On The Hill: Radar Hill Blog

Meltdown and Spectre – Flaws in the System

Est. reading time 5 minutes

A few years ago, Heartbleed was all over the news, and in the beginning 2018 Meltdown and Spectre have been making the rounds. But what are they exactly? While they sound like they should belong in a James Bond film, they are essentially faults in the system that could lead to sensitive data being accessed. While there hasn’t actually been any large-scale data breach, the potential for one is there, which is why people are concerned about it. We’re going to do our best to explain it to you below.

What Is It?

Meltdown and Spectre are the names given by researchers to flaws found in CPUs (Computer Processing Unit), typically made by Intel or AMD. Meltdown breaks the mechanism that keeps applications from accessing arbitrary system memory. Consequently, applications can access system memory. Spectre tricks other applications into accessing arbitrary locations in their memory. Both attacks use side channels to obtain the information from the accessed memory location.

Meltdown is so-called because it basically “melts security boundaries which are normally enforced by the hardware.” Spectre’s name is “based on the root cause, speculative execution. As it is not easy to fix, it will haunt us for quite some time.”

Essentially, Spectre and Meltdown are variants of the same technique: accessing data that they shouldn’t have access to. These two flaws allow programs to read data that they are not meant to be reading. This could be any information, from basic messages, to encrypted keywords and passwords. The way that they can read this data, is from a technique called “speculative execution.”

Why Has This Happened?

A computer has to shuffle around a huge amount of data as it responds to a user’s commands, clicks, and key presses. The core part of a computer’s operating system, known as the kernel, handles this data coordination. The kernel moves data between different sorts of memory on the chip and elsewhere in the computer. Computers are programmed to give you the data you want in the fastest way possible, and it is in this area that vulnerabilities have been discovered.

Speculative execution is an optimization technique where a computer system performs some task that may not be actually needed. The main idea is to do work before it is known whether that work will be needed at all, so as to prevent a delay that would have to be incurred by doing the work after it is known that it is needed. If it turns out the work was not needed after all, most changes made by the work are reverted and the results are ignored.

In other words, modern CPUs are designed to execute code even if it doesn’t need to. Without writing out confusing computer code, basically, if the value of a line was not known, the CPU either has to get that information from the internal main memory, or from a cache of that memory. Going to the main memory however takes 200 times slower than simply going to the cache, and so a CPU will make a prediction based on memory, and cache information, and this cached information can be accessed by Spectre.

Why Is It Bad?Skull and data

These are multiple vulnerabilities that have been exposed at the same time. According to Google’s Project Zero security team, in a worst-case scenario the flaws could be exploited to reap sensitive information that is currently encrypted. Essentially the fear is that attackers would exploit the flaws to gain access to parts of the computer’s memory, which may be storing sensitive information. It could be very easy to take data from your PC, as the code could be added for example to a JavaScript that is downloaded from a website, and once it is on your PC it can download information from the other webpages you are visiting, including passwords and banking details

Any desktop, laptop, or Cloud-accessing computer may be affected by Meltdown. If it has an Intel processor which implements out-of-order execution it could be affected, which is essentially all processors since 1995. Because the issue is stemming from the actual hardware, this cannot be fixed by switching your Operating System. According to the CBC, since the flaws detailed by researchers are fundamental to the design of modern processors, the only way to truly prevent any attacks is for Intel, AMD and ARM to redesign their chips entirely. Of course, that’s not going to be practical for most people and businesses, and so hardware and software companies are attempting to mitigate the two flaws’ effects with software updates.

How To Protect Yourself

Firstly, whenever there is an update on your computer, you should let it update and not perpetually hit the snooze button for the alert. Do not just put your PC to sleep, but shut it down and let it restart when it needs to, as usually there are important security updates that get installed. You should update your web browsers and other programs regularly, and of course, have secure passwords. We have hosted password security workshops in the past as is it an important and lengthy topic, but suffice to say that make sure your passwords are long, different from each other, and contain numbers and special characters. As well, having Anti-Virus software installed is a fundamental aspect of protection for any and all of your devices.

For Meltdown and Spectre specifically, there are patches that have been rolled out. Microsoft has released a cumulative security update which offers software-level protection against speculative execution. Android and Apple have been updating their software to try and mitigate the risk. While web servers can be vulnerable, rest assured that we ensure that the latest security is installed for your website.

Google Chrome users can enable an experimental security feature in the Chrome web browser called Site Isolation, which provides protection against many different types of malware, including speculative execution.

If Heartbleed and now Meltdown and Spectre have shown us anything, it’s that there is no such thing as automatic security. Unfortunately, anything can be vulnerable, as can clearly be seen by these processors which have been around for twenty years with the flaw only being discovered recently. That is not to say that you should shut everything down and live in a cave, rather just be aware of the reality of the 21st century. Ensure that all your devices and programs are kept up to date, and have secure passwords, and your risk of your sensitive information being breached is widely reduced.