FRANKFURT/SAN FRANCISCO (Reuters) - Security researchers on Wednesday disclosed a set of security flaws that they said could let hackers steal sensitive information from nearly every modern computing device containing chips from Intel Corp, Advanced Micro Devices Inc and ARM Holdings.

One of the bugs is specific to Intel but another affects laptops, desktop computers, smartphones, tablets and internet servers alike. Intel and ARM insisted that the issue was not a design flaw, but it will require users to download a patch and update their operating system to fix.

“Phones, PCs, everything are going to have some impact, but it’ll vary from product to product,” Intel CEO Brian Krzanich said in an interview with CNBC Wednesday afternoon.

Researchers with Alphabet Inc’s Google Project Zero, in conjunction with academic and industry researchers from several countries, discovered two flaws.

The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.

The researchers said Apple Inc and Microsoft Corp had patches ready for users for desktop computers affected by Meltdown. Microsoft declined to comment and Apple did not immediately return requests for comment.

Daniel Gruss, one of the researchers at Graz University of Technology who discovered Meltdown, called it “probably one of the worst CPU bugs ever found” in an interview with Reuters.

Gruss said Meltdown was the more serious problem in the short term but could be decisively stopped with software patches. Spectre, the broader bug that applies to nearly all computing devices, is harder for hackers to take advantage of but less easily patched and will be a bigger problem in the long term, he said.

Speaking on CNBC, Intel’s Krzanich said Google researchers told Intel of the flaws “a while ago” and that Intel had been testing fixes that device makers who use its chips will push out next week. Before the problems became public, Google on its blog said Intel and others planned to disclose the issues on Jan. 9. Google said it informed the affected companies about the “Spectre” flaw on June 1, 2017 and reported the “Meltdown” flaw after the first flaw but before July 28, 2017.

The flaws were first reported by tech publication The Register. It also reported that the updates to fix the problems could causes Intel chips to operate 5 percent to 30 percent more slowly. (bit.ly/2CsRxkj)

Related Coverage Factbox: What you need to do about newly discovered computer chip flaws

Intel denied that the patches would bog down computers based on Intel chips.

“Intel has begun providing software and firmware updates to mitigate these exploits,” Intel said in a statement. “Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

ARM spokesman Phil Hughes said that patches had already been shared with the companies’ partners, which include many smartphone manufacturers.

“This method only works if a certain type of malicious code is already running on a device and could at worst result in small pieces of data being accessed from privileged memory,” Hughes said in an email.

AMD chips are also affected by at least one variant of a set of security flaws but that it can be patched with a software update. The company said it believes there “is near zero risk to AMD products at this time.”

Google said in a blog post that Android phones running the latest security updates are protected, as are its own Nexus and Pixel phones with the latest security updates. Gmail users do not need to take any additional action to protect themselves, but users of its Chromebooks, Chrome web browser and many of its Google Cloud services will need to install updates.

Amazon Web Services, a cloud computing service used by businesses, said that most of its internet servers were already patched and the rest were in the process of being patched.

The defect affects the so-called kernel memory on Intel x86 processor chips manufactured over the past decade, The Register reported citing unnamed programmers, allowing users of normal applications to discern the layout or content of protected areas on the chips.

That could make it possible for hackers to exploit other security bugs or, worse, expose secure information such as passwords, thus compromising individual computers or even entire server networks.

Dan Guido, chief executive of cyber security consulting firm Trail of Bits, said that businesses should quickly move to update vulnerable systems, saying he expects hackers to quickly develop code they can use to launch attacks that exploit the vulnerabilities. “Exploits for these bugs will be added to hacker’s standard toolkits,” said Guido.

FILE PHOTO: Intel's logo is pictured during preparations at the CeBit computer fair, which will open its doors to the public on March 20, at the fairground in Hanover, Germany, March 19, 2017. REUTERS/Fabian Bimmer/File Photo

Shares in Intel were down by 3.4 percent following the report but nudged back up 1.2 percent to $44.70 in after-hours trading while shares in AMD were up 1 percent to $11.77, shedding many of the gains they had made earlier in the day when reports suggested its chips were not affected.

It was not immediately clear whether Intel would face any significant financial liability arising from the reported flaw.

“The current Intel problem, if true, would likely not require CPU replacement in our opinion. However the situation is fluid,” Hans Mosesmann of Rosenblatt Securities in New York said in a note, adding it could hurt the company’s reputation.</s>What are Meltdown and Spectre? Do they only affect Intel chips? Will the fixes slow my computer … and what even is a processor?

Meltdown and Spectre are the names of two serious security flaws that have been found within computer processors. They could allow hackers to steal sensitive data without users knowing, one of them affecting chips made as far back as 1995.



What are Meltdown and Spectre?

Meltdown is a security flaw that could allow hackers to bypass the hardware barrier between applications run by users and the computer’s core memory, which is normally highly protected.

Spectre is slightly different. It potentially allows hackers to trick otherwise error-free applications into giving up secret information.

Is it serious?

Yes. Meltdown is “probably one of the worst CPU bugs ever found” according to Daniel Gruss, one of the researchers at Graz University of Technology who discovered the flaw. It is very serious in the short term and needs immediate attention.

The problem with Meltdown is that anything that runs as an application could in theory steal your data, including simple things such as javascript from a web page viewed in a browser.

Spectre, on the other hand, is harder for hackers to take advantage of but is also more difficult to fix and is expected to be a bigger problem in the long term.

What kinds of devices are affected?

Practically every computing device affected by Spectre, including laptops, desktops, tablets, smartphones and even cloud computing systems. A few lower power devices, such as certain Internet of Things gadgets, are unaffected.

What is a processor?

The processor, or central processing unit (CPU), is the primary chip in a computer that carries out the instructions of a computer program – in essence, the brain of the computer.

When you command a program to do something, it is the processor that carries out that command, co-operating with the rest of the system to perform whatever task is needed.

There are other types of processors, including graphics processing units (GPU) or graphics cards, co-processors such as sensor chips that detect motion or similar physical conditions, but the term “processor” without a caveat is generally exclusively used to describe the CPU.

Does it only affect Intel processors?

Spectre affects all modern processors, including those designed by Intel, AMD and ARM, but Meltdown is currently thought only to affect Intel chips manufactured since 1995, with the exception of the Itanium and Atom chips made before 2013.

What can be stolen?

Facebook Twitter Pinterest Credit cards could be at risk due to Meltdown. Photograph: Alamy Stock Photo

The core system, known as the kernel, stores all types of sensitive information in memory. This means banking records, credit cards, financial data, communications, logins, passwords and secret information could which is all be at risk due to Meltdown.

Spectre can be used to trick normal applications into giving up sensitive data, which potentially means anything processed by an application can be stolen, including passwords and other data.

Is it already being used to steal data?

The UK’s National Cyber Security Centre said that there is no evidence that Meltdown and Spectre are actively being used to steal data at the moment, but the nature of the attacks make them difficult to detect.

Experts expect that hackers will quickly develop programs to launch attacks now that the information is available. Dan Guido, chief executive of cybersecurity consulting firm Trail of Bits, said: “Exploits for these bugs will be added to hackers’ standard toolkits.”

What can I do about it?

Users can do little to avoid the security flaws apart from update their computers with the latest security fixes as soon as possible. Fixes for Linux and Windows are already available. Chromebooks updated to Chrome OS 63, which started rolling out in mid-December, are already protected.

Android devices running the latest security update, including Google’s Nexus and Pixel smartphones, are already protected. Updates are expected to be delivered soon. Users of other devices will have to wait for the updates to be pushed out by third-party manufacturers, including Samsung, Huawei and OnePlus.

On Thursday night, Apple advised customers in a blog post to update their devices’ operating systems and only download software from “trusted sources such as the App Store”. The company also said that “there are no known exploits impacting customers at this time”.

Will the fixes slow my computer?

While the fixes for Spectre are not expected to have much immediate impact on the performance of computers, the nature of the fixes needed to protect against Meltdown could have a significant impact.

That’s due to the separation of the application and kernel memory required by the various operating systems to prevent the flaw being used to access protected data. Separating the two memory systems like this means that tasks that constantly require the kernel do to things, such as writing files to disk or sending data over a network, could be significantly slower due to the increased time it will take for the processor to switch between the application memory and the kernel memory.

Some early estimates predict up to 30% slower performance in some tasks. Whether users will notice a difference on their computers will depend on the task they are trying to do. Gaming, browsing and general computing activities are unlikely to be affected, but those that involve lots of writing files may become slower.

Some technologies, such as Intel’s Process-Context Identifiers (PCID) that was included with the company’s processors since 2013, can lessen the impact of the fixes if taken advantage of in the operating system.

Who found it?

Meltdown was independently discovered and reported by three teams, including Jann Horn from Google’s Project Zero, Werner Haas and Thomas Prescher from Cyberus Technology and Daniel Gruss, Moritz Lipp, Stefan Mangard and Michael Schwarz from Graz University of Technology in Austria.

Spectre was independently discovered by two people, including Horn and Paul Kocher, who worked in collaboration with Daniel Genkin, from University of Pennsylvania and University of Maryland, Mike Hamburg from tech firm Rambus, Lipp, and Yuval Yarom from the University of Adelaide and Data61.

What about cloud services?

The problem is magnified for cloud services such as Amazon’s Web Services and Google’s Cloud Platform, due to the scale of their computing resources and the potential impact on performance of the fixes.

Amazon said it was in the process of patching systems with all but a “small single-digit percentage” of its Amazon Web Services EC2 systems already protected, but that “customers must also patch their instance operating systems” to be fully protected.

Google also said that the majority of its systems were updated, but that some additional customer action may be needed for its Compute Engine and other Cloud Platform systems.

Microsoft said it was in the process of deploying fixes to its cloud systems.

This article contains affiliate links, which means we may earn a small commission if a reader clicks through and makes a purchase. All our journalism is independent and is in no way influenced by any advertiser or commercial initiative. By clicking on an affiliate link, you accept that third-party cookies will be set. More information.</s>After building speculation fueled by media reports (including our own) ahead of a planned coordinated release, researchers at Google, academic institutions, and other companies have revealed a pair of attack classes this afternoon that exploit fundamental operating principles of modern CPUs to allow attackers to arbitrarily read data from the memory of vulnerable systems.

The first, called "Meltdown," breaks down CPU-level protections that prevent unprivileged applications from reading arbitrary system memory, including privileged memory locations corresponding to the operating system's kernel, using what the researchers describe as side effects of out-of-order execution on modern processors.

According to the Meltdown paper, the researchers were able to successfully perform the Meltdown attack using unprivileged code on Intel microarchitectures because of a privilege escalation vulnerability specific to that company's CPUs, but could not successfully execute the full version of the attack on AMD and ARM CPUs.

The researchers warn that every Intel CPU employing out-of-order execution could be vulnerable to the Meltdown attack, which is to say all Intel chips dating back to the Pentium Pro are vulnerable outside of some in-order Atom cores. The principle of kernel page table isolation (KPTI) described in our earlier news post on this topic was not specifically designed to mitigate this attack, according to the researchers, but it does effectively stop an attacker from exploiting this vulnerability.

The researchers urge the adoption of KPTI-style mitigations for Meltdown as soon as possible—something that macOS, Windows, and Linux have done or are in the process of doing.

The second class of attack, called Spectre, apparently allows similar leaking of memory contents through misdirection of certain speculative execution features present in all modern CPUs. The researchers say they have verified the attack on processors from Intel, AMD, and ARM. The researchers further note that Spectre attacks are harder to carry out but also defy easy mitigation, as with Meltdown.

Intel has not provided information regarding its response to these attacks beyond its initial statement this afternoon, but AMD claims that at worst its CPUs have a "near zero risk of exploitation" in a dedicated page on its site. ARM has provided a detailed list of affected products and potential workarounds on its site.

At the software level, Google has detailed steps that it's taking to limit the scope of these vulnerabilities in its own products. Microsoft has also pushed an out-of-band security update for Windows and plans to aggressively begin rebooting affected Azure virtual machines this afternoon. As always when discussing this type of vulnerability, we suggest keeping all software as up-to-date as possible as soon as possible.</s>Jan. 3 (UPI) -- Billions of devices might be at risk after researchers found two security flaws inside Intel chips that allow hackers to enter processors and steal sensitive data.

Intel chips have been installed in devices since 1995 and the researchers said every device now contains those security flaws. But the flaws aren't limited to personal devices. Cloud providers like Amazon Web Services, Microsoft Azure and Google Cloud Platform may also be affected.

The two bugs are called Meltdown and Spectre, with the latter being potentially more widespread.

"Almost every system is affected by Spectre," researchers said in a report. "Desktops, laptops, cloud servers, as well as smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD and ARM processors."

"More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995, except Intel Itanium and Intel Atom before 2013."

The researchers said they successfully tested Meltdown on Intel processor generations released as early as 2011.

"Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown," they said.

The main difference between the two bugs is that Meltdown "breaks the mechanism that keeps applications from accessing arbitrary system memory," while Spectre "tricks other applications into accessing arbitrary locations in their memory."

After researchers released their assessment of the bugs, Intel issued a statement that the security flaw is not unique to their chips.

"Based on the analysis to date, many types of computing devices -- with many different vendors' processors and operating systems -- are susceptible to these exploits," Intel said.

Intel advised people with Intel chips in their devices to contact their operating system vendor or system manufacturer and apply any available updates.

Daniel Gruss, a security researcher who discovered the Meltdown bug, told ZDNet that any data can be accessed through the security flaws.

They are "going to haunt us for years," he said.</s>Security researchers have now disclosed two new exploits that can be executed against modern processors. Dubbed Meltdown and Spectre, the exploits use similar methods to impact processors from Intel, AMD, and ARM across PCs, mobile devices, and in the cloud. The researchers explain:

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Meltdown and Spectre are both distinct attacks, but they both allow attackers to break isolation between applications to access information. Perhaps the most distinct difference, however, is the specific processors affected by each attack. Meltdown, the researchers say, has only been assessed to impact Intel processors. However, the range of potentially affected processors is vast.

More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Spectre, on the other hand, appears to have a much wider reach. According to researchers, nearly every type of device is affected by Spectre; it has been verified to work across Intel, AMD, and ARM processors. Spectre is harder to exploit than Meltdown, but researchers caution that it is also harder to guard against.

The attacks also work against cloud servers, which could leave customer data vulnerable.

Fortunately, at least some fixes are on the way. There are patches against Meltdown for Linux, Windows, and macOS, and Microsoft is currently rolling out an emergency patch for the issue. Spectre is not an easy fix, it seems, and the researchers say that there is ongoing work to "harden software against future exploitation of Spectre, respectively to patch software after exploitation through Spectre."

You can read more on Spectre and Meltdown, including more technical details, in the researchers' full report.</s>Most of us use computers which house Intel and AMD processors, and then you have the Windows or Linux or macOS operating systems running on them. While the AMD processor running systems are supposedly fine, those running on Intel chips will need to gear themselves for some bad news: A security flaw discovered in the Intel chips that were made after 1995, requires an OS level update, which is expected to bring down the processor performance by 5 to 30 percent.

There is a lot of news floating about this security flaw, which was discovered by The Register, but in case you are still confused about what the fuss is all about, let us try and address the issue for you.

Here is everything you need to know about the Intel chipset security flaw.

So what is this Intel security flaw?

Intel chips that were made post-1995 have been discovered to have a security flaw or bug. According to this, there is a bug at the kernel level which has been found to be leaking memory. This could let hackers access or read your sensitive data such as passwords, login keys and more from the chip itself. In the extreme cases, hackers could also insert malware into your PCs via this opening. This vulnerability isn't just limited to individual PCs, but could also affect servers in data centres that run cloud computing services. Think Amazon Web Services!

Think of the kernel as the central nervous system of an operating system. It is like the god program that controls other programs running on your machine. Every multi-tasking operating system uses a kernel, so that includes Windows, Linux, Android, iOS, macOS and so on.

The diagram above shows how the kernel is the mediator between the software and the device hardware such as the processor, memory as well as other plugged devices. So in a sense, it manages the memory resources, CPU resources as well as the processes required to run the software. Any time you fire up an application, turn on Bluetooth or Wi-Fi, turn on that game — everything goes through the kernel. Your PC is switching between the user mode and the kernel mode to ensure that instructions being given to your system are giving the right results.

The flaw appears to be letting attackers bypass the protections surrounding the kernel access, which lets any regular app read the contents of the kernel memory.

Which systems are affected? How do I find out if my system is also affected?

Any system with an Intel chip is affected by the flaw. The speculation is that this bug is affecting all Intel x86 processors irrespective of the OS running on the system. There is no way to know it, as there are no traces left in traditional log files. Desktops, laptops and even cloud computers running on Intel chips have been affected. Since it is an x86 chip issue, systems running Linux, Windows, as well as macOS, have been affected. The Python Sweetness blog notes that the attack could impact common virtualisation environments such as Amazon's EC2 and Google Compute Engine.

Meltdown is the name given to the vulnerability which affects Intel chips whereas Spectre is the name been given to vulnerabilities in other chip vendors and affects all chips, including ARM, Intel and AMD.

Meltdown is an exploit that breaks the secure separation layer between user applications and the operating system. Memory spaces between applications are segregated and protected to prevent accidental interference with each other's data. Meltdown lets malicious software break this protection. This attack lets a program access the memory and the operating system. Systems with vulnerable processors and those running an unpatched OS, need to beware and not work with sensitive information. It was discovered by Jann Horn (Google Zero Project), Werner Haas and Thomas Prescher (Cyberus Technology) and Daniel Gruss, Moritz Lipp, Stefan Mangard, Michael Schwarz (Graz University of Technology). Here are the patches to fix the Meltdown exploit.

Spectre, on the other hand, breaks the isolation between different applications, which will let hackers into tricking programs to leak their secrets. This affects not just PCs, but also mobile phones, embedded devices and other devices housing a chip. Spectre was reported by Jann Horn (Google Project Zero) and Paul Kocher in collaboration with, in alphabetical order, Daniel Genkin (University of Pennsylvania and University of Maryland), Mike Hamburg (Rambus), Moritz Lipp (Graz University of Technology), and Yuval Yarom (University of Adelaide and Data61).

According to this FAQ, there is no known misuse by exploiting the Meltdown or Spectre vulnerabilities that have been recorded yet.

How will it affect me?

The bug lets hackers get access to the kernel memory. Now as we read above, everything passes through the kernel when it comes to the operating system. So the kernel memory could house some private data which is accessible to hackers.

How is the issue being resolved? What do I have to do?

In the ideal scenario, it is a chip issue and Intel should be fixing it. But experts say that the fix cannot be implemented as a microcode update, and has to be fixed at the OS level.

According to TechCrunch, Meltdown can be fixed by having a stronger wall around the kernel; the technical term is “kernel page table isolation.” This will make the kernel invisible to the running processes. Spectre will take some time to get fully fixed.

In the long term, Spectre could be more serious than Meltdown. While Meltdown can be fixed, albeit, with a performance hit, Spectre seems almost impossible to fix completely and will possibly require a complete rework of how a modern CPU functions. Fixes for Spectre affect only known vulnerabilities. An analogy would be a leaky ship. You know you're taking on water, just not where it's coming from, and you're patching holes as and when you find them.

Linux devs have released a kernel patch. Microsoft is expected to release its security patch soon as part of Patch Tuesday on 9 January. Microsoft has tested it on the Windows Insider preview build. Apple claims that its systems are protected against the exploit with the macOS 10.13.2 release, and additional safeguards will come out with macOS 10.13.3.

As a user, you will have to be on top of any security update that your OS releases and ensure that your system is updated with it. Also, ensure your security software is monitoring for any untoward activity. Intel has also advised running your security software at regular intervals.

Will everything be back to normal after the patch addresses the bug?

Well yes, but there's a catch. The OS level fix is expected to prevent kernel memory from leaking, so that's a good thing. But this will come at the cost of your system performance coming down in the range of 5 to 30 percent, according to The Register. User PCs having Intel 4th gen processors will not suffer as much as those sporting older processors. Virtualisation applications and data centre or cloud workloads are expected to be affected more. Intel says that the performance hit depends on the workload and won't be much for average home PC users. Amazon Web Services has warned customers in an email to expect a major security update to come on Friday.

AMD has released a statement saying that machines sporting AMD processors are not affected by this bug. "AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault," said AMD.

In such a scenario, AMD processor housing systems should not be affected. But if the OS vendor does not make exceptions for the change in OS level code from affecting AMD systems, then there could be some performance hit. As of now, this is in the realm of speculation.</s>“Researchers with Alphabet Inc’s Google Project Zero, in conjunction with academic and industry researchers from several countries, discovered two flaws,” Busvine and Nellis report. “The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.”

“Speaking on CNBC, Intel’s Krzanich said Google researchers told Intel of the flaws ‘a while ago’ and that Intel had been testing fixes that device makers who use its chips will push out next week,” Busvine and Nellis report. “Before the problems became public, Google on its blog said Intel and others planned to disclose the issues on Jan. 9. Google said it informed the affected companies about the ‘Spectre’ flaw on June 1, 2017 and reported the ‘Meltdown’ flaw after the first flaw but before July 28, 2017.”

“Intel denied that the patches would bog down computers based on Intel chips,” Busvine and Nellis report. “ARM spokesman Phil Hughes said that patches had already been shared with the companies’ partners, which include many smartphone manufacturers. ‘This method only works if a certain type of malicious code is already running on a device and could at worst result in small pieces of data being accessed from privileged memory,’ Hughes said in an email. AMD chips are also affected by at least one variant of a set of security flaws but that it can be patched with a software update. The company said it believes there ‘is near zero risk to AMD products at this time.’””

Read more in the full article here.

Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed. Intel believes these exploits do not have the potential to corrupt, modify or delete data. Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits. Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time. Intel is committed to the industry best practice of responsible disclosure of potential security issues, which is why Intel and other vendors had planned to disclose this issue next week when more software and firmware updates will be available. However, Intel is making this statement today because of the current inaccurate media reports. Check with your operating system vendor or system manufacturer and apply any available updates as soon as they are available. Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied. Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers. 

 Intel’s massive chip flaw could hit Mac where it hurts – January 3, 2018</s>Today will be a crucial test of the market’s response to news of a massive security vulnerability that affects chips made by Intel, as well as a separate problem that hits all microprocessors, regardless of manufacturer.

News of the Intel security problem, known as the “Meltdown” bug, sent the company’s stock price plunging 3.5% yesterday (Jan. 3). The stock recovered by the end of the session, but it’s down around 1.7% in pre-market trading today.

On the heels of the news about the vulnerabilities were reports this morning that Intel chief executive Brian Krzanich made $25 million from selling Intel stock in late November, when he knew about the bugs, but before they were made public.

Meanwhile, rival chip-maker AMD’s stock price was up as much as 5% in yesterday’s trading, before closing the session flat. The stock is up 2.6% in pre-market trading today.

The Meltdown bug means Intel chips dating back to 1995 could be exploited for unauthorized access to their memories. That means passwords, photos, and other content could be accessed by hackers. The other bug, dubbed “Spectre,” gives hackers similar access although it is more difficult to execute, and it affects all modern microprocessors, not just those made by Intel.

The potential for damage from the security loopholes, which were discovered by researchers at a number of companies and universities including Google and the University of Pennsylvania, remains unclear. The chip-makers have issued contradictory statements downplaying the severity of the bugs, but security experts are less sanguine.

Independent security researcher Lukasz Olejnik pointed out that although the bugs are currently difficult to execute, now that they are public, malicious parties will develop increasingly effective ways to carry them out. He points to the potential for the bugs to be triggered through website code, mentioned in the paper released by the researchers, as one cause for concern. “I think it’s fair to expect these techniques to definitely improve,” he said. “But it’s difficult to estimate how soon and to what extent.” There’s currently no evidence that the bugs have been successfully exploited.

Intel issued a statement yesterday denying that the Meltdown bug is unique to its chips, and claimed the problems “do not have the potential to corrupt, modify or delete data.” It also said it was working with other chip and operating-system makers to fix the problems. Intel’s claim that it is working with other chip-makers including AMD prompted the latter to reply that its products were unaffected. The company said in a statement that its product designs meant that there is a “near zero risk to AMD processors at this time.”

Whatever the case may be around the hardware, software makers aren’t taking any chances. Microsoft, Apple, and the Linux open-source community are releasing fixes that will be implemented in their respective operating systems. The trade-off is that these fixes are expected to slow computers down by as much as 30%. It’s not a great time to have Intel inside your machine.

Read next: Most processors produced since 1995 have a flaw that could let hackers steal sensitive information</s>Two major security flaws found by a group of academic and industry researchers have taken over the tech world by storm. Dubbed ‘Meltdown’ and ‘Spectre’, reports say that Intel chips are most vulnerable, however researchers have said these serious security flaws can also affect AMD and ARM chips.

According to a report, parts of a computer’s memory dedicated to protect things like passwords can be taken over by the bug. The report also says that computers with Intel chips as much as 10 years old can be affected and Windows and Mac OS X patches are required immediately to fix the issue. Steve Smith, Intel’s engineering lead who is investigating the issues has said “Someone has figured out a way to exploit the architecture that is built into all modern computer systems.”

In an official statement, Intel has said “Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

Intel is already facing pressure as its shares fell by 5.5 percent which is the biggest drop since October 2016.

The security threat is not restricted to just computers. Modern microprocessors present on smartphones and other smart device are equally at risk and will require patches to be secure. Now security threats keep coming and going, however, the reason why this is actually a big deal is because chip design flaws are quite rare. Flaws in chip design, if not fixable through software updates, can be really difficult to fix. It usually means a recall of the product, but a recall of this level could potentially be really tedious task. Apart from consumers, major servers, corporates and even a major backbone of the internet is reliant on Intel chips. To put this into perspective, Intel’s chips have over 80 percent market share in PCs overall and over 90 percent in laptops and servers around the world.

What is Meltdown and Spectre?



 A chip architecture contains infringed spaces where data passes through raw and unencrypted form. Say for instance the kernel, which is the most central software unit in the architecture, or in system memory and is kept separate from other applications. This data is protected so it stays safe from any interference or be accessed by any entity say a process or application.

Meltdown and Spectre are two such techniques, rather than a flaw or bug, that can penetrate this protection. Essentially this means that they can expose almost any type of data that the processor processes including passwords, confidential information and even encrypted data.

Meltdown targets Intel processors and bypasses the security system protecting random locations in the kernel memory. It makes the process of segregating and protecting memory spaces to prevent applications from accidentally interfering with one another’s data, or malicious software from being able to see and modify, ineffective.

On the other hand, Spectre can affect Intel, AMD, and ARM processors which brings smartphone and portable smart devices under the radar as well. This means almost anything with a chip, like an air purifier, TV, gaming consoles, to name a few.

Spectre can trick applications into revealing information that is usually inaccessible and safe inside the protected memory area. Since it is based on an established practice in multiple chip architectures, it is a little more difficult to fix.</s>Intel says that claims Meltdown or Spectre are due to flaws or bugs on processors are incorrect.

Chip giant Intel has dismissed suggestions that the Meltdown and Spectre exploits represent bugs or flaws in its chips, and said that other manufacturers are equally susceptible to the vulnerabilities.

The world awoke today to a terrifying reality that virtually all phones and computers in the world are potentially at risk because of security vulnerabilities that exist on chips manufactured in the last 10 years.

Discovered by Google’s Project Zero team last June, the tech industry was due to provide a jointly coordinated response to the exploits on 9 January, but now the issue is out in the open. Security researchers warn that the industry is in a race against time before hackers figure out how to exploit the vulnerabilities.

Meltdown concerns laptops, desktop computers and internet servers that have Intel chips, and allows a rogue programme to access the memory and other secrets of programs and the operating system contained in the central processing unit (CPU).

Spectre is an exploit that breaks the isolation between different applications on chips from Intel, AMD and ARM, and potentially allows hackers to ‘trick’ error-free programmes that normally follow best practices into ‘leaking’ their secrets.

IDC estimated that there are 1.5bn PCs in use around the world today, out of which 90pc are powered by Intel processors.

Intel said it is working with AMD and ARM as well as operating system-makers to develop an industry-wide approach to resolving the issue. Microsoft and Linux Foundation are working on patches to fix the vulnerabilities while Apple has yet to make a statement on the matter.

In a statement, Intel said that the exploits surfaced through security research and, while they have the potential to gather sensitive data, the company does not believe these exploits have the potential to corrupt, modify or delete data.

“Recent reports that these exploits are caused by a ‘bug’ or a ‘flaw’ and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices – with many different vendors’ processors and operating systems – are susceptible to these exploits.

“Intel is committed to product and customer security, and is working closely with many other technology companies – including AMD, ARM Holdings and several operating system vendors – to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits.

“Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

The electronics giant urged consumers and businesses to check with operating system vendors and device manufacturers for updates.

“Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied.

“Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers.”
Security researchers disclose two hardware vulnerabilities—Spectre, which affects most modern processors, and Meltdown, which affects most Intel chips.