How the recent discoveries affect your systems.
No, these aren’t the titles of the next Marvel superhero outings. Meltdown and Spectre are the names given by security researchers to two recently discovered bugs affecting the central processing units (CPUs) of nearly ever modern computer, including cell phones, PCs, and the servers which run much of the Internet.
The bugs–subtle flaws in the architecture of processors made by Intel, AMD, and others–have been present for many years, but only recently the ability to exploit these flaws has become known. When properly executed, it allows the attacker to bypass the hardware-based security that processors use to keep the memory running one process separate from another.
Using the right tools, this could allow a hacker to “read” data from a program being run in parallel on the same system by a different user. While the process is somewhat random, such fragments of memory could theoretically contain passwords or other sensitive information sent between an end user and a web application.
Of biggest concern is the impact this flaw has on virtualized machines (VMs), the systems which allow Cloud-based services to provide applications to hundreds or thousands of different customers on the same physical server hardware. Sites like Facebook, Office 365 and iCloud rely on such shared VMs to service millions of customers. Unpatched, a server running multiple virtual machines could leak sensitive information between its customers to an attacker who has gained access through a legitimate account.
Thus far, there have been no known exploits of these bugs and Microsoft, Apple, and the Linux community are rushing through patches to address the problem. But because of the nature of the flaw—encoded into the hardware at the most fundamental level of the system—the changes required to fix them could also impact the performance of processors, slowing down some computers as much as 30 percent by some estimates.
Time will tell whether these steps are sufficient to close the hole before hackers develop the tools to more easily exploit this weakness.
Sean Kirby is a Client Support Specialist at Triella, a technology consulting company specializing in providing technology audits, planning advice, project management and other CIO-related services to small and medium sized firms. For additional articles, please visit http://www.triella.com/whats-new/. Triella is a VMware Professional Partner, Microsoft Certified Partner, Citrix Solution Advisor – Silver, Dell Preferred Partner, Authorized Worldox Reseller and a Webroot Partner..
© 2018 by Triella Corp. All rights reserved. Reproduction with credit is permitted.