Meltdown and Spectre: Here’s what Intel, Apple, Microsoft, others are doing about it

 

The Meltdown and Spectre flaws—two related vulnerabilities that enable a wide range of information disclosure from every mainstream processor, with particularly severe flaws for Intel and some ARM chips—were originally revealed privately to chip companies, operating system developers, and cloud computing providers. That private disclosure was scheduled to become public some time next week, enabling these companies to develop (and, in the case of the cloud companies, deploy) suitable patches, workarounds, and mitigations.

With researchers figuring out one of the flaws ahead of that planned reveal, that schedule was abruptly brought forward, and the pair of vulnerabilities was publicly disclosed on Wednesday, prompting a rather disorderly set of responses from the companies involved.

There are three main groups of companies responding to the Meltdown and Spectre pair: processor companies, operating system companies, and cloud providers. Their reactions have been quite varied.


What Meltdown and Spectre do...

Intel...

AMD...

ARM...

Apple...

Microsoft...

Amazon...

Google...

An effective, if uncoordinated, response...

Prease to read more here:

https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre...

--
Never argue with a pig. It makes you look foolish and it anoys the hell out of the pig!

Dependency Affecting Security Fix Availability

Despite knowing a patch had been readied by MS, MS Update failed to offer it until I performed an update of my anti-virus software. If you don't yet see an update from MS, check your AV product, which updating also results in a registry key MS Update is checking for before offering the MS Security Patch.

This scary processor security flaw just recently hit the news

This scary processor security flaw has just recently hit the news where everyday people are just now learning about it. Computer geeks learned about it a long time ago. The vulnerability has actually been there for 15 years! The processor makers (e.g. Intel, Arm and maybe AMD) overlooked a design flaw while coming out with faster and faster processors in their efforts to increase processor speed.

Many people will panic when they read of this news, and especially when they see the name 'Meltdown'. They should NOT panic. The reality is - to exploit this vulnerability or security hole takes a lot of work and time for any bad actor to get anything from a computer that uses a vulnerable processor. It is highly unlikely that the typical domestic user with a vulnerable processor mounted in the motherboard of in their computer will be directly targeted. The people that need to be anxious the most, especially at this point, are worldwide governments, banking and financial institutions and big business who have data that might be worth stealing.

At this time there is no means to use the bugs (Meltdown & Spectre) in a malware attack. It is information leakage only. The primary concern is that a bad actor will use these bugs to find vulnerable places in a computer (e.g. a work computer) in which he/she wants to obtain information that the person is not normally privy to getting.

I just don't see anybody bothering with individuals' home computers. Bad actors will reserve the extremely hard work to try to build a working attack against primarily Windows 10 operating systems and they will target country's government computers, banks' computers and large companies' computers. Their task is so difficult that their aim will not be personal computers of everyday Joe and Jane in 'hopes' of obtaining something of value. It is a serious theoretical worldwide risk and threat, but the experts really don't see attacks against average domestic users.

All of my computers are vulnerable with Intel processors.

If you care to find out if your computer's Intel processor is vulnerable you can easily check it (as I did mine) with Intel's SA-00086 Detection Tool.

Intel offers various computer maker's (e.g. Dell, HP, etc.) and motherboard maker's (e.g. Aser, Gigabyte, VIA, etc.) support resources: https://www.intel.com/content/www/us/en/support/articles/000...

~~~~~~~~~~~~~

Download the Intel SA-00086 Detection Tool from Intel: https://downloadcenter.intel.com/download/27150?v=t

Or

Download the Intel SA-00086 Detection Tool from MajorGeeks: http://www.majorgeeks.com/files/details/intel_sa_00086_detec...

Note:
Use the Intel-SA-00086-GUI.exe to execute and test your personal computer.
The Intel-SA-00086-console.exe is for IT and server admins to check multiple computers across a network.

--
According to the laws of aerodynamics, bumblebees cannot fly. But the bumblebees, not knowing the laws of aerodynamics, go ahead and fly anyway...

MS KB4056892 Security Patch doesn't eliminate the processor flaw

Bayou Navigator wrote:

Despite knowing a patch had been readied by MS, MS Update failed to offer it until I performed an update of my anti-virus software. If you don't yet see an update from MS, check your AV product, which updating also results in a registry key MS Update is checking for before offering the MS Security Patch.

The Microsoft KB4056892 Security Patch doesn't eliminate the processor design flaw, but may add a degree of protection.

These links (below) will explain how to obtain the Microsoft Security Patch for Windows 10 based on which version you are using.

https://www.cnet.com/how-to/how-to-protect-your-pc-against-t...

https://www.cnet.com/how-to/how-to-fix-meltdown-spectre-inte...

--
According to the laws of aerodynamics, bumblebees cannot fly. But the bumblebees, not knowing the laws of aerodynamics, go ahead and fly anyway...

All Good Info, But Due To High Initially Reported BSOD Rates...

. . .isn't the purpose behind updating your AV product prior to applying the MS patch so that the AV update's new registry key signals MS Update that the AV product is now compatible with the update?

new registry key signals MS Update

Yes.

Look for this one:
Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWAREMicrosoftWindowsCurrentVersionQualityCompat" Value="cadca5fe-87d3-4b96-b7fb-a231484277cc" Type="REG_DWORD”

https://www.bleepingcomputer.com/news/microsoft/how-to-check...

--
-Quest, Nuvi 1390T

Apple Releases iOS Update to Patch 'Spectre' Chip Flaw

Apple Releases iOS Update to Patch 'Spectre' Chip Flaw

The latest version of the iPhone operating system addresses a major flaw in the processor that could leak sensitive information.

https://www.cnet.com/news/apple-ios-update-patch-spectre-chi...

--
According to the laws of aerodynamics, bumblebees cannot fly. But the bumblebees, not knowing the laws of aerodynamics, go ahead and fly anyway...

iOS Patch

I see that Apple has released iOS 11.2.2 as a security patch for my iPad Pro. It appeared to download very quick on my tablet, but then seemed to be quite slow in actually processing the update.

- Tom -

--
XXL540, GO LIVE 1535, GO 620

not to be cantankerous but..

I guess the question is how are we assured these updates lose the holes?

--
Never argue with a pig. It makes you look foolish and it anoys the hell out of the pig!

I'd like to see

I'd like to see comprehensive benchmarks over the next couple weeks on both windows 7 and 10 systems using all generations of Intel processors in both games and productivity. Supposedly haswell (4 gen) and up have PCID capability that mitigates some of the performance degradation. But I believe that the vendors must specifically code to use this.

Microsoft Halts Chip Patches After Some PCs Can't Reboot

Microsoft Halts Chip Patches After Some PCs Can't Reboot

The Windows updates patched the Spectre and Meltdown flaws. Some computers with chips made by AMD wouldn't turn on again after getting the update.

https://www.cnet.com/news/microsoft-amd-spectre-meltdown-hal...

--
According to the laws of aerodynamics, bumblebees cannot fly. But the bumblebees, not knowing the laws of aerodynamics, go ahead and fly anyway...

.

koot wrote:

Microsoft Halts Chip Patches After Some PCs Can't Reboot

The Windows updates patched the Spectre and Meltdown flaws. Some computers with chips made by AMD wouldn't turn on again after getting the update.

► https://www.cnet.com/news/microsoft-amd-spectre-meltdown-halt-chip-patches-pcs-unbootable-brick/

So it's safe now. No one can hack it.

Is that a question...or a statement?

chewbacca wrote:
koot wrote:

Microsoft Halts Chip Patches After Some PCs Can't Reboot

The Windows updates patched the Spectre and Meltdown flaws. Some computers with chips made by AMD wouldn't turn on again after getting the update.

► https://www.cnet.com/news/microsoft-amd-spectre-meltdown-halt-chip-patches-pcs-unbootable-brick/

So it's safe now. No one can hack it.

Is that a question...or a statement?

--
According to the laws of aerodynamics, bumblebees cannot fly. But the bumblebees, not knowing the laws of aerodynamics, go ahead and fly anyway...

It's still hackable...

koot wrote:
chewbacca wrote:
koot wrote:

Microsoft Halts Chip Patches After Some PCs Can't Reboot

The Windows updates patched the Spectre and Meltdown flaws. Some computers with chips made by AMD wouldn't turn on again after getting the update.

► https://www.cnet.com/news/microsoft-amd-spectre-meltdown-halt-chip-patches-pcs-unbootable-brick/

So it's safe now. No one can hack it.

Is that a question...or a statement?

1) Use an axe

2) Pull out the processor and put it into a machine that's not had the software update and it's still vulnerable... maybe it's just exposed! razz

--
Never argue with a pig. It makes you look foolish and it anoys the hell out of the pig!

The only way to really

The only way to really prevent 'Meltdown' and 'Spectre' is to replace the processors that can cause information leakage under certain circumstances. The Windows and Apple software updates only help close the holes a little, but don't fully close them all the way.

Also, these updates are said to slow some computers by as much as 30% based on the processor the computer uses.

--
According to the laws of aerodynamics, bumblebees cannot fly. But the bumblebees, not knowing the laws of aerodynamics, go ahead and fly anyway...

Microsoft Says No More Windows Security Updates Unless AVs ...

Steve Gibson's InSpectre Utility

BarneyBadass wrote:

I guess the question is how are we assured these updates lose the holes?

Even after applying all patches that've been offered to date, I was surprised to learn that my "older" CPU was still unprotected against one of the two vulnerabilities and that I could expect system performance to be notably slower while existing protection remains enabled. The option to disable or (re)enable protection from each vulnerability is built in to the utility (or grayed out if unavailable) and EXPLAINED. Techies should also check the details and explanation available through the Details menu accessible by clicking the ghost-like InSpectre icon at the top left.

More info and a download link are available at the GRC web site:
https://www.grc.com/inspectre.htm

Seems like

Seems like Microsoft is withdrawing its Spectre Mitigation patch.
https://www.bleepingcomputer.com/news/microsoft/microsoft-is...

--
-Quest, Nuvi 1390T