Spectre and Meltdown the big chip flaws
Processors
are vital to running all our computerized devices, even if we hardly
ever think about them. That's why it's a big deal that they have
major vulnerabilities, such as Spectre and Meltdown, that leave them
open to hacking attacks.
As
they run all the essential processes on your computer, these silicon
chips handle extremely sensitive data. That includes passwords and
encryption keys, the fundamental tools for keeping your computer
secure.
The
Spectre and Meltdown vulnerabilities, revealed Wednesday, could
let attackers capture information they shouldn't be able to access,
like those passwords and keys. As a result, an attack on a
computer chip can turn into a serious security concern.
What are the vulnerabilities?
Researchers
found two major weaknesses in processors that could let attackers
read sensitive information that should never leave the CPU, or
central processing unit. In both cases, attackers could see data that
the processor temporarily makes available outside of the chip.
Here's
why that happens: To make computer processes run faster, a chip will
essentially guess what information the computer needs to perform its
next function. That's called speculative execution. As the chip
guesses, that sensitive information is momentarily easier to access.
The
vulnerabilities allow an attacker to compromise the privileged memory
of a processor by exploiting the way processes run in parallel. They
also allow an attacker to use JavaScript code running in a browser to
access memory in the attacker’s process. That memory content could
contain key strokes, passwords, and other valuable information.
Researchers are already showing how easy this attack works on Linux
machines, but Microsoft says it has “not received any information
to indicate that these vulnerabilities have been used to attack
customers at this time.”
Protecting
a Windows PC is complicated right now, and there’s still a lot of
unknowns. Microsoft, Google, and Mozilla are all issuing patches for
their browsers as a first line of defense. Firefox 57 (the latest)
includes a fix, as do the latest versions of Internet Explorer and
Edge for Windows 10. Google says it will roll out a fix with Chrome
64, which is due to be released on January 23rd. Apple has not
commented on how it plans to fix its Safari
browser
or even macOS. Chrome, Edge, and Firefox users on Windows won’t
really need to do much apart from accept the automatic updates to
ensure they’re protected at the basic browser level.
For
Windows itself, this is where things get messy. Microsoft has issued
an emergency security patch through Windows Update, but if you’re
running third-party antivirus software then it’s possible you won’t
see that patch yet. Security researchers are attempting to compile a
list of antivirus software that’s supported, but it’s a bit of
mess to say the least.
A
firmware update from Intel is also required for additional hardware
protection, and those will be distributed separately by OEMs. It’s
up to OEMs to release the relevant Intel firmware updates, and
support information for those can be found at each OEM support
website. If you built your own PC you’ll need to check with your
OEM part suppliers for potential fixes.
If
you own a Windows-powered PC or laptop, the best thing to do right
now is ensure you have the latest Windows 10 updates and BIOS updates
from Dell, HP, Lenovo, or one of the many other PC makers. We’re
hoping Microsoft or Intel creates a simple tool (they have a
PowerShell script right now) to check protection for both the
firmware and Windows updates, but until such a tool is available
you’ll need to manually check or get familiar with PowerShell.
Here’s a quick step-by-step checklist to follow for now:
These
steps only currently provide protection against Meltdown, the more
immediate threat of the CPU flaws. Spectre is still largely an
unknown, and security researchers are advising that it’s more
difficult to exploit than Meltdown. Spectre fixes will be a lot more
complicated as they require a redesign of the processor and hardware
changes, so we could be living with the threat of a Spectre attack
for years to come.
Comments
Post a Comment