M
eltdown and Spectre. You’ve heard a little about these two names in the news and media, but what are they actually going on about? Seems fitting that the New Year would kick off with a brand new potential threat to our IT Systems, but these two might actually be the most critical vulnerabilities to date.
However, before you start chucking all your devices out the window and going into a panic room, we need to not only identify what these two things are, but establish how much of a risk they realistically present. It’s all well and good to panic at the first sight of a potential threat, but things may not be quite as bad as they seem.
This week, let’s look into the two major vulnerabilities the IT Industry has faced this New Year and how you, as a consumer or business owner/employee may be affected (if at all).
Never Miss a Post
Subscribe to our newsletter and we will let you know as soon as the next blog post is out.
Plus, get exclusive discounts and tips straight from the team at Computer Assistance.
Meltdown & Spectre
Discovered in summer last year, Meltdown and Spectre are two forms of vulnerabilities that are present in all modern day CPUs, dating back at least 10 years. These two vulnerabilities allow attackers to potentially access secure information, without you knowing. Thus personal data, images, e-mails, passwords to your accounts and more could be accessible. However, it’s not a simple process to perform and software companies have already been releasing patches to mitigate these attacks.
This will be a little tricky to explain, as it will get quite technical. However, let’s break this down into manageable chunks and address each aspect of these vulnerabilities.
What do they do?
Both Spectre and Meltdown give the same sort of access to attackers, meaning potentially personal data. The data itself is only present when the machine is on and running, as these vulnerabilities allow access to the system memory. However, the process to do so isn’t simple. Furthermore, Spectre is considerably harder to exploit, but likewise much harder to mitigate.
Meltdown
Meltdown’s name comes from the basic overview of what the vulnerability does. It essentially “melts down the security boundaries normally enforced by hardware.” Thus, the end result being access to sensitive data that is usually inaccessible by conventional means. However, it’s not as straight forward as that. You need to be pretty adept at being able to exploit the vulnerability to get said sensitive data out and revealed. 
An attacker can use some software that’s currently running on the device to gain access to data to areas it would not normally be able to access. This includes the system memory and areas only administrators have access to!
However, the process does require a program to be running on the machine, as well as other programs that may have information stored in the system memory, to be fully effective. Otherwise, not much data will be able to be extracted. Furthermore, this exploit only really works on Intel chips, so AMD users are safe! Finally, this issue has already been looked into and fixes are already being rolled out by Microsoft and others. Thus, the chances of Meltdown affecting you are very slim!
There is a catch, as always. The current patches in Windows for Intel chips regarding this vulnerability have reported performance loss. However, it appears only synthetic benchmarks notice the difference in performance. General day to day operations don’t appear to be as noticeably affected. So, if you’re just checking your e-mails or writing up a document or two, you should be absolutely fine. Business as usual.
Spectre
Spectre is the one the tech industry is considerably more concerned about. Now, before we explain how it works, why is it more of a concern? Well, Spectre is considerably harder to execute and exploit. But, being able to mitigate an attack of this nature is very difficult. Furthermore, you wouldn’t even notice that it’s happened. So, your personal data could already be stolen and you wouldn’t notice it happen. Moreover, data logs showing your activity in your operating system won’t notice the event, either!
Sounds a little bit doom and gloom, but it’s not all bad news. Thankfully, patches are also being rolled out for this vulnerability already. However, this one will take a little bit more time to mitigate, as Intel, AMD and ARM chips are affected.
So, how does it work? Spectre exploits a mechanism found in all modern CPUs. Speculative Execution. More on that in a moment.
Spectre is a really tricky one to explain in a simple manner. But for the most part, an attacker can force an unnecessary computation string to execute. Thus, force a program on the PC to access data from the protected memory on the PC, then extract said data from the protected memory via a secondary channel. This, however, is only made possible by abusing speculative execution. But, what is speculative execution?
Speculative Execution
This is a term you may have heard if you’ve been reading into any of the shortened explanations online about how the two vulnerabilities work. However, they’ve never really explained the term.
Speculative Execution is a process that modern CPUs use to improve the performance of data execution and the speed that said data reaches you, the user.
Let’s say, Program A has an unknown variable. It could be either a true or false statement. Both statements have their own results and require the CPU to process two completely different pathways.
Speculative Execution allows the CPU to compute both scenarios, before actually knowing what the result of Program A’s unknown variable is. Thus, when the answer is revealed, the CPU has already done most of the leg work, thus improving the performance.
Furthermore, if a program has a common processing pathway (i.e, it performs the same function in exactly the same way very frequently), the CPU can complete this process before it even needs to be done. So, when the program finally calls for that process, the CPU has already done it and thus improves system performance.
For the most part, it’s a brilliant piece of technology, but comes with its own risks, which we have now found as two major vulnerabilities.
What’s the risk?
Both of these attacks seem pretty scary, right? However, as aforementioned, Microsoft, Google and other major industry leaders are already on the case. Patches have already been released to combat these vulnerabilities, with varying levels of success. Google has compiled a list of programs and devices that are affected and what the best course of action is to take with them. Furthermore, Microsoft have released several patches to combat Spectre and Meltdown, depending on what chip you have in your PC. However, if you’re running an anti-virus software, make sure they’re compatible with these patches.
ESET is one of the first anti-virus programs on the market to be completely compatible with all the recent patches. Definitely a good anti-virus software to use. We also provide a full setup and configuration for you, should you choose to switch over. Click here find out more.
For right now, it’s safe enough to say that as an average internet user, you’re pretty safe. While the risk is there, there are currently no known exploits out in the wild. Thus, no-one’s really utilizing these vulnerabilities in a known way. So, chances are you won’t be affected by this at all.
Still, it would be nice to know what you can do to help yourself out, right? Here are some tips to get you started, depending on what operating system you’re on.
What can I do?
We have a list here for you. From Mac, Windows to Chromebooks, we have you covered! In fact, we have some tips if you’re running some software as well, including popular web browsers. Take a look!
Windows 7/8: Microsoft have released patches for Meltdown/Spectre. However, you will notice a significant performance drop, they report. So, be on the lookout for this. However, we do recommend you keep your system up to date with these security updates!
Windows 10: Microsoft have already got patches out right now, mitigating these vulnerabilities. We recommend you update as soon as possible. There was a scare recently about AMD chips being “bricked” after updating, but that has since been resolved. This story is constantly on the move, however. Recently, Microsoft have released an update to fix a bad patch made by Intel.
OSX: Apple have already released software updates for you, if you’re on El Capitan or Sierra. Keep that operating system up to date! Here’s a helpful article, addressing how macOS has already patched out Meltdown and Spectre vulnerabilities.
Chrome OS (Chromebooks): Google has already addressed this issue and provided patches for all Chrome OS devices. Just make sure you keep your Chrome OS up to date! Here’s some more information on chromebooks and ChromeOS patches
What about the future?
As this is a rather new threat to consumers and businesses alike, this story will continue develop into this year. Whilst Meltdown has already been resolved for the most part, Spectre will haunt developers for years.
One can only hypothesize what the next step is in this equation. However, the best solution would be to remove the vulnerability at a hardware level. Intel have already “promised” Spectre/Meltdown proof chips this year. However, if the previous article about how Microsoft had to patch out an Intel fix is anything to go by, take this with a pinch of salt.
We will release new articles on the matter as soon as any other major developments happen. But rest assured, these vulnerabilities are going to be sticking around for a while.
Tried the above but still a little confused? Why not give your PC/laptop/MAC a full M.O.T? We’ll do a full diagnostic, both hardware and software side. From there, you’ll also get our expert recommendations on improvements or solutions to improve longevity of your device.
Feel free to give us a call on 01865 717088 and you’ll receive a call from a technician who will be able to sort out all of your problems. We also give expert advice on the next move, whatever the IT problem may be. Your next IT Solution is just a phone call away!
While you’re at it, why not join our newsletter? We’ll send you a message when our next blogpost is up and ready for consuming. Furthermore, you’ll also receive some exclusive tips and information, as well as discounts on device repairs you book in with us! So, check the footer of this page, fill in your e-mail address and click Sign up. That’s all there is to it!