If you own a personal computer (PC), laptop, smartphone, or any electronic gadgets that are powered by computer chips (processors), you should be concerned about the design flaws that were uncovered last week in all processors (CPUs) made by Intel, AMD, ARM, or any other chip manufacturer out there. And this is independent of whether or not the device has been manufactured by Apple, Samsung, Lenovo, Dell, or you have built up your device yourself. All are affected if they were built within the past 20 years.
The flaws, which are of two kinds, and respectively dubbed “Meltdown” and “Spectre,” were disclosed by Google’s Project Zero team last week. The bottom line is that an attacker might be able to steal any data on your system.
Needless to say that the industry is scrambling to find fixes for the issues and offer patches to mitigate the effects of the bugs. Obviously, this is an issue because we have hackers, without whom you would not have much to worry about. Hackers can use JavaScript code running in a browser like Chrome, Fire-fox, Internet Explorer, and so on, to access memory in your process. Such memory could contain your passwords, history of your key strokes, and other valuable bits of information.
The kernel memory areas of your device’s CPU are the focus here. Kernels in an operating system (OS) have complete control over your entire computer system, and connect applications – such as MS Word, YouTube, and your bank’s online software – to the processor random access memory and other hardware inside your computer. The flaw allows hackers to bypass the protection provided by the kernel, so that regular apps can read the contents of the kernel memory. To forestall this, Linux programmers are now separating the kernel’s memory away from your processes, in a technique referred to as “Kernel Page Table Isolation,” or KPTI for short. Linux patches have been rolling out over a month now – way before the public became aware of the security flaws.
Microsoft’s patch was reportedly deployed for supported versions of Windows 10 last week, though supported systems running older versions of Windows like Windows 7 or Windows 8 might have to wait a bit longer. Analogous to the idea behind KPTI, Microsoft is separating NT kernel memory, to address the problems. Apple is reportedly also rolling out patches to partially fix the security bug in macOS Version 10.13.2 that was released in December 2017. Apparently, Apple is mitigating the flaw by changing existing programming requirements related to the kernel memory data in macOS.
The issue with the KPTI approach is that programmers are reporting performance problems. That is, the performance (speed) of your computer/device may be slowed down by as much as 30 percent, although this number is thought to depend on the exact processor in your device. To wit, information on the specific bug had been kept confidential between software and hardware vendors, as stated by Tom Warren on his 3 January 2018 article in theverge.com. He also states that “the patches for the Linus kernel included comments that have been redacted to prevent attackers discovering the precise weakness.”
Interestingly, initially the flaw was thought to exist only in Intel chips, as AMD, the other major chip maker, denied any occurrence of the bug in its processors. This led to the soaring of AMD’s stock sometimes last week. However, it is now known that chips by all manufacturers suffer from the same problems.
The issue of computer performance taking a 30 percent hit from the patches is potentially very troubling for some. Intel’s official statement is that the extent of performance degradation will depend on the workload and that the average user will not be significantly impacted. However, no specifics on “workload” have been provided by Intel, making one feel the statement is perhaps worthless. Moreover, if they say 30 percent, who knows, the damage might actually be higher. Moreover, these chips are the engines driving clustered workhorse systems in modern day supercomputers whose only reason for existence is the ability to perform massive calculations. The effect of Meltdown and/or Spectre on the performance of such systems is anyone’s guess at this point.
It is speculated that cloud providers and virtual machines will be the most affected by the security problem in terms of performance degradation and data security problems. The common cloud services include Amazon’s Web Services, Microsoft’s Azure, Google Cloud, and Apple’s iCloud. When Spectre exploits are turned on cloud services, vulnerabilities will allow one cloud tenant to peer into the data of another co-hosted tenant; as the same server will typically be working for scores of tenants at once; and a single client program could be spread across thousands of servers in data centers across the world, sharing hardware!
A novel chip-level patch is believed to be at work at Google which may reduce the impact on performance. The technique, called Retpoline, may thus be better than KPTI.
Prevention is better than cure any day. While applying any legitimate available updates as soon as they are available, you’ll need to follow good security practices that protect your devices against malware.
Answers to last week’s quiz.
1 (c); 2 (b); 3 (a); 4 (b): False; 5 (b): False; 6 (b); 7 (b): False; 8 (b); 9 (d): You had to settle the hackers in Bitcoins; 10 (a); 11 (b) and (c); 12 (c); 13 (c); 14 (b) and (c); 15 (a); 16 (d); 17 (c); 18 (b); 19 (a); 20 (a); 21 (b); 22 (a); 23 (c).
