![\"spectre](\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/haunted-house-mod.jpg\")
<\/p>\n<\/p>\n
Imagine for a moment that you own a house \u00a0with a persistent termite problem. You do what you can to stop the pests: protecting your support beams, closing off entry routes, monitoring for any signs of infestation. You know you may not be able to completely remove the termites, but you believe that you can at least minimize the damage and reduce the number of infestations you experience. Maybe with a few upgrades to the house and the right pest solution, you can even reduce the problem to a negligible state.<\/span><\/p>\n Now imagine the company who built your home announced that the foundation is made of softwood and that termites could reach it every time you opened any door in the house…and that the same problem applies to all of the houses in the world. <\/span><\/p>\n That\u2019s about on par with how the revelations about Meltdown and Spectre felt like to cybersecurity professionals. The truth that microprocessors\u2019 native functions could result in key memory compromises\u2014and that even if remediation is possible it would result in significant operational slowdowns\u2014left many shocked and reeling. That these issues have existed undetected for the past two decades, affecting virtually every computer and mobile device built since 1995, only fueled the collective anxiety. \u00a0<\/span><\/p>\n These issues, nicknamed Meltdown and Spectre, are still being parsed, patched, re-patched, and debated at time of writing. It can be hard for anyone to wrap their head around. We\u2019ve already <\/span>provided<\/span><\/a> our own <\/span>coverage<\/span><\/a> and spoken with <\/span>Neil Weitzel<\/span><\/a> of Cygilant about these monumental security vulnerabilities, but this story continues to unfold. At this rate, it may prove one of the most devastating discoveries in InfoSec history. We want to make sure you have all the information you need to adequately understand and prepare against Meltdown and Spectre. Here\u2019s what we\u2019ve learned: <\/span><\/p>\n Spectre and Meltdown are security flaws embedded in the operation of microprocessors. Chips by Intel, Arm, and AMD\u2014the three largest microprocessors manufacturers\u2014all contain it; experts believe flaws are inherent in the design, rooted in the race for greater processing speeds during the home computer revolution of the mid-to-late 90s. <\/span><\/p>\n It all comes down to speculative execution. Microprocessors achieve their incredible modern speeds by essentially predicting what operation they will need to do next\u2014the user has activated X, therefore I will be called to activate Y\u2014and prerunning it so it can launch it quickly. But by prerunning operations early, speculative execution opens a backdoor to the operating systems\u2019 normally secured kernel memory\u2014where the most important data, passwords, and documents are stored. Meltdown and Spectre are the exploits of this backdoor. <\/span><\/p>\n Returning to the earlier metaphor, it doesn\u2019t matter how many barricades you place on the walls, the house\u2019s foundations are fragile and weak, ready to collapse with the right push. <\/span><\/p>\n All of the microprocessor manufacturers were made aware of Meltdown and Spectre sometime around June 2017. The public announcement of the flaws\u2019 existence did not occur until just about two weeks ago (at time of writing). <\/span><\/p>\n On one level, this does make sense\u2014reporting the issue without having some sort of patch in place is like setting out the welcome mat for hackers to conduct <\/span>zero-day attacks<\/span><\/a>. It is customary for solutions providers and manufacturers, once made aware of a security hole, to take a few months to explore the issue and generate a patch.<\/span><\/p>\n However, the patches for Meltdown and Spectre seemed to take much longer than expected, and some writers have criticized the manufacturers for a <\/span>lack of transparency<\/span><\/a>. Initially, the plan for Intel was to disclose Spectre and Meltdown during CES, the world\u2019s largest technical show, with the news under embargo until then. But the truth was revealed slightly earlier than expected, as discoveries by independent researchers forced everyone\u2019s hand. When the news did come out, there were serious deployment issues, as if the manufacturers were still unprepared. We\u2019ll discuss that in more in detail below. <\/span><\/p>\n Adding fuel to the suspicions, Intel\u2019s CEO Brian Krzanich sold the maximum amount of stock he is legally allowed to in Q4\u2014 before the news became public but after Intel was informed of Spectre and Meltdown. There is now a very real possibility of an SEC investigation. Even if the sale was legal as Krzanich contends, it does not speak confidence to Intel\u2019s (and other chip manufacturer\u2019s) ability to solve the problem. <\/span><\/p>\n Yes, despite having two names, Spectre and Meltdown are in fact three variations on the same abuse of the speculative execution processes. Spectre is actually two different vulnerabilities that forces programs to reveal secure data to attackers. It requires more sophisticated knowledge of the program\u2019s inner mechanics and only works on individual programs, but it can work on almost any chip. Both variants are more challenging to fix than Meltdown, with the second variant \u201cBranch Target Injection\u201d proving to be extremely difficult to solve without serious performance compromises.<\/span><\/p>\n By contrast, Meltdown uses speculative execution to gain access to all of a systems data that would normally be secure, including the data of other programs and information that only administrators should have access to. While easier to \u201csolve,\u201d many of the complaints of slow downs we\u2019ll explore in more detail below stem from the Meltdown mitigation processes. \u00a0\u00a0<\/span><\/p>\n To their credit Intel, Arm, AMD, Microsoft, and Google among others are releasing patches and possible solutions as quickly as they can to fix Spectre and Meltdown. But problems with the patches are emerging. Overall, the patches have been reported as buggy and potentially damaging.<\/span><\/p>\n Intel has asked people to no longer use the microcode update to defend against Spectre after numerous reports of systems crashes from the patch. Microsoft had to halt deployment of the AMD chip patch after complaints arose that they were causing Blue Screen of Death errors. In the first days of the patches, the patches were known to clash with certain anti-virus solutions; Microsoft responded by essentially holding all of its updates hostage until solutions providers registered as compatible with the patches. <\/span><\/p>\n Even though most solutions providers should be integrated with the patches now, older solutions or apps that no longer update should be removed as the manufacturers will not create patches for them. Indeed, endpoint security vendor <\/span>Crowdstrike<\/span><\/a> notes that those most at risks are those with older browsers and lesser-known applications with vendors not up-to-date with these vulnerabilities\u2014and the microprocessor manufacturers appear to be confirming this observation. Intel only provided patch benchmarks for the latest Intel processors, leaving older models behind. <\/span><\/p>\n Microsoft withdrew its AMD systems patch after crashes, and industrial manufacturers are experiencing product driver incompatibilities with Meltdown patches and are currently avoiding implementation until these are resolved.\u00a0<\/span><\/p>\n As of time of writing, no wild permutation of a Meltdown and Spectre attack has appeared. That\u2019s the good news. However, researchers state with confidence that hackers are getting closer by the day; their academic studies have gotten remarkably close to cracking how to utilize the exploits. That\u2019s the bad news. <\/span><\/p>\n If the patches cannot adequately protect against Spectre and Meltdown by the time a hacker figures out how to weaponize them, then literally almost every person on earth is left vulnerable. Sensitive data will have no respite, and sandboxing would be an exercise in futility. It would represent some of the most potent malwareless attack vectors ever conceived. <\/span><\/p>\n\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2020\/02\/SIEM_VM_SB.jpg\")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\nA Quick Refresher<\/b><\/h3>\n
Intentional Delays in the Response<\/b><\/h3>\n
Meltdown and Spectre are Actually Three Different Vulnerabilities<\/b><\/h3>\n
The Patches Aren\u2019t Working Well…Or Aren\u2019t Being Deployed at All<\/b><\/h3>\n
No One Has Weaponized Meltdown or Spectre…Yet<\/b><\/h3>\n