Skip to main content

Featured post

Finding the Cheapest Car to Insure When Making a New Car Purchase

Post a Comment

Meltdown and Spectre: what you need to know




Overview

If you’ve been keeping up with computer news over the last few days, you might have heard about Meltdown and Spectre, and you might be wondering what they are and what they can do. Basically, Meltdown and Spectre are the names for multiple new vulnerabilities discovered and reported for numerous processors. Meltdown is a vulnerability for Intel processors while Spectre can be used to attack nearly all processor types.
The potential danger of an attack using these vulnerabilities includes being able to read “secured” memory belonging to a process. This can do things like reveal personally identifiable information, banking information, and of course usernames and passwords. For Meltdown, an actual malicious process needs to be running on the system to interact, while Spectre can be launched from the browser using a script.
Microsoft, Google, Mozilla, and other vendors have been releasing patches all day to help protect users from this vulnerability. Some of the updates from Microsoft may negatively interact with certain antivirus solutions. However, Malwarebytes is completely compatible with our latest database update. The best thing to do to protect yourself is to update your browsers and your operating system with these patches as soon as you see an update available.
For a quick guide on how to protect yourself from this threat, please check out “Meltdown and Spectre Vulnerabilities – what you should do to protect your computer” on the Malwarebytes support knowledge base.

Details


The Google Project Zero team, in collaboration with other academic researchers, has published information about three variants of a hardware bug with important ramifications. These variants—branch target injection (CVE-2017-5715), bounds check bypass (CVE-2017-5753), and rogue data cache load (CVE-2017-5754)—affect all modern processors.
If you’re wondering if you could be impacted, the answer is most certainly yes.
The vulnerabilities, named Meltdown and Spectre, are particularly nasty, since they take place at a low level on the system, which makes them hard to find and hard to fix.
Modern computer architecture isolates user applications and the operating system, which helps to prevent unauthorized reading or writing to the system’s memory. Similarly, this design prevents programs from accessing memory used by other programs. What Meltdown and Spectre do is bypass those security measures, therefore opening countless possibilities for exploitation.
The core issue stems from a design flaw that allows attackers access to memory contents from any device, be it desktop, smart phone, or cloud server, exposing passwords and other sensitive data. The flaw in question is tied to what is called speculative execution, which happens when a processor guesses the next operations to perform based on previously cached iterations.
The Meltdown variant only impacts Intel CPUs, whereas the second set of Spectre variants impacts all vendors of CPUs with support of speculative execution. This includes most CPUs produced during the last 15 years from Intel, AMD, ARM, and IBM.
It is not known whether threat actors are currently using these bugs. Although due to their implementation, it might be impossible to find out, as confirmed by the vulnerability researchers:
Can I detect if someone has exploited Meltdown or Spectre against me?Probably not. The exploitation does not leave any traces in traditional log files.
While there are no attacks reported in the wild as of yet, several Proof of Concepts have been made available, including this video that shows a memory extraction (using a non-disclosed POC). This is particularly damaging because 1. There aren’t many options for protection currently and 2. as previously stated, even if threat actors do spring to action, it might be impossible to verify if that’s the case. 

Mitigations

Because the Meltdown and Spectre variants are hardware vulnerabilities, deploying security programs or adopting safer surfing habits will do little to protect against potential attack. However, a patch for the Meltdown variant has already been rolled out on Linux, macOS, and all supported versions of Windows.
According to our telemetry, most Malwarebytes users are already able to receive the latest Microsoft update. However, we are working to ensure that our entire user base has access to the patch.
Unfortunately, Microsoft’s fix comes with significant impact on performance, although estimates of how much vary greatly. An advisory from Microsoft recommends users to:
  1. Keep computers up to date.
  2. Install the applicable firmware update provided by OEM device manufacturers.
If you are having issues getting the Windows update, please refer to this article, as Microsoft has stated some possible incompatibility issues with certain security software.
No software patch for Spectre is available at the time of this article. Partial hardening and mitigations are being worked on, but they are unlikely to be published soon.
The Spectre bug can be exploited via JavaScript and WebAssembly, which makes it even more critical. It is therefore recommended to apply some countermeasures such as Site Isolation in Chrome. Mozilla is rolling out a Firefox patch to mitigate the issue while working on a long-term solution. Microsoft is taking similar action for Edge and Internet Explorer.
Cloud providers (Amazon, Online.net, DigitalOcean) also rushed to issue emergency notifications to their customers for upcoming downtimes in order to prevent situations where code from the hypervisor could be leaked from a virtual machine, for example.
The aftermath from these bugs is far from being completely understood, so please check back on this blog for further updates.
Vendor advisories:

Labels:

Comments

Post a Comment

Popular posts from this blog

MacPorts Brings the Best Open Source Software to Your Mac

It’s safe to say that the Apple ecosystem brought “app stores” to the mainstream. Before the introduction of the iPhone, buying digital software was often full of trials like submitting your payment to the developer’s website, waiting for a license key by email, and negotiating refunds. You’d be forgiven for thinking that free and open source software (FOSS) is rare on the Mac, given Apple’s approach. In reality, the Mac is an excellent host for many of the community’s best free tools. MacPorts  is your “app store” for all this great software. Let’s take a look at how it works. What Is MacPorts? MacPorts is a package system for Macs. It’s very similar in function and use to the Red Hat Package Management (RPM) system and Advanced Package Tools (APT), which install DEB packages on Linux. Actually, it descends from the Ports system of FreeBSD. Did you know Mac OS X started its life as a fork of FreeBSD called Darwin? Even today macOS has a sol...
Post a Comment
Read more

Finding the Cheapest Car to Insure When Making a New Car Purchase

other lists of least expensive cars to insure do exist, in comparing the results above to those lists, the top 5 were already in this list, so this is a good guideline for the National Average expectation for cars costing less on insurance. Here are the other cars that made the list of vehicles that will save you money on insurance costs compared to the national average. All these cars cost between $1,204 and $1,221 per year according to the annual ranking of least expensive cars to insure. Mazda CX-3   Honda Pilot LX Fiat 500X Pop Nissan Frontier S Hyundai Tuscon SE Subaru (XV) Crosstrek 2.0l Honda HR-V LX Ford F-150 XL Ford Edge SE What Makes a Car Less Expensive for Insurance The information used to determine the cheapest cars to insure can often also be a good indicator to you of the cheapest cars to maintain and service. It can also be an indicator of potential problem areas because the insurance rates are determined when the insurance company...
Post a Comment
Read more

Google Birthday Surprise Spinner: The Best Games And How To Play them

Google is celebrating its birthday in perhaps the most Google of ways: with a Doodle that lets you play through the most fun Doodles ever. The company is now 19 years old (or is it?) and so has a huge stock of entertaining and time-wasting little animations to play through. So it has selected the best of recent years and assembled them all into the meta-Doodle, which lets people use a spinner to find which of the Doodles to play. Using the Doodle is simple enough: you head to the Google homepage, click on the spinner, and opt either to play the option you've been given or have another go. But read on, because there's a major catch. In some cases, they're actually better than the times they were Google Doodles. That's because the company has made them full screen this time around, allowing you to see everything you're doing without all that bothersome Google branding getting in the way. For most people, picking through the games is an initially fu...
Post a Comment
Read more