Meltdown of CPUs: Spectre is hunting you! (security holes)

[LennStar]

More information is out on yesterday’s vulnerabilities of CPUs. Yes, you read that right, it’s *plural*. There are actually 2 vulnerabilities, named Meltdown and Spectre, that can potentially be used in 4 different exploits. Those vulnerabilities allow an attacker to read everything in your memory - like the passwords you ust used for your online banking.

> Which systems are affected by Meltdown?
Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

> Which systems are affected by Spectre?
Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.

> Which cloud providers are affected by Meltdown?
Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.

> What is the difference between Meltdown and Spectre?
Meltdown breaks the mechanism that keeps applications from accessing arbitrary system memory. Consequently, applications can access system memory. Spectre tricks other applications into accessing arbitrary locations in their memory. Both attacks use side channels to obtain the information from the accessed memory location.

Source of the quotes, from the security researcher’s website: https://spectreattack.com/
Project Zero technical explanation https://googleprojectzero.blogspot.de/2018/01/reading-privileged-memory-with-side.html

[Syonyk]

Actually, the Project Zero stuff is separate from the Meltdown/Spectre papers. :)  It's a whole plethora of ways your CPU doesn't keep secrets anymore!

[LennStar]

Actually, the Project Zero stuff is separate from the Meltdown/Spectre papers. :)  It's a whole plethora of ways your CPU doesn't keep secrets anymore!

Yes, but the 2 attcks were discovered during the project.

-----

Update (copied, so it may be a bit awkward looking)

Yesterday I wrote about the official announcements of those 2 serious attacks.
https://steemit.com/news/@LennStar/meltdown-of-cpus-spectre-is-hunting-you

As I wrote, the programmers are feverishly working on upgrades. (That will still make your computer slower depending on what type of program, luckily games seem to suffer nearly not at all.)
iOS / Apple too

Apple now confirmed that it's iOS is also vulnerable.

https://support.apple.com/en-us/HT208394
Updates (OS)

Win 10 already has updates, but depending on your virus scanner you may not get them. (Some virus scanners will seriously damage the system without compatibility with the new patch, do NOT install the patch manually if you are not sure.

(Generally on Win10 3rd party virus scanners may be more dangerous then "only" using the Win10 included one, but that is a different story).

Win 7 seems to have it too, because my Win 7 rig just got this:

    KB4056894 (Monthly Rollup)
    Gilt für: Windows Server 2008 R2 Service Pack 1, Windows 7 Service Pack 1

Which tells you in the information the thing with the virus scanners.

Linux is still working on updates.
Updates (browser)

Firefox has released 57.0.4. with a fix, and Microsoft
for Edge and IE (KB4056890)

I am not sure, but it sounds like all those browser fixes (means they only stop viruses running in your browser but not outside programs) are not complete fixes but only making it harder to exploit the weaknesses.
Anyway you will still need to upgrade your OS.

Safari: "in the following days".