Jump to content


Game Makers
  • Content Count

  • Joined

  • Days Won


Maverick last won the day on April 15

Maverick had the most liked content!

Community Reputation

1,045 Distinguished

About Maverick

  • Birthday 04/17/1996

Personal Information

  • xat Username

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

Single Status Update

See all updates by Maverick

  1. Overview of Meltdown and Spectre

    You have probably heard the news of new vulnerabilities that affect most major chipsets,

    including Intel, Arm, and AMD. This means that the vulnerability affects nearly everyone

    who owns a computing device.


    What is the vulnerability?


    The vulnerability affects how systems isolate sensitive data in memory. Exploiting the

    vulnerability could allow an attacker to gain access to data such as passwords, encryption

    keys, or potentially data from other virtual systems on the same server.


    Right now there are two specific vulnerabilities being dubbed Meltdown and Spectre.


    Meltdown: This vulnerability is the easiest to exploit and the one getting the most 

    attention. It primarily affects the Intel chipset and is current being addressed with

    operating system level patches from Microsoft, Apple and various Linux distributions. It 

    works by using a method called "speculative execution" to infer values in protected memories. This vulnerability has been assigned CVE-2017-5754


    Who is affected?


    Basically anyone with a computer. This would include local devices you use like laptop and

    desktop computers, but also potentially your phones and tablets, as well as IoT devices. It 

    also includes servers and services you may visit as well, most notably cloud systems that 

    offer virtualization. The vulnerability has been verified to work on chipsets going back to at 

    least 2011 and likely affect CPUs going back as far as 1995.


    Most at risk right now are systems using the Intel chipset as they are the easiest to exploit, 

    and the first proof-of-concept exploits are being released target Intel. This means that your 

    laptop is probably more at risk than your phone, for now.


    How can this be attacked?


    To exploit these vulnerabilities, an attacker would need to execute code on a local system. 

    This could be performed in a variety of ways. Being locally logged in, even as a low-level or 

    nearly unprivileged user, would allow the attacker to launch the attack. Attackers could also 

    launch the attack remotely if they can get malicious code executed on a local system. This 

    could take the form of downloaded malware and malware pushed via malicious websites or 

    even through malicious documents.


    Has it been attacked "in the wild"?


    Nothing has been detected as being exploited in the wild so far. Since these vulnerabilities

    have been disclosed by security researchers rather than being discovered in an active 

    attack, it's likely that attackers were not aware of these vulnerabilities until everyone else. 

    This will quickly change however, as proof-of-concept exploits are already being written and 

    floated around the internet. It is probably only a matter of time until we see these 

    vulnerabilities exploited in malware and local attacks.


    What is the solution?


    Since these issues are hardware related and vary widely dependent on specific software, 

    complete fixes will be complex and likely take a while to get here. Luckily while Meltdown is 

    easier to exploit, it's also easier to address. And while Spectre is a harder problem to patch, 

    it is also much harder to exploit (right now).


    Currently OS vendors like Microsoft, Apple and Linux are releasing patches that will provide 

    protection against Meltdown attacks. These patches work by removing shared kernel 

    mapping which prevents the ability to predict values in protected memory. Unfortunately, by 

    removing this feature, a lot of processing efficiency is removed as well. This will result in 

    some performance decrease for those systems. What that decrease is will depend on how 

    heavily software relies on this memory access, but current estimates suggest anywhere 

    from a 5%-30% decrease in overall software performance.


    Intel has released firmware updates, but some people seem to have a misconception that 

    firmware updates occur as a simple, generic patch that anyone can download. This is far 

    from the truth. The biggest problem with the firmware updates that are being released is 

    that firmware will be vendor and model specific. Intel develops multiple firmware updates for 

    each different chip. These firmware updates are then distributed to the computer vendors 

    like HP and Dell who, in turn, have to test and release them to their customers for each 

    model of computer they sell.


    For instance, here's Intel's page on how to get their firmware updates. It basically provides 

    links to the individual computer vendor's site: 


    If you look at Dell's linked page, as an example, you can see dozens of updates that are 

    model dependent:


    Adding insult to injury, most firmware updates need to be installed directly on the system 

    requiring a person physically in front of the machine. Whether you send every user a USB 

    stick with instructions for installation (and lots of prayer) or you send an IT person to every 

    terminal, you can see how burdensome and complex the process can become. Even 

    figuring out which updates are needed for an enterprise fleet of computers of different 

    vendors and models can be an overwhelming task. Pair this with the need for software 

    patches, like those from MS, Apple and Linux and every company's IT will be in overdrive 

    for the foreseeable future over this issue.

    In the meantime, all the things we currently recommend to prevent malware apply here. 

    Avoid suspicious email attachments, documents and websites. Make sure you use long and 

    complex passwords to prevent unauthorized users from accessing your system and keep 

    your software up to date with patches.


    Additional resources

    FAQ and Technical Documents: https://meltdownattack.com/

    Round Up of Vendor Responses: https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre-heres-what-intel-apple-microsoft-others-are-doing-about-it

    SpiderLabs will be keeping an eye on these vulnerabilities as more information is released.

    Original post: https://www.trustwave.com/Resources/SpiderLabs-Blog/Overview-of-Meltdown-and-Spectre/


    [UPDATED 1/5: typo correction, expansion of "What is the solution?" section and addition of 

    "Additional resources" section]

    1. Jedi


      On linux: update your kernel, reboot your machine.

  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.