reading an article on the malicious site.
No other type of user interaction is required to conduct an attack.
The new method, the experts demonstrated, can be used for inter-keystroke timing attacks, which can allow inferring sensitive information such as passwords based on keystroke timing data.
The research targeted 11 desktop graphics cards: two RX series products from AMD, and nine GTX, RTX and Quadro series products from NVIDIA. The attack targets browsers with WebGPU support, which includes Chrome, Chromium, Edge, and Firefox Nightly.
Mozilla, AMD, NVIDIA and Chromium developers have been notified.
The researchers said none of the other companies plan on taking any action either.
Giner said they suggested a permission pop-up in the browser, such as the one requesting microphone or camera access.
The Chromium team said it had found that asking users to make security decisions whose implications they don't comprehend adds friction without making them safer.
It shows whether WebGPU is available and conducts a harmless attack in the browser.
Also updated third paragraph to clarify that this is one of the first GPU cache side-channel attacks from within a browser, rather than 'the first' attack of this kind.
This was the first attack when the paper was being written, but others have since conducted similar research with different targets.


This Cyber News was published on www.securityweek.com. Publication date: Mon, 18 Mar 2024 14:28:04 +0000


Cyber News related to New Attack Shows Risks of Browsers Giving Websites Access to GPU

New Attack Shows Risks of Browsers Giving Websites Access to GPU - A team of researchers from the Graz University of Technology in Austria and the University of Rennes in France has demonstrated a new graphics processing unit attack impacting several popular browsers and graphics cards. The research focused on ...
1 year ago Securityweek.com
New Attack Shows Risks of Browsers Giving Websites Access to GPU - A team of researchers from the Graz University of Technology in Austria and the University of Rennes in France has demonstrated a new graphics processing unit attack impacting several popular browsers and graphics cards. The research focused on ...
1 year ago Packetstormsecurity.com
Google Patches Another Chrome Zero-Day as Browser Attacks Mount - For the fourth time since August, Google has disclosed a bug in its Chrome browser technology that attackers were actively exploiting in the wild before the company had a fix for it. Integer Overflow Bug The latest zero-day, which Google is tracking ...
1 year ago Darkreading.com CVE-2023-6345 CVE-2023-4863 CVE-2023-5217 CVE-2023-28205 CVE-2023-32409 CVE-2023-28204 CVE-2023-32373
Attackers Could Eavesdrop on AI Conversations on GPUs - Researchers at cybersecurity research and consulting firm Trail of Bits have discovered a vulnerability that could allow attackers to read GPU local memory from affected Apple, Qualcomm, AMD and Imagination GPUs. In particular, the ...
1 year ago Techrepublic.com
eIDAS: EU's internet reforms will undermine a decade of advances in online security - The European Union's attempt to reform its electronic identification and trust services - a package of laws better known as eIDAS 2.0 - contains legislation that poses a grave threat to online privacy and security. An article buried deep in the draft ...
1 year ago Helpnetsecurity.com
Attack Vector vs Attack Surface: The Subtle Difference - Cybersecurity discussions about "Attack vectors" and "Attack surfaces" sometimes use these two terms interchangeably. This article guides you through the distinctions between attack vectors and attack surfaces to help you better understand the two ...
2 years ago Trendmicro.com
AMD, Apple, Qualcomm GPUs leak AI data in LeftoverLocals attacks - A new vulnerability dubbed 'LeftoverLocals' affecting graphics processing units from AMD, Apple, Qualcomm, and Imagination Technologies allows retrieving data from the local memory space. Tracked as CVE-2023-4969, the security issue enables data ...
1 year ago Bleepingcomputer.com CVE-2023-4969
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
1 year ago Esecurityplanet.com
Lost in Translation: Mitigating Cybersecurity Risks in Multilingual Environments - With increased connectivity and linguistic diversity comes a new set of cybersecurity risks. This article will delve into the unique cybersecurity challenges in multilingual environments, focusing on solutions and best practices to mitigate such ...
1 year ago Cyberdefensemagazine.com
Detecting Vulnerability Scanning Traffic From Underground Tools Using Machine Learning - Our structured query language (SQL) injection detection model detected triggers containing unusual patterns that did not correlate to any known open-source or commercial automated vulnerability scanning tool. We have tested all malicious payloads ...
10 months ago Unit42.paloaltonetworks.com
GPUHammer - First Rowhammer Attack Targeting NVIDIA GPUs - Cybersecurity researchers at the University of Toronto have achieved a breakthrough in hardware-level attacks by successfully demonstrating GPUHammer, the first Rowhammer attack specifically targeting discrete NVIDIA GPUs. The research, which focuses ...
1 month ago Cybersecuritynews.com Inception
Many popular websites still cling to password creation policies from 1985 - A significant number of popular websites still allow users to choose weak or even single-character passwords, researchers at Georgia Institute of Technology have found. The researchers used an automated account creation method to assess over 20,000 ...
1 year ago Helpnetsecurity.com
Apple, AMD, Qualcomm, Imagination GPUs open to data theft The Register - A design flaw in GPU drivers made by Apple, Qualcomm, AMD, and likely Imagination can be exploited by miscreants on a shared system to snoop on fellow users. On a non-shared system, malware that manages to run on the box could abuse the weakness to ...
1 year ago Go.theregister.com Hunters
CVE-2024-0671 - Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory ...
1 year ago
18 Best Web Filtering Solutions - 2025 - Pros Cons Comprehensive content filtering.Cost can be high for full features.Malware and threat protection.Hardware-based solutions may require additional infrastructure.Easy to deploy and manage.Configuration complexity for advanced ...
5 months ago Cybersecuritynews.com
CVE-2024-1067 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. On Armv8.0 ...
1 year ago
New Credit Card Skimming Attack Leverages Chrome, Edge, & Firefox Extensions to Steal Financial Data - The careful design of this attack chain enables persistent access without requiring elevated privileges, allowing the attackers to maintain long-term access to victims’ browsers and financial information. When payment details are detected, the ...
4 months ago Cybersecuritynews.com
Menlo Security Adds SaaS Platform to Manage Secure Browsers - Menlo Security today unfurled a software-as-a-service platform that makes it simpler to centrally apply and manage cybersecurity policies to secure instances of Google Chrome or Microsoft Edge browsers. Rew Harding, vice president of security ...
1 year ago Securityboulevard.com
Employee giving and volunteerism drives positive business outcomes - Cisco was honored last year to win the top spot on People's 2023 List of Companies That Care, and a key factor was our employee culture of giving back. We've been on a multi-year journey to engage our employees for positive impact at scale. Not only ...
1 year ago Feedpress.me
How to Do a Risk Analysis Service in a Software Project - Software projects are vulnerable to countless attacks, from the leak of confidential data to exposure to computer viruses, so any development team must work on an effective risk analysis that exposes any vulnerabilities in the software product. A ...
1 year ago Feeds.dzone.com
CVE-2023-5643 - Out-of-bounds Write vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. ...
1 year ago
CVE-2019-19083 - Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). This affects the dce112_clock_source_create() function in ...
5 years ago
CVE-2023-32804 - Out-of-bounds Write vulnerability in Arm Ltd Midgard GPU Userspace Driver, Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a local non-privileged user to write a ...
1 year ago Tenable.com
CVE-2023-6143 - Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race ...
1 year ago
CVE-2023-6241 - Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race ...
1 year ago

Cyber Trends (last 7 days)