Internet Security BLOG

Meltdown: A Security Flaw like No Other

medltdown-spectre-300x214 Internet Security BLOG

With the potential to affect almost every computer with a microprocessor inside it, the Meltdown security vulnerability is creating some serious seismic activity in the computer industry.

Perfectly named, Meltdown promises to send operating systems (including Windows, Android, macOS, iOS and Linux) into a catastrophic state of not only vulnerability, but also reduced performance. It’s the type of security flaw that experts would be grateful if it was only limited to a handful of products, but Meltdown has the potential to affect any computer manufactured with either an Intel x86 or certain ARM microprocessors.  And it’s a flaw which has been present in Intel chips for over 20 years now.

It’s a vulnerability that the digital age really didn’t need and it’s left security experts questioning the reach that this security flaw could have. And, for microprocessor manufacturers, it’s put them under intense pressure to reassure consumers and issue patches. Therefore, it’s time to prepare yourself for Meltdown.

What is Meltdown?

To understand the modus operandi of the Meltdown exploit, we need to start by looking at the operating system kernel. Now, the kernel acts as a bridge that allows hardware and software to communicate with each other. Without this mediation, computer systems would be unable to effectively allocate CPU and memory power to multiple applications. Acting as the heart of any operating system, the kernel is a sensitive and crucial component.

In order to maximize performance, computer systems perform speculative execution; this is a method by which processors perform a task before it’s known whether or not it’s required. The aim of speculative execution is to prevent delays incurred when it’s known for sure that processor power is required. And it’s always been fine, until several different research teamsdiscovered a massive flaw in the hardware behind speculative execution.

Standard practice is for only privileged applications to be allowed access to the kernel.  However, through the use of a side channel attack, attackers are able to observe the kernel and all its activity. This access is completely invisible to the victim, but exposes sensitive information such as logins, passwords and any scrap of data housed on that computer. As Meltdown is purely a read-only vulnerability, there’s no risk of computers being trashed by attackers, but the security concerns are monumental.

Naturally, the data handled by the kernel has always been rigorously secured, but, as Daniel Gruss from the Graz University of Technology discovered, not rigorously enough.  You see, just before speculative execution produces its results, it stores them in cache of memory allocated to the system’s processor. And, by firing snippets of code at the processor, a hacker can easily work out if the data is being stored in the cache by the time taken for the processor to respond. This grants the hacker to access restricted data quite freely.

Speculation by security experts suggests that every single Intel processor built since 1995 is at risk and, as you can imagine, this takes in a huge number of different processors. ARM, meanwhile, have confirmed that their Cortex-A processors are at risk of being exposed to Meltdown.

Protection from Meltdown

As with all security vulnerabilities, the key to protection is to update everything as soon as possible. Microprocessor manufacturers, keen to protect their assets and reputation, have been working round the clock to deliver patches to help solve the Meltdown conundrum and ensure that affected systems remain protected. The first patch was released by Microsoft on January 3rdto aid Windows in protecting itself from Meltdown with IntelApple and ARM soon following suit.

Revised firmware updates, for Intel at least, will then be issued by product manufacturers (such as Dell and HP) for the foreseeable future. In the meantime, Intel aim, by the end of January, to have released firmware updates for all of their processors released in the last five years. With all the affected CPU manufacturers attempting to remedy Meltdown, you could be forgiven for thinking that this intriguing chapter of IT security was coming to an end. However, the patches and firmware upgrades are coming in for major criticism.

The Meltdown Slowdown

Whilst the actions taken by Intel et al to patch their vulnerable hardware are admirable and effective, they’re also creating a new set of problems for computer users. The most immediate and measurable side effect of the patches is the decrease in performance. Due to the changes in memory handling required to circumvent Meltdown, processors are now having to work harder and this is putting a drain on resources.

For the average consumer, the effect upon performance shouldn’t be noticeable, but that’s only if they’re working with a relatively new computer system that contains, for example, Skylake or Kaby Lake microprocessors. If, however, a consumer is running a version of Windows 10 with an older processor then there’s a good chance they will notice a decrease in performance. And if a consumer has persevered with Windows 7 or 8, the slowdown will be significantly more noticeable.

It’s when you analyze the impact of the patches on servers, though, that the performance issue really rears its ugly head. Microsoft, for example, have announced that Windows Server will suffer “a more significant performance impact” when running with the associated patches to protect from Meltdown. It would appear, therefore, that Microsoft is actually advising their customers to risk a major security exploit in order to maintain the performance of their servers. And this seriously underlines just how far away from an efficient patch Microsoft are.

Security researcher Thomas Roth, meanwhile, has been testing a number of different chips and discovered that an updated Intel i7-6700 microprocessor running Ubuntu 16.04 is producing communication between applications and the kernel that is now up to four times slower. Roth believes that performance will be hit hardest in sectors such as large websites, search engines and cloud providers. And, just to prove his point, the increased processor usage brought on by patched processors has been blamed for slowing down the cloud based service that powers online game Fortnite.

Final Thoughts

Meltdown has, thankfully, been prevented due to the number of patches and firmware upgrades released in the wake of its public revelation. However, it’s a damning indictment of the hardware industry that this security vulnerability has lain dormant for over 20 years. Whilst the security researchers who discovered this flaw are no doubt talented, there are more than enough hackers out there who are equally as talented. And this is highly disturbing for our online futures.

There’s also the small matter of performance drop in those microprocessors which have been patched. Whilst a slight lag in performance is much better than sensitive data being compromised, the impact of this lag has already been demonstrated. And, for businesses and large organizations, the possibility of their activities being severely disrupted is very troubling.

As with all major security risks, the main takeaway appears to be that patching is essential when it comes to protecting your systems and your data. Without these immediate fixes, you’re more vulnerable than ever before. And with vulnerabilities being shipped with the majority of computers manufactured in the last 20 years, you need all the help you can get.

 

6 Replies to “Internet Security BLOG”

  1. Step by Step guide for Office Setup, Office Activation, Office error, Office help, Download & complete installation online.
    We are providing independent support service if in case you face problem to activate or Setup your product
    http://www.www-office-com-setup.xyz/

    office activation
    office setup
    office.com/setup
    http://www.office.com/setup
    office support
    office error
    office technical support
    www office com setup
    office help
    office install
    0ffice.c0m/setup

  2. Step by Step guide for kASPERSKY Setup, kaspersky Activation, kaspersky error, kaspersky help, Download & complete installation online.
    We are providing independent support service if in case you face problem to activate or Setup your product
    http://www.activation-kaspersky.com

    kaspersky activation
    kaspersky setup
    kaspersky.com/setup
    http://www.kaspersky.com
    kaspersky support
    kaspersky error
    kaspersky technical suport
    kaspersky antivirus
    kaspersky help
    kaspersky install

  3. Tollfree Support Number Acer
    http://tollfreesupportcontactnumber.com/acer-tollfree-number/

    Tollfree Support Number Adobe
    http://tollfreesupportcontactnumber.com/adobe-tollfree-number/

    Tollfree Support Number Ali express
    http://tollfreesupportcontactnumber.com/ali-express-tollfree-number/

    Tollfree Support Number Amazon
    http://tollfreesupportcontactnumber.com/amazon-tollfree-number/

    Tollfree Support Number Amazon Prime
    http://tollfreesupportcontactnumber.com/amazon-prime-tollfree-number/

    Tollfree Support Number Aol
    http://tollfreesupportcontactnumber.com/aol-tollfree-number/

    Tollfree Support Number Asus
    http://tollfreesupportcontactnumber.com/asus-tollfree-number/

    Tollfree Support Number At&t
    http://tollfreesupportcontactnumber.com/att-tollfree-number/

    Tollfree Support Number Avast
    http://tollfreesupportcontactnumber.com/avast-tollfree-number/

    Tollfree Support Number Avg
    http://tollfreesupportcontactnumber.com/avg-tollfree-number/

    Tollfree Support Number Avira
    http://tollfreesupportcontactnumber.com/avira-tollfree-number/

    Tollfree Support Number Bell South
    http://tollfreesupportcontactnumber.com/bellsouth-tollfree-number/

    Tollfree Support Number Best Buy
    http://tollfreesupportcontactnumber.com/best-buy-tollfree-number/

    Tollfree Support Number Bit Defender
    http://tollfreesupportcontactnumber.com/bit-defender-tollfree-number/

    Tollfree Support Number Brother
    http://tollfreesupportcontactnumber.com/brother-tollfree-number/

    Tollfree Support Number Canon
    http://tollfreesupportcontactnumber.com/canon/

    Tollfree Support Number Century Link
    http://tollfreesupportcontactnumber.com/centurylink/

    Tollfree Support Number Charter
    http://tollfreesupportcontactnumber.com/charter/

    Tollfree Support Number Chromebook
    http://tollfreesupportcontactnumber.com/chromebook/

    Tollfree Support Number Comcast
    http://tollfreesupportcontactnumber.com/comcast/

    Tollfree Support Number Comodo
    http://tollfreesupportcontactnumber.com/comodo/

    Tollfree Support Number Contact Us
    http://tollfreesupportcontactnumber.com/contact-us/

    Tollfree Support Number Cox
    http://tollfreesupportcontactnumber.com/cox/

    Tollfree Support Number Cricket Wireless
    http://tollfreesupportcontactnumber.com/cricket-wireless/

    Tollfree Support Number Dell
    http://tollfreesupportcontactnumber.com/dell/

    Tollfree Support Number Disclaimer
    http://tollfreesupportcontactnumber.com/disclaimer/

    Tollfree Support Number Dish Network
    http://tollfreesupportcontactnumber.com/dish-network/

    Tollfree Support Number Dropbox
    http://tollfreesupportcontactnumber.com/dropbox/

    Tollfree Support Number Ebay
    http://tollfreesupportcontactnumber.com/ebay/

    Tollfree Support Number Epson
    http://tollfreesupportcontactnumber.com/epson/

    Tollfree Support Number Eset
    http://tollfreesupportcontactnumber.com/eset/

    Tollfree Support Number F-Secure
    http://tollfreesupportcontactnumber.com/f-secure/

    Tollfree Support Number Facebook
    http://tollfreesupportcontactnumber.com/facebook/

    Tollfree Support Number Gateway
    http://tollfreesupportcontactnumber.com/gateway/

    Tollfree Support Number Geek Squad
    http://tollfreesupportcontactnumber.com/geek-squad/

    Tollfree Support Number Gmail
    http://tollfreesupportcontactnumber.com/gmail/

    Tollfree Support Number Google Chrome
    http://tollfreesupportcontactnumber.com/google-chrome/

    Tollfree Support Number H&R Block
    http://tollfreesupportcontactnumber.com/hr-block/

    Tollfree Support Number HBO
    http://tollfreesupportcontactnumber.com/hbo/

    Tollfree Support Number Hotmail
    http://tollfreesupportcontactnumber.com/hotmail/

    Tollfree Support Number Hp Printers
    http://tollfreesupportcontactnumber.com/hp-printer/

    Tollfree Support Number Hulu
    http://tollfreesupportcontactnumber.com/hulu/

    Tollfree Support Number icloud
    http://tollfreesupportcontactnumber.com/icloud/

    Tollfree Support Number intel
    http://tollfreesupportcontactnumber.com/intel/

    Tollfree Support Number intuit
    http://tollfreesupportcontactnumber.com/intuit/

    Tollfree Support Number itunes
    http://tollfreesupportcontactnumber.com/itunes/

    Tollfree Support Number Kaspersky
    http://tollfreesupportcontactnumber.com/kaspersky-2/

    Tollfree Support Number Kindle
    http://tollfreesupportcontactnumber.com/kindle/

    Tollfree Support Number Kyocera
    http://tollfreesupportcontactnumber.com/kyocera/

    Tollfree Support Number Lenovo
    http://tollfreesupportcontactnumber.com/lenovo/

    Tollfree Support Number Lexmark
    http://tollfreesupportcontactnumber.com/lexmark/

    Tollfree Support Number Liberty Tax
    http://tollfreesupportcontactnumber.com/liberty-tax/

    Tollfree Support Number Magicjack
    http://tollfreesupportcontactnumber.com/magicjack/

    Tollfree Support Number Malwarebytes
    http://tollfreesupportcontactnumber.com/malwarebytes/

    Tollfree Support Number Mcafee
    http://tollfreesupportcontactnumber.com/mcafee/

    Tollfree Support Number Microsoft office
    http://tollfreesupportcontactnumber.com/microsoft-office/

    Tollfree Support Number Mozilla Firefox
    http://tollfreesupportcontactnumber.com/mozilla-firefox/

    Tollfree Support Number Netflix
    http://tollfreesupportcontactnumber.com/netflix/

    Tollfree Support Number Nintendo
    http://tollfreesupportcontactnumber.com/nintendo/

    Tollfree Support Number Norton
    http://tollfreesupportcontactnumber.com/norton/

    Tollfree Support Number OneDrive
    http://tollfreesupportcontactnumber.com/onedrive/

    Tollfree Support Number OpenOffice
    http://tollfreesupportcontactnumber.com/openoffice/

    Tollfree Support Number Opera Browser
    http://tollfreesupportcontactnumber.com/opera-browser/

    Tollfree Support Number Outlook
    http://tollfreesupportcontactnumber.com/outlook/

    Tollfree Support Number Panda Security
    http://tollfreesupportcontactnumber.com/panda-security/

    Tollfree Support Number Photoshop
    http://tollfreesupportcontactnumber.com/photoshop/

    Tollfree Support Number Playstation
    http://tollfreesupportcontactnumber.com/playstation/

    Tollfree Support Number Privacy Policy
    http://tollfreesupportcontactnumber.com/privacy-policy/

    Tollfree Support Number Quick Heal
    http://tollfreesupportcontactnumber.com/quick-heal/

    Tollfree Support Number Quickbooks
    http://tollfreesupportcontactnumber.com/quickbooks/

    Tollfree Support Number Quicken
    http://tollfreesupportcontactnumber.com/quicken/

    Tollfree Support Number Roadrunner
    http://tollfreesupportcontactnumber.com/roadrunner/

    Tollfree Support Number Rogers
    http://tollfreesupportcontactnumber.com/rogers/

    Tollfree Support Number Safari
    http://tollfreesupportcontactnumber.com/safari/

    Tollfree Support Number Samsung
    http://tollfreesupportcontactnumber.com/samsung/

    Tollfree Support Number Shaw
    http://tollfreesupportcontactnumber.com/shaw/

    Tollfree Support Number Skype
    http://tollfreesupportcontactnumber.com/skype/

    Tollfree Support Number Sony
    http://tollfreesupportcontactnumber.com/sony/

    Tollfree Support Number Sophos
    http://tollfreesupportcontactnumber.com/sophos/

    Tollfree Support Number Sprint
    http://tollfreesupportcontactnumber.com/sprint-tollfree-number/

    Tollfree Support Number Staples
    http://tollfreesupportcontactnumber.com/staples-toll-free-number/

    Tollfree Support Number T-Mobile
    http://tollfreesupportcontactnumber.com/t-mobile/

    Tollfree Support Number TaxAct
    http://tollfreesupportcontactnumber.com/taxact/

    Tollfree Support Number TaxSlayer
    http://tollfreesupportcontactnumber.com/taxslayer-tollfree-number/

    Tollfree Support Number TaxTrack
    http://tollfreesupportcontactnumber.com/taxtrack-tollfree-number/

    Tollfree Support Number Telus
    http://tollfreesupportcontactnumber.com/telus-tollfree-number/

    Tollfree Support Number Terms And Conditions
    http://tollfreesupportcontactnumber.com/terms-condition-toll-free-number/

    Tollfree Support Number Toshiba
    http://tollfreesupportcontactnumber.com/toshiba-tollfree-number/

    Tollfree Support Number Trend Micro
    http://tollfreesupportcontactnumber.com/trend-micro-toll-free-number/

    Tollfree Support Number Turbotax
    http://tollfreesupportcontactnumber.com/turbotax-toll-free-number/

    Tollfree Support Number Us Cellular
    http://tollfreesupportcontactnumber.com/us-cellular-toll-free-number/

    Tollfree Support Number Verizon
    http://tollfreesupportcontactnumber.com/verizon-toll-free-number/

    Tollfree Support Number Vipre
    http://tollfreesupportcontactnumber.com/vipre-toll-free-number/

    Tollfree Support Number Virgin Mobile
    http://tollfreesupportcontactnumber.com/virgin-mobile-toll-free-number/

    Tollfree Support Number Walmart
    http://tollfreesupportcontactnumber.com/walmart-toll-free-number/

    Tollfree Support Number Webmail
    http://tollfreesupportcontactnumber.com/webmail-toll-free-number/

    Tollfree Support Number Webroot
    http://tollfreesupportcontactnumber.com/webroot/

    Tollfree Support Number Xbox
    http://tollfreesupportcontactnumber.com/xbox/
    s
    Tollfree Support Number Xerox
    http://tollfreesupportcontactnumber.com/xerox/

    Tollfree Support Number Yahoo
    http://tollfreesupportcontactnumber.com/yahoo/

    Tollfree Support Number Zone Alarm
    http://tollfreesupportcontactnumber.com/zonealarm/

Leave a Reply

Your email address will not be published. Required fields are marked *