skip to Main Content
Chip Vulnerabilities And The Aftermath Of “Spectre” And “Meltdown”

Chip Vulnerabilities and the Aftermath of “Spectre” and “Meltdown”

Chip Vulnerabilities and the Aftermath of “Spectre” and “Meltdown”

Today we are experiencing innovation and technological advancement happening quicker than it has ever been possible. It is an exciting time for those involved, as this is allowing us to make ground breaking discoveries at lightning fast speeds, utilize big data in a fashion that was unheard of 10 years ago, and sharing all of this in next to no time! As security professionals would attest, however, this does come at a cost. With all these incredible feats, comes an enormous amount of responsibility to ensure that everything is being taken care of in a secure manner. Earlier this year, the processor vulnerabilities known as “Spectre” and “Meltdown” were discovered to affect most electronic devices including computers, smartphones, tablets, and servers. This was because of the performance efficiency enhancements made by manufacturers such as Intel and other top producers, which inadvertently allowed an avenue for hackers to exploit and access data as it comes across the CPU without being detected by typical security measures. Because these chips and therefore the enhancements are used on nearly all modern computers, regardless of operating system, it poses a major threat to both commercial and residential users alike if ignored.

 

The good news is, there are things you can do to protect yourself. Since we were made aware of this flaw early in 2018, most all operating systems have patches available to limit the risk of these vulnerabilities. Many of the earlier patches did cause quite a bit of derogation to the performance of these chips, but that is coming around as well.  Adding to the performance issues, though, Linux systems in which non-stable or cutting-edge kernels are running may require additional steps to ensure that all vulnerable chips have been effectively patched. The patches alone will not solve all your issues, however. To ensure all measures have been taken, a firmware or hardware BIOS update must also be applied. The silver lining to this specific vulnerability, comes in the form of knowledge and education. It is hard to say exactly how long this has been a known exploitable avenue by potential cyber criminals, but there is no evidence thus far that suggests this has been a major issue or the root to any major data breaches. What the discovery of this vulnerability does is protect us against future variations of this same type of exploit.

 

As of late May 2018, another breed of these same attacks, called “Speculative Store Bypass Variant 4” emerged. Spectre and Meltdown represent the first three variations of the vulnerability. What is different about Variant 4 specifically is that it allows an attacker to access data which would typically be stored out of the user’s reach. This includes JavaScript modules that are used in web browsing that is responsible for which ads the user sees. What is most frightening about this, is it would potentially allow for an attacker to know more information about their victim than the victim is probably aware is even available. With newly implemented GDPR rules at the forefront for most international organizations, this creates a very interesting caveat to that discussion.

 

Typical to all newly discovered vulnerabilities, the exploits follow the same series of advances. One will be discovered and remediated, and then it will be followed by other variations of the same type of exploit. This has already happened with SSB Variant 4 and can only be expected to continue for at least a few more times. What this does for the “blue” teams fighting those attackers though, is it gives them the equal opportunity to discover these same variations before they are uncovered by a malicious party. Had it not been for Spectre and Meltdown’s initial discovery, it is likely that this attack could be known only to less honorable individuals. This brings up a very valuable lesson, which is one that we are inevitably going to continue to visit as commercial demand takes priority over thorough security inspection. As innovation in technology becomes more prolific, the security of such must also be held to a higher standard.

 

Andrew Noland,

Director of Business Development

Alias Forensics, Inc.

Back To Top