- On 3 January Meltdown and Spectre were made public, two design flaws affecting Intel, AMD and ARM chips.
- Under certain conditions they allow a program to read information it should not see, such as passwords or keys.
- The response is to update systems, browsers and devices, and to review cloud services and shared environments.
On 3 January 2018 two vulnerabilities were made public, nicknamed Meltdown and Spectre, which affect a technique used by almost all modern processors to run faster. Among the researchers who reported them was Google’s Project Zero team. Meltdown mainly affects Intel processors; Spectre affects Intel, AMD and ARM chips.
This is neither a virus nor a bug in a particular program, but a flaw in the way processors get ahead of their work. That is why the reach is so wide: computers, servers, phones and network equipment may all be affected. For companies of any size, the question is what to do as soon as updates become available.
What happens inside the chip
To go faster, a processor does not wait to know which instruction comes next: it runs it ahead of time, speculatively, and discards the result if it guessed wrong. Researchers found that even when the result is discarded, that execution leaves measurable traces. With clever techniques, a malicious program can use those traces to deduce data that is not its own.
Meltdown lets a program without permission read memory reserved for the operating system. Spectre is harder to exploit, but also harder to eliminate: it can trick other programs into leaking their own information. In both cases the attacker needs to be able to run code on the machine, which is less likely on restricted devices. The researchers also stress that these attacks leave no obvious traces in ordinary logs, which makes them hard to detect afterwards and reinforces the importance of prevention through updates and of limiting which code can run on each device.
Where the risk weighs most
The risk is greater where programs from different users share a single physical machine, such as cloud services and shared servers. It also matters in browsers, which run third-party code when opening web pages. On an office computer with no other uses the danger is more limited, but not zero. In practice, small companies depend mainly on their suppliers of equipment, cloud services and software: they are the ones who publish the fixes, and someone in the company should know what has been installed and when.
Manufacturers and the developers of operating systems and browsers began to release patches. Some fixes may cost some performance, depending on the type of workload, and others require updating the device’s firmware. That is why changes should be tested in critical environments before being rolled out widely. The large cloud providers published advisories and updated their infrastructure in the first days, but customers who manage their own virtual machines must also update the operating systems installed on them.
What to review
A first step is to take stock: which computers, servers and devices the company has, and who is responsible for updating them. Next, check with cloud and hosting providers what measures they have applied and by when. And verify that operating systems, browsers and antivirus software update automatically.
There is also a legal dimension. European data protection rules, which become fully applicable in May, require technical measures appropriate to the risk. Keeping systems up to date and recording what was done is good practice, and may help if the company ever has to show its diligence. If the company outsources its IT, it is worth asking the provider for a simple report of the updates applied and pending, and appointing an internal person to review it periodically.
IT security starts with knowing which devices you have and keeping them up to date.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
