“Meltdown & Spectre again !!” – This is the most popular happening in cybersecurity now.  It’s a known fact that Meltdown & Spectre exploit critical hardware vulnerabilities in modern processors.

Let’s have a look at Meltdown-Spectre in detail.

In the starting of 2018, it was reported that almost all computer chips manufactured within the last 20years are affected by fundamental and widespread vulnerabilities, which are fatal. Researchers found that if exploited, these vulnerabilities allow attackers to get hold of data, even in protected memory (holds protected data. Every process in a computing system access data after privilege check. This allows every program to keep its data hidden from some of the users and enable operating systems to prevent one program from seeing data of another program). Three variations to this vulnerability were found and they were given CVE (Common Vulnerabilities and Exposure Program) numbers.  One among them – identified by Jann Horn (Google Project Zero); Werner Hass and Thomas Prescher (Cyberus Technology); Daniel Gruz, Moritz Lipp, Stefan Mangard and Michael Schwarz (Graz University of Technology)- was named as Meltdown(CVE-2017-5754). The other two – identified by  Jann Horn (Google Project Zero) along with Daniel Genkin, Mike Hamburg, Moritz Lipp and Yuval Yarum- were grouped as Spectre (CVE-2017-5753 and CVE-2017-5715).

Meltdown & Spectre are mentioned together because they are variants of one underlying vulnerability. As mentioned before, these vulnerabilities give ways to get hold of protected data (includes personal data, sensitive business information, password details, etc.) by exploiting two important techniques which are used to increase the speed of computer chips. These two techniques are –Speculative Execution (a process where the chip attempts to predict future. Example: in idle time, chip performing a particular function in a program which  has been used frequently in order to get its result faster) and Caching (a process used to store the data often needed or used by the system in CPU cache. Often, output data of speculative execution get stored in cache and this increases speed). Vulnerabilities occur when speculative execution & cache deal with protected memory.

Characteristics of Meltdown and Spectre

• MeItdown ‘melts’ the normal security boundaries enforced by hardware. Attackers will be able to use a program on a machine to access every data irrespective of its privilege.
• Meltdown doesn’t need too much knowledge on the program upon which the attacker works.
• Spectre – The name comes from speculative execution. Stopping it will be difficult.
• An attacker can make a program to reveal its protected data by using spectre
• Spectre needs in-depth knowledge of the attacked program’s data, and it doesn’t access other data.
• Meltdown or Spectre exploitation doesn’t leave any trace in log files. So, difficult to detect.
• Practically unlikely to detect using antivirus softwares.
• High risk involved, leakage of important as well as sensitive data.
• Every type of digital device – Desktop, Laptop, Smartphones, Cloud computing devices – can be affected.

Patches for Meltdown Spectre

Even though so many software patches have been released (even from giants like Intel, Microsoft, Apple and Google), patching is practically impossible because, in Meltdown Spectre, the fundamental vulnerability exists in the hardware. But KAISER patch released in 2017 for improving Linux security, has a side effect of preventing meltdown attacks.

Javascript codes on a website can exploit spectre to trick web browsers to reveal sensitive information like username and password. This makes browser updates a very basic thing to stay away from spectre attacks.

Patches have been released from Firefox, Microsoft – Windows 7, Google – Chrome browsers, Apple – macOS, iOS, tvOS operating systems, Safari browser. Since Android mobiles are numerous, it cannot be made sure whether all of them are patched. So many of them which are directly from Google and Samsung will have adequate patch updates where others may not. Systems like Windows XP are among those which are not patched.

These patches disable speculative execution and caching, exploiting which Meltdown Spectre works. But the risk is, this can slow down overall system performance because speculative execution and caching aims to make systems faster.

All these information underlines the fact that any modern digital system (every Intel processor since 1995, except Intel Itanium and Intel Atom before 2013) can most probably be affected by Meltdown Spectre – a fundamental vulnerability, which is difficult to detect, widespread as well as dangerous resulting in the breach of sensitive data. This enormously increases the importance of adequate security patch updates.