- Joined
- Mar 29, 2016
- Messages
- 3,732
- Reaction score
- 0
Two major flaws in computer chips could leave a huge number of computers and smartphones vulnerable to security concerns, researchers revealed Wednesday.
Links Source 1 : http://money.cnn.com/2018/01/03/technology/computer-chip-flaw-security/index.html (General Thread Link)
Links Source 2 : http://money.cnn.com/2018/01/04/tec...e-macs-ios-spectre-meltdown/index.html?iid=EL (All iPhones, iPads and Macs affected by chip flaws)
And a U.S. government-backed body warned that the chips themselves need to be replaced to completely fix the problems.
The flaws could allow an attacker to read sensitive data stored in the memory, like passwords, or look at what tabs someone has open on their computer, researchers found. Daniel Gruss, a researcher from Graz University of Technology who helped identify the flaw, said it may be difficult to execute an attack, but billions of devices were impacted.
Called Meltdown and Spectre, the flaws exist in processors, a building block of computers that acts as the brain. Modern processors are designed to perform something called "speculative execution." That means they predict what tasks they will be asked to execute and rapidly access multiple areas of memory at the same time.
That data is supposed to be protected and isolated, but researchers discovered that in some cases, the information can be exposed while the processor queues it up.
Researchers say almost every computing system -- desktops, laptops, smartphones, and cloud servers -- is affected by the Spectre bug. Meltdown appears to be specific to Intel (INTC) chips.
"More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors," the researchers said.
Government agencies issued statements warning users about the vulnerabilities.
The U.S. Computer Emergency Readiness Team said that while the flaws "could allow an attacker to obtain access to sensitive information," it's not so far aware of anyone doing so.
The agency urged people to read a detailed statement on the vulnerabilities by the Software Engineering Institute, a U.S.-government funded body that researches cybersecurity problems.
The institute said that "fully removing the vulnerability requires replacing vulnerable [processor] hardware."
It later changed its guidance on Thursday to suggest updating software was enough. The institute didn't say why it had made the change and didn't immediately respond to a request for further information.
It said the problems affect technology giants including Apple, Google and Microsoft.
Intel chips are found in everything from personal computers to medical equipment. The company's shares were down 3% on Wednesday.
The company said in a press release that "many types of computing devices — with many different vendors' processors and operating systems — are susceptible to these exploits."
Intel said it is working with other chipmakers, including AMD and ARM Holdings, to solve the issue. ARM said in a statement a small subset of its processors are susceptible to the flaws. AMD said in a statement there is a "near zero risk of exploitation" for one of the security issues, due to architecture differences.
Links Source 1 : http://money.cnn.com/2018/01/03/technology/computer-chip-flaw-security/index.html (General Thread Link)
Links Source 2 : http://money.cnn.com/2018/01/04/tec...e-macs-ios-spectre-meltdown/index.html?iid=EL (All iPhones, iPads and Macs affected by chip flaws)
And a U.S. government-backed body warned that the chips themselves need to be replaced to completely fix the problems.
The flaws could allow an attacker to read sensitive data stored in the memory, like passwords, or look at what tabs someone has open on their computer, researchers found. Daniel Gruss, a researcher from Graz University of Technology who helped identify the flaw, said it may be difficult to execute an attack, but billions of devices were impacted.
Called Meltdown and Spectre, the flaws exist in processors, a building block of computers that acts as the brain. Modern processors are designed to perform something called "speculative execution." That means they predict what tasks they will be asked to execute and rapidly access multiple areas of memory at the same time.
That data is supposed to be protected and isolated, but researchers discovered that in some cases, the information can be exposed while the processor queues it up.
Researchers say almost every computing system -- desktops, laptops, smartphones, and cloud servers -- is affected by the Spectre bug. Meltdown appears to be specific to Intel (INTC) chips.
"More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors," the researchers said.
Government agencies issued statements warning users about the vulnerabilities.
The U.S. Computer Emergency Readiness Team said that while the flaws "could allow an attacker to obtain access to sensitive information," it's not so far aware of anyone doing so.
The agency urged people to read a detailed statement on the vulnerabilities by the Software Engineering Institute, a U.S.-government funded body that researches cybersecurity problems.
The institute said that "fully removing the vulnerability requires replacing vulnerable [processor] hardware."
It later changed its guidance on Thursday to suggest updating software was enough. The institute didn't say why it had made the change and didn't immediately respond to a request for further information.
It said the problems affect technology giants including Apple, Google and Microsoft.
Intel chips are found in everything from personal computers to medical equipment. The company's shares were down 3% on Wednesday.
The company said in a press release that "many types of computing devices — with many different vendors' processors and operating systems — are susceptible to these exploits."
Intel said it is working with other chipmakers, including AMD and ARM Holdings, to solve the issue. ARM said in a statement a small subset of its processors are susceptible to the flaws. AMD said in a statement there is a "near zero risk of exploitation" for one of the security issues, due to architecture differences.
