Meltdown & Spectre - The bugs that have got tech world on edge

Posted in Information Technology by Adolf on Feb 15,2018 243

2017 saw a rise in the number of cyber-attacks, namely through ransomware. It’s exactly as the word says, holding the data of the victims for a ransom. Nothing seemed safe, there was one attack after the other. When one threat seemed to be over, the next took its place and wreaked havoc and became a nightmare for the IT users around the world. Some of the most prominent among these breaches were the WannaCry Ransomware, Petya and NotPetya Ransomware and the Equifax Breach which effectively left 145 million Americans and their personal information open to the world, leaving them vulnerable.

2017 was the most tumultuous year in the cyber-security space. The attacks toned down in the fourth quarter of 2017. The last four months were relatively quiet on the attack front. But with the start of 2018, another vulnerability has been discovered, on the hardware front this time. The vulnerabilities have been named Meltdown and Spectre and affect virtually every available device out right now. More specifically, it affects Intel x86 processors and microprocessors (Intel CPUs) and some ARM-based microprocessors.

The vulnerabilities were made in the first week of January. The operating system (OS) didn’t matter for the attack, as long as you are using most recent and patched versions of iOS, Linux, macOS, or Windows. Security analysts describe the vulnerability as “catastrophic”. You might wonder what the hullabaloo is all about? How can two hardware vulnerabilities send shock waves across the whole industry?

To understand the same, you need to first know what Meltdown and Spectre are and what they can do. Here’s a quick summary -

Meltdown allows a program to gain access to the memory and confidential information of other programs and operating systems by breaking the isolation barrier between the operating system and user application. The vulnerability, if exploited, runs the risk of sensitive information being leaked.

Spectre on the other hand is much more dangerous. It breaks the isolation of different applications, that they have with each other. This can help an attacker to trick error-free programs to leaking their sensitive information, in turn leaving them vulnerable to further attacks. As odd as it may sound, the various safety checks put in place by the programs end up increasing the attack chances leaving the susceptible to Spectre.

Both these vulnerabilities can essentially be used to steal sensitive data and passwords off your computer. The last time a vulnerability was discovered, we were attacked with WannaCry and Petya, which exploited those vulnerabilities and costed approximately $ 5 billion in damages. Meltdown mostly affects the Intel processors and microprocessors and Spectre on the other hand affects all including your smart phones.

This has particularly put Intel in a soup given that most PC and servers use their chips. Patches are being released for the software now, but the result of those patches are shaky. While they assure to block and isolate these vulnerabilities, the price to pay is the performance. The benchmarks done after applying the patch by Microsoft look bad for Intel with performance being hindered anywhere from 5 to 30%, especially computers running on Haswell architecture and older windows system such as Windows 7 and 8.

Intel CEO Brian Krzanich took the stage at CES in Las Vegas and tried playing down the discovery, but it didn’t work. Things don’t exactly look bright on the side of AMD either with several PCs running on AMD’s older processor series reported their computers bricked or disabled after applying the windows update for Spectre. And considering phones and any other device running on a microprocessor aren’t safe either, the tech world is effectively in a crisis right now.

To complicate the matters further, Computer Emergency Response Team (CERT) has suggested replacing the vulnerable hardware altogether, which is enough to indicate the severity of the vulnerabilities. It’s suggestion basically begs the question whether all the patches being released by the company would be fully effective or not?

It will be interesting to see what measures are taken and implemented to tackle and contain these seemingly long stretching vulnerabilities that are here to haunt the tech world in the coming days


Comment / Reply From