Meltdown and Spectre Update

With TV shows like Black Mirror captivating audiences around the world, it’s no wonder this addiction to technology is also reflected in the marketplace. This theatrical fiction became true when it revealed the vulnerabilities in technology. The press named them Meltdown and Spectre.

Both Spectre and Meltdown allow attackers to access data. The difference between the two is that Meltdown gives an attacker access to data in programs that only administrators should have access to, and Spectre makes a program reveal data that should have been kept confidential. While both are worrisome, numerous patches for Meltdown have been deployed. Spectre, on the other hand, is a bit more complicated to contain.

Spectre affects modern processors and operating systems, including chipsets from Intel, AMD, and ARM. It also affects other systems such as Android, Chrome, iOS, and MacOS. Therefore, Microsoft advises customers to seek guidance from these respective vendors. News of this broke on January 6th when Google released this comment:

“Variants of this issue are known to affect many modern processors, including certain processors by Intel, AMD, and ARM. For a few Intel and AMD CPU models, we have exploits that work against real software. We reported this issue to Intel, AMD, and ARM on 2017-06-01 [1]. So far, there are three known variants of the issue: Variant 1: bounds check bypass (CVE-2017-5753), Variant 2: branch target injection (CVE-2017-5715), and Variant 3: rogue data cache load (CVE-2017-5754).”

Spectre is responsible for variants 1 and 2 and Meltdown for variant 3.

What devices can Meltdown and Spectre affect? –Workstations, laptops, in-house servers, smartphones, and tablets. While this can be overwhelming, there is good news. Microsoft and other systems like Android, Chrome, iOS, and MacOS have already put updates in place that can effectively protect and secure your devices. The key to keeping your devices safe, after updating, is to continue to monitor and detect for any first-warning signs such as phishing emails or browser-based exploits. Spectre and Meltdown use these as vehicles to obtain your confidential data. If you limit their transport capabilities, you can effectively protect your data.

It’s terrifying enough that this could affect personal devices, but now they are far more dangerous and could possibly enter your home or business via smart-home devices. This year at CES, tech companies, such as LG and Samsung, doubled down on connected platforms built on user data. In one year, we witnessed a jump from 29% to 35.9% in smart-home device use like Alexa and Google Assistant. With this latest threat and deep infiltration of technology, it’s more important than ever for companies to ensure their smart-home platforms and servers are secure. On this note, Google, Amazon, and Microsoft all say they’ve patched their servers against known exploits.

So how do we protect ourselves from these threats? The first step is to the make sure your systems are up to date. Microsoft released several updates to help mitigate these vulnerabilities. They also took action to secure their cloud services. Microsoft says these vulnerabilities haven’t been used to attack customers at this time. They continue to work closely with industry partners including chip makers, hardware OEMs and app vendors to protect customers. It’s recommended that you use available protections, including hardware/firmware and software updates. This includes microcodes from device OEMs, and in some cases updates to antivirus software. In addition to these operating systems updates, look for firmware updates that eliminate the vulnerabilities introduced via Meltdown and Spectre.

Microsoft goes on to say that antivirus updates should be installed first. Then make sure your Windows automatic updates are turned on. (If automatic update is turned on, the updates will be automatically installed.) Also, install hardware (firmware) updates from your PC manufacturer. You may need to proactively check with the device manufacturer for updates. This could require going to a device driver update page on the manufacturer’s website.

While updating helps to secure and protect your data, it has a downside. It’s important to note that you will see a difference in your device’s performance by installing this update. This can be as high as 42 percent but is dependent on the device and its use. For example, an article in PC World states:

“Here’s how much the Meltdown and Spectre fix hurt my Surface Book performance… the sequential read and write performance doesn’t change much…But…4K performance ain’t pretty. While 4K read performance was similar, the write performance dropped by 26 percent. Far worse, though, 4K read and write with high queue depth take a performance hit of 42 percent and 39 percent, respectively. Ouch.”

The age of an Intel chip can impact the effectiveness of the patch. Navin Shenoy from Intel, explains:

“On 8th generation platforms with SSDs it’s small…the expected impact is less than 6 percent.”

Some users have experienced a much more noticeable impact with web applications that rely on JavaScript operations. The good news in all of this is that companies have banded together to fight these common adversaries, e.g., Meltdown, and Spectre. This united front against these bugs has resulted in shared patches. Similar to the U.S. military’s war on terror, companies like Netflix and Amazon have developed a united plan of attack. This collaboration gives researchers the upper hand on Spectre and Meltdown for the first time since this technological chaos began.