After Meltdown and Spectre, Another Scary Chip Flaw Emerges

At the beginning of the year, everyone was talking about processor vulnerabilities called “Meltdown” and “Spectre” that potentially exposed data in everything from servers and desktops to tablets and smartphones. The flaws, which impacted the chips in many popular devices, allowed hackers to inconspicuously manipulate a common efficiency technique used to speed data processing. As a result, chip manufacturers and software makers scrambled to issue patches and work out the performance sluggishness that came along with blocking the risky optimizations.

At the same time, though, a larger concern was also looming: Spectre and Meltdown represented a whole new class of attack, and researchers anticipated they would eventually discover other, similar flaws. Now, one has arrived.

On Monday, researchers from Microsoft and Google’s Project Zero disclosed a new, related vulnerability known as Speculative Store Bypass Variant 4 (Meltdown and Spectre collectively make up variants 1-3) that impacts Intel, AMD, and ARM processors. If exploited, an attacker could abuse the bug to access data that is meant to be stored out of reach. It particularly could expose certain components often used in web browsing that are meant to be isolated, for example, a JavaScript module that shows ads.

the original source
their explanation
their website
these details
they said
this article
this contact form
this content
this guy
this hyperlink
this link
this page
this post
this site
this website
top article
total stranger
try here
try these guys
try these guys out
try these out
try this
try this out
try this site
try this web-site
try this website
try what he says
try what she says
updated blog post
use this link
view it
view it now
view publisher site
view siteÂ…
view website
visit here
visit homepage
visit our website
visit site
visit the site
visit the website
visit their website
visit these guys
visit this link
visit this page
visit this site
visit this site right here
visit this web-site
visit this website
visit website
visit your url
visite site
watch this video
web link
web site
website link
what do you think
what google did to me
what is it worth
why not check here
why not find out more
why not look here
why not try here
why not try these out
why not try this out
you can check here
you can find out more
you can look here
you can try here
you can try these out
you can try this out
you could check here
you could look here
you could try here
you could try these out
you could try this out
your domain name
your input here
have a peek at this web-site
have a peek here

Microsoft says that the risk to users from this bug is “low,” and Intel notes that there is no evidence that the flaw is already being used by hackers. Some systems, particularly browsers, already have some protection against Speculative Store Bypass attacks just from the initial Meltdown and Spectre patches. But as was the case before, chip manufacturers and software developers are now working to release tailored fixes—and SSB raises the same types of performance problems that emerged before.

“We know that new categories of security exploits often follow a predictable lifecycle, which can include new derivatives of the original exploit,” Leslie Culbertson, Intel’s executive vice president and general manager of product assurance and security, wrote in a statement on Monday. She explains that once they are generally available, some SSB protections will be off by default, requiring users to opt into protection. “If enabled, we’ve observed a performance impact of approximately 2 to 8 percent based on overall scores for benchmarks.”

Modern processors use a technique called “speculative execution” to make educated guesses about what data to work with as they complete tasks instead of waiting to have perfect information about what to do. Meltdown, Spectre, and Speculative Store Bypass flaws are all part of a category of “speculative execution side channels” in which attackers can potentially take advantage of flaws in how processors protect data during this speculative processing to grab information that leaks out in various ways. Systems can rein this in through relatively simple software and firmware (lower level coordinating software) patches. But some updates need to be changes to a processor’s “microcode” that tweak the fundamental behavior of how a chip operates, and most software developers will be depending on chip manufacturers to first release microcode updates.

Once companies push all the various types of updates, though, users will decide case by case whether to install them, since bypassing processing efficiencies to neuter potential attacks can also slow systems down. Some Meltdown and Spectre updates caused real problems for businesses and consumers. For SSB—which seems like it may be a less dangerous bug—some users may consider the pros and cons of patching rather than immediately moving forward.

Microsoft says it began investigating SSB in November, after Spectre and Meltdown were already being researched, but before the flaws were publicly disclosed in January. In March, Microsoft also began offering a $250,000 reward for information about new variants of “speculative execution” attacks. Google’s Project Zero, Intel, and numerous other security researchers in the industry have all also been working to understand and discover other similar attacks since last year. Given how complicated it is to distribute fixes for these types of flaws, and how much of that process hinges on what manufacturers release, analysts say that the work that went into pushing patches for Meltdown and Spectre will make things a bit more streamlined when addressing the new SSB flaw.

“We all just started digging in and saying ‘that uses speculation, that uses speculation, what could be wrong there?'” says Jon Masters, chief ARM architect at the open source enterprise IT services group Red Hat, which had early access to the SSB research findings as part of industry defense collaboration. “Unfortunately but also fortunately there was a last time this happened, so as a result of Meltdown and Spectre lots of effort was put in to make sure the update process would be easier.”

Researchers also say that more time to investigate this general type of attack means there’s more confidence now that other speculative execution flaws won’t crop up all the time. And observers are relieved that today’s SSB revelation isn’t related to a more dire attack. But the danger in this class of bugs is the sheer number of devices they impact and how persistent they will be over time. Full protection can only come from replacing vulnerable equipment with new devices that contain fundamentally more secure chips. This replacement process will take years, and in the meantime lots of devices will remain exposed to these niche, but potentially effective attacks.

Leave a Reply

Your email address will not be published.