Tech firms rush out patches for ‘pervasive’ computer flaw
“Businesses and consumers should update operating systems and apply patches as soon as they become available.”
Intel updates
Computer chipmaking giant Intel — the focus of the first reports on the flaw — said the company and its partners have made significant progress in deploying updates to mitigate any threats.
An Intel statement said, “Intel expects to have issued updates for more than 90 percent of processor products introduced within the past five years.
“In addition, many operating system vendors, public cloud service providers, device manufacturers and others have indicated that they have already updated their products and services.”
But John Bambenek, a Fidelis security researcher who works with the SANS Internet Storm Center, warned that it may be too soon to know the extent of the problem.
“This bug is probably worth its name and logo considering the pervasive nature of the vulnerability.
“Contrary to some initial reporting, this is not just an Intel bug, it affects AMD and ARM processors as well. These could even be used in cloud... environments to leak memory outside the running virtual machine.”
In a web page dedicated to the vulnerability, security researchers said Meltdown and Specter may get hold of secrets stored in the memory of other running programs.
“This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.”
The two flaws work on personal computers, mobile devices, and in the cloud.
Apple said in a post at an online support page, “All Mac systems and IOS devices are affected, but there are no known exploits impacting customers at this time.”
It advised only getting apps from its online App Store which vets programs for safety, and said it has already released some ‘mitigations’ to protect against the exploit and planned to release a defensive update for Safari on macos and IOS in the coming days.
Some experts pointed out that the only real ‘fix’ in some cases would be replacing the chip itself, which would be a massive issue for the computing industry.
Bambenek said, “The good news is patches are out for almost everything.
“The bad news is, Specter, in particular can’t be completely mitigated by patching as it seems it will require a hardware fix. The good news is that Specter is harder to exploit.”
The US government’s Computer Emergency Response Team initially indicated in a bulletin that only a hardware fix would solve the problem, but then removed that from an update.
The first bulletin said, “Fully removing the vulnerability requires replacing vulnerable CPU (central processing unit) hardware.”