Have you heard of the Meltdown and Spectre security flaws? They are so fundamental and widespread that many security experts are calling them catastrophic.
In brief, the Meltdown and Spectre bugs are vulnerabilities that could allow computer programs to access data they should not be allowed to see. Potentially sensitive information on your computer or server could be at risk. Combating these vulnerabilities is as easy as installing updates, however certain antivirus applications are causing issues with these updates.
What is the vulnerability?
Well, here is how it works.
Meltdown and Spectre make use of a normal function of processors — the fundamental technology that runs a computer.
To enhance performance, most processors try to speculate what the computer program is going to do in the future. This is known as “speculative execution”.
If the processor guesses incorrectly, it does not apply the changes and instead continues from where it began. However, evidence of what the processor was attempting to do linger. This is where sensitive information can be retrieved.
Processors built since 1995, and those built by Intel, AMD and ARM, are affected by these bugs.
How does this affect you?
You’ll want to keep up to date with all security updates from Microsoft. Google, Firefox and Internet Explorer browsers are all receiving updates in the coming month, so keep up to date with these.
However, before rushing to do the updates straight away, speak to your IT Professionals. Microsoft has noted that, unless a registry key is updated within your antivirus package, installing the security patch can result in a blue screen of death (BSoD). Some anti-virus companies have released updates for this, but some haven’t.
In addition to the anti-virus changes, Intel have admitted that there may be some performance issues with the new updates, and SYSmark tests (SYSmark is a benchtest program) that have assessed post-patch PC’s show that the slow down ranges from two per cent to 14 per cent, so once the patches and updates are applied, you’ll likely notice some performance issues with the PC.
Meltdown and Spectre – Not the same bug
Despite being very similar exploits, Meltdown and Spectre are two different bugs. Meltdown is the bug being patched, and it affects Intel PC processors and the Arm Cortex-A75 that is yet to ship. Reportedly it is easier to patch and resolve.
Spectre, however, has been shown to exist on Intel Ivy Bridge, Haswell and Skylake processors, AMD Ryzen CPUs, and several ARM-based Samsung and Qualcomm system-on-chips used for mobile phones. There are two variants of Spectre.
Variant 1 has some updates to web browsers, applications and Operating Systems available to help mitigate the exploit. Variant 2 requires CPU microcode updates, which have been released in the past by Microsoft Updates. Hopefully they will be released the same way this time. Variant 2 may also, in the future, be resolved by installing a new CPU.
For information on the latest Microsoft updates, have a look at the Microsoft website.
To read more about these bugs and current solutions, have a look at this page of the Homeland Security website
Looking for IT Support in Perth? Partner with the experts at Rule Technology and keep your Servers and PC’s up to date. Connect with us today.
