News Analysis

Meltdown, Spectre, and Early Lessons Learned

Security threats to the IoT (Internet of Things) are just part of reality, unfortunately, and no one in the industry expected 2018 to be threat-free. However, when Intel, www.intel.com, disclosed vulnerabilities in its processors that affect billions of machines and devices on January 3, it seemed to start the year off on a bad note, to say the least.

In reality, the vulnerabilities were discovered by Google’s Project Zero team last year, and Intel was in the process of preparing fixes before announcing the researchers’ findings. This common industry practice serves to avoid giving cybercriminals a heads up by revealing potential problems before solutions are available. A leak pushed Intel’s timeline up, and the company released a statement on January 3, saying: “Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed.”

The vulnerabilities in question have been dubbed Meltdown and Spectre. The Dept. of Homeland Security’s Vulnerability Notes Database describes Spectre attacks as taking advantage of a CPU’s (central processing unit’s) branch prediction capabilities, which speculatively execute instructions at a location the CPU believes it will branch to. The fear here is a Spectre attack could leak sensitive data to other processes on a system and/or allow one part of an application to access other parts of the same process memory space that would otherwise not be permitted. The database says Meltdown also uses a cache side channel to access data that otherwise wouldn’t be available. However, unlike Spectre, Meltdown leverages “out-of-order execution capabilities” in modern CPUs. Intel describes how side-channel analysis works here.

To date, no exploitation of these vulnerabilities is known, and Intel says it does not believe these exploits have the potential to corrupt, modify, or delete data. Tech companies like Apple, www.apple.com, Amazon, www.amazon.com, Google, www.google.com, and Microsoft, www.microsoft.com, are reporting little to no performance impact in their affected products. And, though Intel is at the center of the situation, it’s important to note that other vendors’ processors, including those from AMD, www.amd.com, and ARM, www.arm.com, may also have been affected. Companies are urging customers to make sure their systems are up to date with the latest patches and updates.

So far, the industry’s response to Meltdown and Spectre has shown the benefits of collaboration and industry-wide information sharing. When device security is at risk, information sharing is perhaps the strongest defense possible against those working against data privacy. Because it is impossible to prevent vulnerabilities from existing or from cropping up from time to time, the lesson Meltdown and Spectre has already taught the industry, even in these early hours, is that no one is exempt and everyone must participate in the ongoing process of securing connected devices and systems.

Hopefully, the Meltdown and Spectre vulnerabilities are not an indication of how 2018 will go in terms of cybersecurity. However, the safe thing to do is to assume devices are always under attack and prepare accordingly. That way, any threat that comes down the line is not a surprise attack.

Want to tweet about this article? Use hashtag #IoT #M2M #security #cybersecurity #Intel #Spectre #Meltdown #ARM #AMD #blockchain #AI #bigdata #machinelearning #analytics

By | 2018-04-20T17:44:29+00:00 1/8/2018|

Leave A Comment