It’s always nice to start off the day with some good news, right? Well, today is not exactly a day for good news, especially for your Intel-powered laptop or desktop. A seemingly recent security flaw has users worldwide panicking about their Intel-powered systems. The vulnerability exists in the Kernel of Intel chips.
Called Meltdown and Spectre, these two vulnerabilities are akin to those that plagued Intel chips a while back as well. They essentially The icing on the cake is the fact that these vulnerabilities can affect Intel-based systems that have been in operation for over 20 years.
These include computers, servers, and even phones. Yes, the vulnerability has existed for more than 20 years without anyone knowing about it, until now.
What is Meltdown?
Meltdown essentially breaks down the barrier between the user applications and the operating system. As the name suggests, this destroys the security boundaries normally put in place by hardware.
A successful Meltdown attack would allow a malicious program to access the memory or RAM of a system, and also the private and confidential data such as passwords of other programs and indeed the operating system as well.
What is Spectre?
Similar to Meltdown, Spectre breaks down the barrier between different applications. Attackers can manipulate or trick error-free programs into revealing their secrets.
The Spectre vulnerability is a lot more difficult to exploit than Meltdown. On the other hand, it is also harder to alleviate. However, it is possible to prevent specific known exploits based on Spectre through software patches.
Intel isn’t the only one affected
While it was originally assumed that only Intel chips were at risk, it was later discovered that even AMD and ARM chips are susceptible to a Meltdown or Spectre attack. As per the reports, all Desktop, Laptop, and Cloud computers may be affected by Meltdown.
To be more specific, any system that implements out-of-order execution is potentially affected. Coincidentally, this execution has been in processors since 1995, with the exception of the Intel Itanium and Intel Atom before 2013.
Spectre too affects Desktops, Laptops and Cloud Servers. It also affects smartphones as well. They are more likely to be vulnerable if they are modern CPUs capable of retaining multiple instructions at the same time.
With regard to Cloud providers, those who use Intel CPUs and Xen PV as virtualization are at risk if they haven’t applied the latest patches. In addition, cloud providers who don’t have real hardware virtualization, but rather rely on containers that share one kernel, such as Docker, LXC, or OpenVZ would also be affected.
Though AMD noted that their processors were not vulnerable to Meltdown and Spectre, Google researchers have carried out a successful demonstration attack on AMD FX and AMD PRO CPUs. In addition, ARM has also confirmed that their Cortex-A processors are vulnerable to attack.
Help is on the way
So how does one safeguard one’s systems from Meltdown and Spectre? Well, it involves a redesign of the Microsoft Windows and Linux Kernels. For Microsoft, the company has since issued an important patch for Windows 10 operating systems to combat Meltdown and Spectre. According to Microsoft, the update would be downloaded and installed automatically via Windows Update.
While the patch does seem to keep things at bay, systems with the patch installed have been reported to be taking a hit at performance. Accordingly, systems have been noted to slow from anywhere between 5-30% depending on the exact Intel processor model.
Linux systems are undergoing an overhaul as well. Developers are redoing the open source operating system’s kernel’s virtual memory system. Because Meltdown and Spectre enable attackers to bypass kernel access protections, allowing normal apps to read the contents of kernel memory, Linux programmers have been isolating the kernel’s memory away from user processes. They call the process “Kernel Page Table Isolation.”
As a result, Linux systems too have taken a hit on performance but Linux programmers are hopeful that the systems will return to their original performance levels over the course of time.
The plot thickens
Even though the update from Microsoft is scheduled for release today, the actual vulnerability was identified quite a while back. In fact, Google informed the affected companies about Spectre back in June 2017 and Meltdown on July 28, 2017.
For Linux especially, patches and accompanying comments have been redacted in order to prevent attackers from discovering the exact weakness so that they too can exploit it.
macOS 10.3.2 has also received a partial fix for the security bug by altering programming needs related to the kernel memory information from macOS. Mac users can also expect more changes for macOS 10.3.3, expected to arrive shortly.
Cloud services would be the most affected party. Microsoft Azure cloud is expected to go into maintenance by next week. Amazon Web Services too has followed suit, informing users that a security update will be deployed on Friday 5th January 2018. Intel has begun working on software and firmware updates that would do away with the system slowdowns if they exist.
If you’re using Windows 10, then the updates will automatically download and install. Android smartphones too will be getting an update via security patches. Expected to be on the 5th of January, the patch will lessen the chance of your Android device being compromised. Google Chrome too will have a new version released on the 23rd of January 2018 with protocols to protect you from Meltdown and Spectre attacks.