Spectre? Meltdown? What can I do?

Have you been hearing about “MELTDOWN” and “SPECTRE” security exploits lately? What does it all mean? These are flaws in the methods computers use to protect your security while working on your computer. Essentially, for several years now, computers have used something called Address Space Layout Randomization to make it harder to attempt to “hack” a program that might be running on your computer (you don’t know how to target something if you can’t find it). To do this, operating systems like Windows, Linux, and Mac OS relied on code that resided inside the CPU of your computer, in the hardware itself. It turns out that the “random” numbers aren’t as random as once thought, and can now be deciphered.

One researcher showed an example on Twitter of how you can easily decipher a password in real time if you can find the address space to target a specific application:

It’s not hard to picture this being exploited, instead of as seen on screen in the GIF above, to a secret text file hidden on the computer, logging all of your keystrokes and passwords and the things you copy and paste, or even the results returned from a website after you log in. Almost anything could be logged and then sent quietly over the internet to someone else’s computer.

 

What you can do

January 9th, 2018 cannot get here soon enough – that’s when Microsoft intends to release its patches to the world to address these exploits, particularly the one called “Meltdown.” I wouldn’t even be surprised if Microsoft panics and releases an update out of cycle this weekend. Either way, next week: UPDATE YOUR COMPUTERS. This goes for 64-bit Windows 7, 8, 8.1, and 10. If you have 32-bit Windows, no patch is available and none has yet been developed. But keep checking, and if you have a 64-bit version of Windows, which you most likely do if you bought your computer in the last 10 years, just run Windows Update and install the latest fixes when they’re available. If you have a Mac / MacBook, make sure you have High Sierra 10.13.2 (the December 6th patch that also fixed the Root user access vulnerability). You simply need to check for updates in the app store to update MacOS. Linux users, you should apply the KPTI (formerly KAISER) patch.

The fallout

“Meltdown” targets specifically Intel CPUs; it has already and will receive many patches, and these patches will be further fine tuned. Right now they can lead to a loss in performance, but your average user shouldn’t notice much of a decrease in speed during their day-to-day activities.

“Spectre” will also target AMD and ARM brand CPU’s; what that means to you is that almost every single tablet and phone out there has an ARM CPU inside of it. Samsung phones. iPhones. Other Android and Windows Phone devices. They’re all vulnerable. The good news is that “Spectre” is much harder to exploit. In simplest terms, it’s more of a probe than the highly focused laser that is “Meltdown.” This would be used more for targeting specific people, than just broadly out there infecting random computers. While software and hardware vendors may release updates for your devices which will harden against those attacks, the long-term solution is going to require new hardware – and it’s my understanding that as of this posting, none on the market is immune to both of these attacks.

Just keep your systems hardened against attacks by keeping them up to date, whether they are a Mac OR a PC. That is your best course of action at this time.

%d bloggers like this: