Security researchers have found a new class of vulnerabilities in Intel chips which, if exploited, can be used to steal sensitive information directly from the processor.,

The bugs are reminiscent of Meltdown and Spectre, which exploited a weakness in speculative execution, an important part of how modern processors work. Speculative execution helps processors predict to a certain degree what an application or operating system might need next and in the near-future, making the app run faster and more efficient. The processor will execute its predictions if they’re needed, or discard them if they’re not.

Both Meltdown and Spectre leaked sensitive data stored briefly in the processor, including secrets — such as passwords, secret keys and account tokens, and private messages.

Now some of the same researchers are back with an entirely new round of data-leaking bugs.

“ZombieLoad,” as it’s called, is a side-channel attack targeting Intel chips, allowing hackers to effectively exploit design flaws rather than injecting malicious code. Intel said ZombieLoad is made up of four bugs, which the researchers reported to the chip maker just a month ago.

Almost every computer with an Intel chips dating back to 2011 are affected by the vulnerabilities.

ZombieLoad takes its name from a “zombie load,” an amount of data that the processor can’t understand or properly process, forcing the processor to ask for help from the processor’s microcode to prevent a crash. Apps are usually only able to see their own data, but this bug allows that data to bleed across those boundary walls. ZombieLoad will leak any data currently loaded by the processor’s core, the researchers said. Intel said patches to the microcode will help clear the processor’s buffers, preventing data from being read.

Practically, the researchers showed in a proof-of-concept video that the flaws could be exploited to see which websites a person is visiting in real-time, but could be easily repurposed to grab passwords or access tokens used to log into a victim’s online accounts.

Like Meltdown and Spectre, it’s not just PCs and laptops affected by ZombieLoad — the cloud is also vulnerable. ZombieLoad can be triggered in virtual machines, which are meant to be isolated from other virtual systems and their host device.

Daniel Gruss, one of the researchers who discovered the latest round of chip flaws, said it works “just like” it does on PCs and can read data off the processor. That’s potentially a major problem in cloud environments where different customers’ virtual machines run on the same server hardware.

Although no attacks have been publicly reported, the researchers couldn’t rule them out nor would any attack necessarily leave a trace, they said.

What does this mean for the average user? There’s no need to panic, for one.

These are far from drive-by exploits where an attacker can take over your computer in an instant. Gruss said it was “easier than Spectre” but “more difficult than Meltdown” to exploit — and both required a specific set of skills and effort to use in an attack.

But if exploit code was compiled in an app or delivered as malware, “we can run an attack,” he said.

There are far easier ways to hack into a computer and steal data. But the focus of the research into speculative execution and side channel attacks remains in its infancy. As more findings come to light, the data-stealing attacks have the potential to become easier to exploit and more streamlined.

But as with any vulnerability where patches are available, install them.

Intel has released microcode to patch vulnerable processors, including Intel Xeon, Intel Broadwell, Sandy Bridge, Skylake and Haswell chips. Intel Kaby Lake, Coffee Lake, Whiskey Lake and Cascade Lake chips are also affected, as well as all Atom and Knights processors.

But other tech giants, like consumer PC and device manufacturers, are also issuing patches as a first line of defense against possible attacks.

Computer makers Apple and Microsoft and browser makers Google have released patches, with other companies expected to follow.

In a call with TechCrunch, Intel said the microcode updates, like previous patches, would have an impact on processor performance. An Intel spokesperson told TechCrunch that most patched consumer devices could take a 3 percent performance hit at worst, and as much as 9 percent in a datacenter environment. But, the spokesperson said, it was unlikely to be noticeable in most scenarios.

And neither Intel nor Gruss and his team have released exploit code, so there’s no direct and immediate threat to the average user.

But with patches rolling out today, there’s no reason to pass on a chance to prevent such an attack in any eventuality.

Read more: </s> Most of us use computers which house Intel and AMD processors, and then you have the Windows or Linux or macOS operating systems running on them. While the AMD processor running systems are supposedly fine, those running on Intel chips will need to gear themselves for some bad news: A security flaw discovered in the Intel chips that were made after 1995, requires an OS level update, which is expected to bring down the processor performance by 5 to 30 percent.

There is a lot of news floating about this security flaw, which was discovered by The Register, but in case you are still confused about what the fuss is all about, let us try and address the issue for you.

Here is everything you need to know about the Intel chipset security flaw.

So what is this Intel security flaw?

Intel chips that were made post-1995 have been discovered to have a security flaw or bug. According to this, there is a bug at the kernel level which has been found to be leaking memory. This could let hackers access or read your sensitive data such as passwords, login keys and more from the chip itself. In the extreme cases, hackers could also insert malware into your PCs via this opening. This vulnerability isn't just limited to individual PCs, but could also affect servers in data centres that run cloud computing services. Think Amazon Web Services!

Think of the kernel as the central nervous system of an operating system. It is like the god program that controls other programs running on your machine. Every multi-tasking operating system uses a kernel, so that includes Windows, Linux, Android, iOS, macOS and so on.

The diagram above shows how the kernel is the mediator between the software and the device hardware such as the processor, memory as well as other plugged devices. So in a sense, it manages the memory resources, CPU resources as well as the processes required to run the software. Any time you fire up an application, turn on Bluetooth or Wi-Fi, turn on that game — everything goes through the kernel. Your PC is switching between the user mode and the kernel mode to ensure that instructions being given to your system are giving the right results.

The flaw appears to be letting attackers bypass the protections surrounding the kernel access, which lets any regular app read the contents of the kernel memory.

Which systems are affected? How do I find out if my system is also affected?

Any system with an Intel chip is affected by the flaw. The speculation is that this bug is affecting all Intel x86 processors irrespective of the OS running on the system. There is no way to know it, as there are no traces left in traditional log files. Desktops, laptops and even cloud computers running on Intel chips have been affected. Since it is an x86 chip issue, systems running Linux, Windows, as well as macOS, have been affected. The Python Sweetness blog notes that the attack could impact common virtualisation environments such as Amazon's EC2 and Google Compute Engine.

Meltdown is the name given to the vulnerability which affects Intel chips whereas Spectre is the name been given to vulnerabilities in other chip vendors and affects all chips, including ARM, Intel and AMD.

Meltdown is an exploit that breaks the secure separation layer between user applications and the operating system. Memory spaces between applications are segregated and protected to prevent accidental interference with each other's data. Meltdown lets malicious software break this protection. This attack lets a program access the memory and the operating system. Systems with vulnerable processors and those running an unpatched OS, need to beware and not work with sensitive information. It was discovered by Jann Horn (Google Zero Project), Werner Haas and Thomas Prescher (Cyberus Technology) and Daniel Gruss, Moritz Lipp, Stefan Mangard, Michael Schwarz (Graz University of Technology). Here are the patches to fix the Meltdown exploit.

Spectre, on the other hand, breaks the isolation between different applications, which will let hackers into tricking programs to leak their secrets. This affects not just PCs, but also mobile phones, embedded devices and other devices housing a chip. Spectre was reported by Jann Horn (Google Project Zero) and Paul Kocher in collaboration with, in alphabetical order, Daniel Genkin (University of Pennsylvania and University of Maryland), Mike Hamburg (Rambus), Moritz Lipp (Graz University of Technology), and Yuval Yarom (University of Adelaide and Data61).

According to this FAQ, there is no known misuse by exploiting the Meltdown or Spectre vulnerabilities that have been recorded yet.

How will it affect me?

The bug lets hackers get access to the kernel memory. Now as we read above, everything passes through the kernel when it comes to the operating system. So the kernel memory could house some private data which is accessible to hackers.

How is the issue being resolved? What do I have to do?

In the ideal scenario, it is a chip issue and Intel should be fixing it. But experts say that the fix cannot be implemented as a microcode update, and has to be fixed at the OS level.

According to TechCrunch, Meltdown can be fixed by having a stronger wall around the kernel; the technical term is “kernel page table isolation.” This will make the kernel invisible to the running processes. Spectre will take some time to get fully fixed.

In the long term, Spectre could be more serious than Meltdown. While Meltdown can be fixed, albeit, with a performance hit, Spectre seems almost impossible to fix completely and will possibly require a complete rework of how a modern CPU functions. Fixes for Spectre affect only known vulnerabilities. An analogy would be a leaky ship. You know you're taking on water, just not where it's coming from, and you're patching holes as and when you find them.

Linux devs have released a kernel patch. Microsoft is expected to release its security patch soon as part of Patch Tuesday on 9 January. Microsoft has tested it on the Windows Insider preview build. Apple claims that its systems are protected against the exploit with the macOS 10.13.2 release, and additional safeguards will come out with macOS 10.13.3.

As a user, you will have to be on top of any security update that your OS releases and ensure that your system is updated with it. Also, ensure your security software is monitoring for any untoward activity. Intel has also advised running your security software at regular intervals.

Will everything be back to normal after the patch addresses the bug?

Well yes, but there's a catch. The OS level fix is expected to prevent kernel memory from leaking, so that's a good thing. But this will come at the cost of your system performance coming down in the range of 5 to 30 percent, according to The Register. User PCs having Intel 4th gen processors will not suffer as much as those sporting older processors. Virtualisation applications and data centre or cloud workloads are expected to be affected more. Intel says that the performance hit depends on the workload and won't be much for average home PC users. Amazon Web Services has warned customers in an email to expect a major security update to come on Friday.

AMD has released a statement saying that machines sporting AMD processors are not affected by this bug. "AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault," said AMD.

In such a scenario, AMD processor housing systems should not be affected. But if the OS vendor does not make exceptions for the change in OS level code from affecting AMD systems, then there could be some performance hit. As of now, this is in the realm of speculation. </s> Jan. 3 (UPI) -- Billions of devices might be at risk after researchers found two security flaws inside Intel chips that allow hackers to enter processors and steal sensitive data.

Intel chips have been installed in devices since 1995 and the researchers said every device now contains those security flaws. But the flaws aren't limited to personal devices. Cloud providers like Amazon Web Services, Microsoft Azure and Google Cloud Platform may also be affected.

The two bugs are called Meltdown and Spectre, with the latter being potentially more widespread.

"Almost every system is affected by Spectre," researchers said in a report. "Desktops, laptops, cloud servers, as well as smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD and ARM processors."

"More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995, except Intel Itanium and Intel Atom before 2013."

The researchers said they successfully tested Meltdown on Intel processor generations released as early as 2011.

"Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown," they said.

The main difference between the two bugs is that Meltdown "breaks the mechanism that keeps applications from accessing arbitrary system memory," while Spectre "tricks other applications into accessing arbitrary locations in their memory."

After researchers released their assessment of the bugs, Intel issued a statement that the security flaw is not unique to their chips.

"Based on the analysis to date, many types of computing devices -- with many different vendors' processors and operating systems -- are susceptible to these exploits," Intel said.

Intel advised people with Intel chips in their devices to contact their operating system vendor or system manufacturer and apply any available updates.

Daniel Gruss, a security researcher who discovered the Meltdown bug, told ZDNet that any data can be accessed through the security flaws.

They are "going to haunt us for years," he said. </s> What are Meltdown and Spectre? Do they only affect Intel chips? Will the fixes slow my computer … and what even is a processor?

Meltdown and Spectre are the names of two serious security flaws that have been found within computer processors. They could allow hackers to steal sensitive data without users knowing, one of them affecting chips made as far back as 1995.



What are Meltdown and Spectre?

Meltdown is a security flaw that could allow hackers to bypass the hardware barrier between applications run by users and the computer’s core memory, which is normally highly protected.

Spectre is slightly different. It potentially allows hackers to trick otherwise error-free applications into giving up secret information.

Is it serious?

Yes. Meltdown is “probably one of the worst CPU bugs ever found” according to Daniel Gruss, one of the researchers at Graz University of Technology who discovered the flaw. It is very serious in the short term and needs immediate attention.

The problem with Meltdown is that anything that runs as an application could in theory steal your data, including simple things such as javascript from a web page viewed in a browser.

Spectre, on the other hand, is harder for hackers to take advantage of but is also more difficult to fix and is expected to be a bigger problem in the long term.

What kinds of devices are affected?

Practically every computing device affected by Spectre, including laptops, desktops, tablets, smartphones and even cloud computing systems. A few lower power devices, such as certain Internet of Things gadgets, are unaffected.

What is a processor?

The processor, or central processing unit (CPU), is the primary chip in a computer that carries out the instructions of a computer program – in essence, the brain of the computer.

When you command a program to do something, it is the processor that carries out that command, co-operating with the rest of the system to perform whatever task is needed.

There are other types of processors, including graphics processing units (GPU) or graphics cards, co-processors such as sensor chips that detect motion or similar physical conditions, but the term “processor” without a caveat is generally exclusively used to describe the CPU.

Does it only affect Intel processors?

Spectre affects all modern processors, including those designed by Intel, AMD and ARM, but Meltdown is currently thought only to affect Intel chips manufactured since 1995, with the exception of the Itanium and Atom chips made before 2013.

What can be stolen?

Facebook Twitter Pinterest Credit cards could be at risk due to Meltdown. Photograph: Alamy Stock Photo

The core system, known as the kernel, stores all types of sensitive information in memory. This means banking records, credit cards, financial data, communications, logins, passwords and secret information could which is all be at risk due to Meltdown.

Spectre can be used to trick normal applications into giving up sensitive data, which potentially means anything processed by an application can be stolen, including passwords and other data.

Is it already being used to steal data?

The UK’s National Cyber Security Centre said that there is no evidence that Meltdown and Spectre are actively being used to steal data at the moment, but the nature of the attacks make them difficult to detect.

Experts expect that hackers will quickly develop programs to launch attacks now that the information is available. Dan Guido, chief executive of cybersecurity consulting firm Trail of Bits, said: “Exploits for these bugs will be added to hackers’ standard toolkits.”

What can I do about it?

Users can do little to avoid the security flaws apart from update their computers with the latest security fixes as soon as possible. Fixes for Linux and Windows are already available. Chromebooks updated to Chrome OS 63, which started rolling out in mid-December, are already protected.

Android devices running the latest security update, including Google’s Nexus and Pixel smartphones, are already protected. Updates are expected to be delivered soon. Users of other devices will have to wait for the updates to be pushed out by third-party manufacturers, including Samsung, Huawei and OnePlus.

On Thursday night, Apple advised customers in a blog post to update their devices’ operating systems and only download software from “trusted sources such as the App Store”. The company also said that “there are no known exploits impacting customers at this time”.

Will the fixes slow my computer?

While the fixes for Spectre are not expected to have much immediate impact on the performance of computers, the nature of the fixes needed to protect against Meltdown could have a significant impact.

That’s due to the separation of the application and kernel memory required by the various operating systems to prevent the flaw being used to access protected data. Separating the two memory systems like this means that tasks that constantly require the kernel do to things, such as writing files to disk or sending data over a network, could be significantly slower due to the increased time it will take for the processor to switch between the application memory and the kernel memory.

Some early estimates predict up to 30% slower performance in some tasks. Whether users will notice a difference on their computers will depend on the task they are trying to do. Gaming, browsing and general computing activities are unlikely to be affected, but those that involve lots of writing files may become slower.

Some technologies, such as Intel’s Process-Context Identifiers (PCID) that was included with the company’s processors since 2013, can lessen the impact of the fixes if taken advantage of in the operating system.

Who found it?

Meltdown was independently discovered and reported by three teams, including Jann Horn from Google’s Project Zero, Werner Haas and Thomas Prescher from Cyberus Technology and Daniel Gruss, Moritz Lipp, Stefan Mangard and Michael Schwarz from Graz University of Technology in Austria.

Spectre was independently discovered by two people, including Horn and Paul Kocher, who worked in collaboration with Daniel Genkin, from University of Pennsylvania and University of Maryland, Mike Hamburg from tech firm Rambus, Lipp, and Yuval Yarom from the University of Adelaide and Data61.

What about cloud services?

The problem is magnified for cloud services such as Amazon’s Web Services and Google’s Cloud Platform, due to the scale of their computing resources and the potential impact on performance of the fixes.

Amazon said it was in the process of patching systems with all but a “small single-digit percentage” of its Amazon Web Services EC2 systems already protected, but that “customers must also patch their instance operating systems” to be fully protected.

Google also said that the majority of its systems were updated, but that some additional customer action may be needed for its Compute Engine and other Cloud Platform systems.

Microsoft said it was in the process of deploying fixes to its cloud systems.

This article contains affiliate links, which means we may earn a small commission if a reader clicks through and makes a purchase. All our journalism is independent and is in no way influenced by any advertiser or commercial initiative. By clicking on an affiliate link, you accept that third-party cookies will be set. More information. </s> Intel says that claims Meltdown or Spectre are due to flaws or bugs on processors are incorrect.

Chip giant Intel has dismissed suggestions that the Meltdown and Spectre exploits represent bugs or flaws in its chips, and said that other manufacturers are equally susceptible to the vulnerabilities.

The world awoke today to a terrifying reality that virtually all phones and computers in the world are potentially at risk because of security vulnerabilities that exist on chips manufactured in the last 10 years.

Discovered by Google’s Project Zero team last June, the tech industry was due to provide a jointly coordinated response to the exploits on 9 January, but now the issue is out in the open. Security researchers warn that the industry is in a race against time before hackers figure out how to exploit the vulnerabilities.

Meltdown concerns laptops, desktop computers and internet servers that have Intel chips, and allows a rogue programme to access the memory and other secrets of programs and the operating system contained in the central processing unit (CPU).

Spectre is an exploit that breaks the isolation between different applications on chips from Intel, AMD and ARM, and potentially allows hackers to ‘trick’ error-free programmes that normally follow best practices into ‘leaking’ their secrets.

IDC estimated that there are 1.5bn PCs in use around the world today, out of which 90pc are powered by Intel processors.

Intel said it is working with AMD and ARM as well as operating system-makers to develop an industry-wide approach to resolving the issue. Microsoft and Linux Foundation are working on patches to fix the vulnerabilities while Apple has yet to make a statement on the matter.

In a statement, Intel said that the exploits surfaced through security research and, while they have the potential to gather sensitive data, the company does not believe these exploits have the potential to corrupt, modify or delete data.

“Recent reports that these exploits are caused by a ‘bug’ or a ‘flaw’ and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices – with many different vendors’ processors and operating systems – are susceptible to these exploits.

“Intel is committed to product and customer security, and is working closely with many other technology companies – including AMD, ARM Holdings and several operating system vendors – to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits.

“Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

The electronics giant urged consumers and businesses to check with operating system vendors and device manufacturers for updates.

“Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied.

“Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers.” </s> Today will be a crucial test of the market’s response to news of a massive security vulnerability that affects chips made by Intel, as well as a separate problem that hits all microprocessors, regardless of manufacturer.

News of the Intel security problem, known as the “Meltdown” bug, sent the company’s stock price plunging 3.5% yesterday (Jan. 3). The stock recovered by the end of the session, but it’s down around 1.7% in pre-market trading today.

On the heels of the news about the vulnerabilities were reports this morning that Intel chief executive Brian Krzanich made $25 million from selling Intel stock in late November, when he knew about the bugs, but before they were made public.

Meanwhile, rival chip-maker AMD’s stock price was up as much as 5% in yesterday’s trading, before closing the session flat. The stock is up 2.6% in pre-market trading today.

The Meltdown bug means Intel chips dating back to 1995 could be exploited for unauthorized access to their memories. That means passwords, photos, and other content could be accessed by hackers. The other bug, dubbed “Spectre,” gives hackers similar access although it is more difficult to execute, and it affects all modern microprocessors, not just those made by Intel.

The potential for damage from the security loopholes, which were discovered by researchers at a number of companies and universities including Google and the University of Pennsylvania, remains unclear. The chip-makers have issued contradictory statements downplaying the severity of the bugs, but security experts are less sanguine.

Independent security researcher Lukasz Olejnik pointed out that although the bugs are currently difficult to execute, now that they are public, malicious parties will develop increasingly effective ways to carry them out. He points to the potential for the bugs to be triggered through website code, mentioned in the paper released by the researchers, as one cause for concern. “I think it’s fair to expect these techniques to definitely improve,” he said. “But it’s difficult to estimate how soon and to what extent.” There’s currently no evidence that the bugs have been successfully exploited.

Intel issued a statement yesterday denying that the Meltdown bug is unique to its chips, and claimed the problems “do not have the potential to corrupt, modify or delete data.” It also said it was working with other chip and operating-system makers to fix the problems. Intel’s claim that it is working with other chip-makers including AMD prompted the latter to reply that its products were unaffected. The company said in a statement that its product designs meant that there is a “near zero risk to AMD processors at this time.”

Whatever the case may be around the hardware, software makers aren’t taking any chances. Microsoft, Apple, and the Linux open-source community are releasing fixes that will be implemented in their respective operating systems. The trade-off is that these fixes are expected to slow computers down by as much as 30%. It’s not a great time to have Intel inside your machine.

Read next: Most processors produced since 1995 have a flaw that could let hackers steal sensitive information
Security researchers from Graz University of Technology and Catholic University of Leuven discover a major new class of Microarchitectural Data Sampling vulnerabilities called ZombieLoad in Intel processors, which, if exploited, can be used to steal sensitive information directly from the processor. Almost every computer with an Intel chip dating back to 2011 is affected by these vulnerabilities.