Daniel Meissler posted an amazingly succinct, yet accurate, description of the tech behind the Meltdown and Spectre vulns. If you want to understand e
[See the full post at: Best explainer yet for Meltdown and Spectre]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
Best explainer yet for Meltdown and Spectre
- This topic has 88 replies, 20 voices, and was last updated 7 years, 4 months ago.
AuthorViewing 13 reply threadsAuthor-
I think the absolute most important thing this article emphasizes is this:
The major risk consideration here is whether someone is able to run code on your machine.
Some things to discuss:
I don’t believe running a pure JavaScript script is what he means by “run code on your machine”. Usually that terminology refers to running machine code, i.e., compiled instructions. This matters if we’re talking about being exploited by viewing a web page.
We all run a LOT of machine code on our systems. Basically anything you didn’t write or vet and compile yourself falls into that category. And for a long time it’s been known that machine code could compromise your security. Yet people buy or download software and survive, because most of it actually is trustworthy. All of us already have processes in place to see to it we don’t run bad machine code. You can, for example, see almost all of what’s on the web without running any ActiveX / Add-ons to your browser.
Don’t be duped into thinking that only because you allow machine code to run only in user space or with low privileges (i.e., without UAC Administrators escalation) you are safe. While it may be true that certain things – such as actual malware you’ve somehow managed to get running – could be cut off from being able to do more damage or snooping, generally speaking the entire world of software is NOT out to get you. Very much software today is benign and valuable. In fact, there are those of us who ALWAYS run everything privileged, because it’s the most efficient and effective way to do computing, and guess what? No infections, no snooping. UAC actually offers almost no real protection, and Meltdown/Spectre show us why. Concentrate on not running malware in the first place, rather than what to do once it’s running. It doesn’t have to be inevitable that you’ll run malware!
All I advise is this: Learn more before acting.
Make sure to keep a level head and understand the risks and benefits before doing something to respond to the latest OMG! well-marketed set of vulnerabilities. Always remember that there are folks who want you to do things out of fear that will ultimately benefit them, and ponder this: Who will benefit if your computer is 30% slower?
-Noel
-
Is it paranoid to wonder to what extent this thing is being promoted by various people, including those who would like to force us all into Group A?
Andy Grove: Only the paranoid survive.
1 user thanked author for this post.
-
The Spectre paper at https://spectreattack.com/ has a JavaScript example.
2 users thanked author for this post.
-
Interesting… http://www.spectreattack.com is very similar to http://www.meltdownattack.com (which has had some content changed since yesterday, but no changelog).
They are from Graz University of Technology (AT), and note they have received a bug-bounty from Intel for their work.
-
Thanks. A key statement:
Like other optimized JavaScript engines, V8 performs just-in-time compilation to convert JavaScript into machine language.
V8 is the JavaScript engine in Google Chrome. It may be that not all JavaScript engines are equally vulnerable, though the information is still sketchy. I have already read that the engine underlying the Pale Moon browser (which I have chosen to use) doesn’t offer the same vulnerability.
This could also say that conceptually it’s not a bad idea to run an off-the-beaten-path browser whose internals are less likely to be taken advantage of.
And it also says that avoiding running scripts may now be approaching the level of importance as avoiding running executables. That’s a bit different than my prior take on the matter and requires further thought.
Someone has already mentioned the “noscript” add-on, and of course things like uBlock can prevent a lot of site scripts from even being downloaded. However, adding on executable code comes with its OWN risks and requirements for trust. I personally have been using uBlock Origin for quite some time in Pale Moon to afford extra protection from visiting known bad sites.
-Noel
8 users thanked author for this post.
-
-
Thank you for rationally talking us off the ledge. I feel comfortable doing some things to my computer, so I am not a complete noob. However, when there is talk of firmware updates, that starts to scare me a bit.
What would that kind of update entail? If it is downloading and running a program like “normal” updates, no problem. Honestly, I am getting the same feeling when I hear firmware update as I do each time I absolutely have to do an iOS update on my iPads, since it takes so long and basically rewrites the entire operating system… Should I be feeling this way about a firmware update? Can I assume very detailed instructions will be given should a firmware update be released?
Woody, you and the gang here are my lifeline, and I truly appreciate your efforts.
2 users thanked author for this post.
-
A firmware update is an update to the hardware (as opposed to the software/OS. It used to be that you had to boot from a source other than the HDD and install it. But nowdays, it is usually an executable that you download and double click on. The one thing you have to be careful of, though, is you don’t lose power to the device during the update because it can render the component unusable.
-
I worry that such firmware/microcode updates are “trap doors”, once taken, impossible to undo.
Wouldn’t it be cool if there was an application that had a pair of Radio Button controls, so we could try before and after against one another and see what the ramifications are. Maybe the update is innocuous, or maybe it causes havoc.
As it is, we’re pushed to “take the latest update [blindly] and not look back”. I just don’t see that as a good thing.
-Noel
4 users thanked author for this post.
-
-
-
A look in the manual would of course clear things up!
Using Asus motherboards also allows installing a saved or other older bios. Have used that option once on my trusty old P6X58D-E board.
Never been particulary thrilled by burning bios though. Probably the single biggest threat of a toasted system.
Except for Microsoft updates of course…. they are way ahead here. Sigh.
-
-
-
-
I don’t believe running a pure JavaScript script is what he means by “run code on your machine”.
The Mozilla devs have said that they intend to (or already have?) issue a patch to reduce the resolution of the timer available in JavaScript, which apparently is necessary to perform the attack via JS. It would not surprise me if there was another method discovered to thwart this attack from running at all, whether that be in the script interpreter or in an addon like NoScript. If NoScript were to simply ask permission for any script to have direct memory access, which it seems it would have to in order to make use of this vulnerability, that would block it quite effectively for the target audience of NoScript (not beginners, to say the least).
In fact, there are those of us who ALWAYS run everything privileged, because it’s the most efficient and effective way to do computing, and guess what?
I thought about that very fact last night. If you run with admin privileges all the time, it would seem that this exploit has no value whatsoever, as its whole purpose is privilege escalation in terms of memory reads. No escalation is needed if you’re already running the errant process with admin rights.
This is a real issue, but it seems like one that’s a lot smaller than the hype would suggest. At this time, I have no plans to allow performance-robbing fixes on Windows or Linux. Good code doesn’t come out of hurrying to get something out quick– it is possible that an elegant, efficient fix is out there somewhere, just waiting to be discovered/invented. Until then, I will reserve my panic for when an actual drive-by infection is confirmed in the wild, and that it is further confirmed that the attack vector in use is one that I am susceptible to.
Who will benefit if your computer is 30% slower?
AMD? <grin>
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)8 users thanked author for this post.
-
In fact, there are those of us who ALWAYS run everything privileged, because it’s the most efficient and effective way to do computing, and guess what?
I thought about that very fact last night. If you run with admin privileges all the time, it would seem that this exploit has no value whatsoever, as its whole purpose is privilege escalation in terms of memory reads. No escalation is needed if you’re already running the errant process with admin rights.
Thanks for taking up this aspect of the discussion.
One thing that has been worrying me is that people have been led into a false sense of security by the visible promise that UAC will protect them. I have always believed that it’s false, and these particular exploits now show that it truly is. It’s tough to make things foolproof because fools are ingenious.
Instead of being wary of running anything in any way, users have been led to believe they can safely run any old software on their computers/devices because they’re perfectly internally protected (“sandboxed”) from doing harm. People often think that if they don’t allow things at a UAC prompt, or if they only run things in a non-privileged account, then they’re invulnerable. It isn’t so! And I’m not even talking about the [more than?] occasional “Oops, I shouldn’t have clicked [Yes] for that!”
Did/does this visible privilege escalation overhead cause people to be more cavalier about downloading and running things, thus exposing them to GREATER risk than if they simply weren’t led to believe they are protected? I personally think so.
And now we’re learning that JavaScript, which was supposed to be interpreted and well-protected against doing anything it’s not supposed to do is actually capable of being exploited because the engineers have turned it into essentially a compiled language. What were they thinking? Beat the other browsers’ performance at all costs? Deliver more glitz in browsers, because glitz sells more?
I’ve always felt it is safer to lock the front and back doors and only entertain a few trusted friends occasionally than to invite all the neighborhood in all the time and try to watch them all carefully to ensure no one takes the silverware. It seems to work. I never allow executable code to be downloaded/run by a browser without my specific involvement. And now it’s looking more and more like it’s high time to be even more selective about what sites are allowed to run scripts.
-Noel
5 users thanked author for this post.
-
Good point from Ascaris and good point from you, Noel.
I completely agree that UAC should not be seen as a panacea. When you think about it, UAC only (and in theory only, because in practice it doesn’t even seem to work that well for smarter bad code) prevents a user code from doing admin reserved things.
To simplify what it means, it just means that if it worked, the bad software could only do what you can do as a user with a limited account on your computer, which is a lot! It could read and modify or delete all your user files. It could auto start when you start your computer, spy on you, basically control your computer as if you were sitting there. It could also launch code to try to trick you into elevation and grant more power, asking for your admin password looking like it is a legitimate Windows prompt. That is the minimal thing it could do. I am not even starting the discussion on the ways UAC can be circumvented.
What seems to happen though in this particular case is a bit different to me than you running as admin. Running your browser as admin, you might not expect a javascript to do bad things or consult admin reserved memory space outside the browser. Unfortunately, this barrier seems to be broken. Being a user of noscript, I feel that the majority of the web experience is broken if you don’t enable javascript, unlike with ActiveX, so this can be potentially bad if no better fix is found.
In the end, it might turn out that the javascript issues might be mitigated and then the risk will be much less important. We have to wait and see.
1 user thanked author for this post.
-
-
-
FYI, the Pale Moon web browser is touted as not vulnerable.
For more info see: https://forum.palemoon.org/viewtopic.php?f=1&t=17928
-Noel
3 users thanked author for this post.
-
-
When I read what you wrote Noel, I feel like you describe an old view of code like in early 90s when viruses were code added to executables, no offense intended.
From what I understand, buffer overflows and similar attacks changed the whole game about this. You can’t say anymore that there is a distinction between code and document, as if you have a vulnerability, for example in your browser, anything thrown at it by the web as a file have the potential to be turned to code. That is the idea of the buffer overflow. It is a code injection technique that doesn’t need code to be injected, just a vulnerable program reading information from somewhere. Basically, your browser reads a tainted image, code is hidden in the image and is run by your browser because of the vulnerability exploited. But it needs a vulnerability to work and it needs to not get catched by an anti-exploit kit. Of course, your point is still valid when you don’t have a vulnerability in the first place.
In this case, it is different. The vulnerability makes it so that you can read parts of memory that are not supposed to be read. It doesn’t grant you access to user code directly like a buffer overflow would.
Maybe combining this vulnerability in a malware that exploits this in conjunction with an exploit for another vulnerability coud lead to privilege escalation on a vulnerability that would normally be only confined to user space. It would be bad, but in my book, it would already be bad to be compromised at the user level anyway. In big corporations, maybe the potential for harm is much greater if getting privilege escalation helps you gather other info you can use to hack more desirable targets inside.
But I understand that for someone like you, avoiding the malware in the first place and being generally patched, your risk is confined to a 0-day exploit not catched by your black lists maybe, so then this distinction between code and document generally stands.
2 users thanked author for this post.
-
Good points, thanks. It’s clear a good security strategy is a concerted, interconnected thing, not a fragmented set of disparate activities.
It really underscores that a “take this update and be protected against the latest nasties but everything will be 30% slower” vs. “don’t take this update [or any further updates] and become more and more exposed” choice is worrisome.
-Noel
1 user thanked author for this post.
-
-
-
-
-
My 2009-bought laptop’s CPU (with CPUID 306c3) seems to have recently released microcode available.
More good news: Even if your device maker doesn’t supply a BIOS with updated microcode, and if Microsoft doesn’t release microcode updates via Windows Update, there is another method to update microcode in Windows :).
1 user thanked author for this post.
-
-
-
I think we have yet to see how or when any of this is exploited and how effective it is. Also the patches and firmware updates may get tested and we will also see how if any speed is negatively affected. A lot of this is speculation as to how this will be mitigated. I read a ton of theories and very little about anything out there trying to exploit this yet. Since this issue has been around since 1995 or so and nobody has taken advantage of it. In fact nobody has even found a proof of concept until last year. I have to wonder if this is all very much over hyped hysteria over nothing.
2 users thanked author for this post.
-
-
Any citations?
1 user thanked author for this post.
-
“I understand that Intel is releasing microcode updates for their processors but have not been able to nail down what is happening from a short visit to Intel’s website. Any information anyone has on this, I would find interesting and useful.”
If your CPU has CPUID of 306c3, 306d4, 306f2, 40651, 406e3, 406f1, 50654, 506c9, 806e9, or 906e9, then my interpretation of this link is that a microcode update has already been created for your CPU.
See also https://www.askwoody.com/forums/topic/best-explainer-yet-for-meltdown-and-spectre/#post-156543.
-
-
A few questions spring to mind.
Do these CPU microcode updates that are supposed to be required have a performance penalty like the OS-based updates?
What degree of protection is offered by updating just one or the other (microcode xor OS) compared to doing both, which we’re told is necessary? Are both of them truly necessary to get any benefit, or is it that both are required to get ALL of it?
If I block the Windows patch via the registry key, will the other security updates contained in the same update and in all the ones after that still be installed, or is it just a brute-force “block all until the antivirus gets patched?”
If Windows Defender (which I am using) updates to the point that it sets the “all clear to patch” registry key, can I edit that and expect the edit to stick (ie keep blocking updates), or will Defender keep setting the key?
What happens when you have more than one antimalware program installed? I have Defender and Malwarebytes Anti-Exploit (free). If Defender (which still has itself registed as the One True Antivirus on the system) sets the “all clear” key, but MBAE is not compatible, then what? MBAE is not intended to be a full antimalware; it is meant to work in addition to one.
Does the key simply prevent the installation of the anti-Meltdown patch, or does it prevent it from running if installed? I am leaning toward the former now… I had thought it was the latter, like the Linux patch, but now I am not so sure.
It’s kind of weird how they seem to be doing it. If the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat contains a value whose name is a specific UUID, with a value of 0, it will consider that a go-ahead for the Meltdown patch. It doesn’t say what other values do; it merely states that setting it to 0 will get you the patch. Seems backwards that an assumed null value (no key) does not mean the same as an enumerated null value of literal zero.
I wonder if it would be possible to delete that UUID value and set the key’s permissions to block anyone but members of Administrators from changing it.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)3 users thanked author for this post.
-
I can give one answer here.
Lack of the Registry key prevents it from being offered by WU. It does not block manual installation of the patch. I tried yesterday with Win7, Win8.1 and Win10 1709.
Without the key, I was able to manually install both the SO and Rollup on Win7, the SO on Win8.1 and the CU to 16299.192 on 1709. This in VMs, of course, so not risking BSOD and loss of use.5 users thanked author for this post.
-
THAT is good-to-know practical information! Much appreciated.
This is the registry key/value info, just in case you want to check/control whether it’s present on your system:
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat] "cadca5fe-87d3-4b96-b7fb-a231484277cc"=dword:00000000
In summary: If the above registry value exists, WU offers the update.
I found the key/value to already exist on my Win 7 system running Microsoft Security Essentials, which keeps itself up to date, but the system does NOT check automatically for Windows Updates.
-Noel
-
-
-
The reference you quote applies to service through Windows Update.
Lack of the Reg key kept the update from appearing in Windows Update.
But I was able to install manually in the absence of the Reg key on three different version.
On another one, I manually added the Reg key and the update appeared in Windows Update. – But that’s asking for trouble, right?Facts are facts.
-
-
You will believe whichever you want to believe.
3 users thanked author for this post.
-
-
-
-
Paul and PK,
Let me give you what additional information I can.
I use Avira Free, which had set the key.
I deleted the key with O&O RegEditor and closed it. I then re-ran it and it showed that the key was deleted.
I ran the installer. After it had finished I reran O&O RegEditor, which showed that the key had been set.
windows7forever
-
Avira is setting the key. It will continue to reset the key.
The Win installer does NOT set the key.
Thanks for the information.1 user thanked author for this post.
-
-
Sorry, I don’t see any difference in what PKCano is saying, and Woody’s posts are saying, even when I read the full posts, not just the quotes here.
Non-techy Win 10 Pro and Linux Mint experimenter
1 user thanked author for this post.
-
-
-
-
-
-
-
Paul said:
Specifically, are you in the habit of daily or weekly powering down and coldbooting your operating system.Yes, I shut down & cold-boot my Win 7 at least once daily. And I have cold-booted the system 3 or 4 times since the last 2 Win Defender updates over the past 2 days. May I know the relevance ? So far, Win Defender has never requested or forced a system reboot after updates, even when the engine version (mpengine.dll) gets updated. (I have a habit of checking which EXEs, DLLs & VDMs Win Defender replaces after an update.)
But the Defender that you find in Win7 is not. If I read you, and possibly others, correctly you should install MSE on your Win7 system, or chose your favorite 3rd party protection.
Thanks for the advice. I’m not a fan of Win Defender (or any Microsoft malware solutions, including MSE) though. I prefer applications that allow more user customization & control, so since day 1, I’ve been using 3rd-party antivirus for real-time protection, supplemented by a couple of standalone malware scanners for on-demand 2nd-opinion scanning.
Since Win Defender was shipped with Win 7 (without me having any say in it), I set it to disabled as soon as Win OS is installed, & periodically check for updates whenever there are any reported vulnerabilities. Likewise for IE browser, even though I never use it. It’s like making sure that sickly-prone people in the same house (otherwise known as Win OS) get their critical vaccinations & medicine when the need arises.
After checking that Win Defender got updated & runs correctly (thus the perfunctory quick system scan after an update), I set the service (which I enabled in order to run Win Defender) back to disabled again.
Still no sign of that HKLM registry key to date … Oh, perhaps Win Defender needs to be running continuously for at least 24 hrs (hence Win OS must NOT be shut down or rebooted for at least 24 hrs), before Win Defender slowly decides to set that registry key ?
-
-
Paul said:
“If you have disabled Defender from the beginning, and use a 3rd party product that serves you better, the key should be set by that product, if it is compliant.”The majority of the 3rd-party antivirus vendors have not pushed out a fully-compliant update yet — ie. supports Meltdown patch AND also sets the required registry key. Even though several vendors have made their products refrain from making unsupported calls into kernel memory, most have not included the additional fix for the registry key.
Since Microsoft is the very first to claim (03 Jan 2018) that Win Defender & MSE are fully compliant, & since my system lacks the registry key, I thought it was a good opportunity to check if an updated Win Defender does what MS claims.
I still don’t have the registry key, but my plan was to backup & delete the compliant registry key if Win Defender did set it. Considering the uncertainty over the patch’s safety, I’m not in a hurry to install MS’s Meltdown KB patch soon.
1 user thanked author for this post.
-
-
-
Paul said:
Each time I have read one of these stories of conflicting information, I wonder about the habits involved.Below is an IT administrator with a similar experience of the mysteriously missing compliant registry key for multiple Win OS systems with updated Microsoft System Center Endpoint Protection.
Yet, the machines lacking the requisite registry key were offered the Meltdown KB patch via WSUS. (Oh dear …)
Ron (08 Jan 2018):
The environment I am supporting has machines running Windows 7, Server 2008R2, 2012R2, and 2016. All the machines are running different versions of System Center Endpoint Protection and are patched via WSUS 2012 R2.I would say that only 20% of the machines are being offered the Meltdown and Spectre patch. On the machines that are being offered the patches, I find no trace of the the QualityCompat registry key. I have checked on the machines with the latest version of System Center Endpoint Protection client and on machines with older versions of the End Point client. Is Microsoft not using the same registry key for their own AV products?
On machines that are not being offered the patches, I have added the QualityCompat key and had some success in getting them to be offered the patch after rebooting the server. It seems that the patch/AV registry check process is faulty.
1 user thanked author for this post.
-
Paul said:
these stories of conflicting informationAt a separate askwoody thread, there is another case of the latest-updated Windows Defender failing to set the compliant registry key.
James Bond 007 said (<span class=”bbp-reply-post-date”>January 7, 2018 at 7:57 am):</span>
(4) Reactivated Windows Defender, instructed it to check and install the latest updates, then deactivated it again.
(5) Reboot the virtual machine, and that registry value still has not been set.OS: Win 7 on VMware Workstation
CPU: Intel Core i7 6800K CPU1 user thanked author for this post.
-
-
-
-
Thanks, Noel Carboni, for the reassurances.
Now, to spice it up a bit again, maybe:
What about embedded systems?
In cars, airplanes, public utilities, anything with “smart” in the name …
Some are Internet connected for monitoring and control, some are not, but have ports to attach testing equipment…
Y2K is here again?
Later: Internet of Things, “connected” self-driving cars and trucks…
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV2 users thanked author for this post.
-
-
One thing I don’t really understand and maybe some could try to answer here.
I didn’t read much about the technicalities of the flaws. I thought things would be more clear later and I didn’t want to spend too much time in speculations, so please excuse me if my question might seem obvious.
From what I understand, the flaw implies that one of the worst case scenarios could be your private memory is read by some website you browse to that includes a tainted javascript. Ok. Now, I understand a lot of important info can be read.
But, does it have to be in memory? Can your hard disk files be read easily?
Or would the bad software need to dump the info read into an analyzer that could extract anything of interest to reuse it? And then if it wanted to have access to your files, it would need to use the information to have access to your computer, which might be or not that difficult depending on your specific context?
Do the bad software only get access to random specific parts of admin memory or can it read everything quickly and dump it? If it is only small parts of memory, maybe trying to extract useful information will be like looking for a needle in a haystack?
Suppose the software gets your admin password. Then what can it do with it if you are just a home user behind a router with no open ports to the outside? I see how damaging this could be to an organization where an admin password would get stolen and then you attack a normal user on the network with social engineering attacks to install some trojan and then use his computer to do much more damage internally, but what would be the motivation and effort required to attack a normal home user? Suppose my password is stolen. Can an attacker do anything with it unless it creates another way through my computer that requires another vulnerability? Of course if I use remote access programs on my computer, things might be different. Being behind a router on a desktop is one situation. On the road with a laptop that didn’t disable tools to have remote access to the registry or remote desktop is a different thing.
The answer to these questions might help evaluate the real world risk of the issue.
3 users thanked author for this post.
-
-
-
You mean ok regarding just password issues?
1 user thanked author for this post.
-
-
samak said:
So are you OK if you don’t store your passwords anywhere on your PC, don’t deliberately store them in your browser and don’t use a password manager?Right now, the entire scope of possible exploits is more or less an Unknown Unknown.
Intel, ARM and AMD chip scare: What you need to know (BBC News – 04 Jan 2018)
The bugs allow hackers to potentially read information stored on a computer memory and steal information like passwords or credit card data.
Technology analyst Jake Saunders from ABI Research said it was not exactly clear what information might be at risk, but as the security gaps had been exposed “the question is whether other parties can discover and potentially exploit them”.
The BBC understands the tech industry has known about the issue for at least six months – and that everyone involved, from developers and security experts had signed non-disclosure agreements. The plan, it seems was to try to keep things under wraps until the flaws had been fully dealt with.
But ultimately, it does not boil to a single user in terms of patching diligence & personal behaviour/ IT hygiene.
For instance, all the 3rd-party service providers that you supply your important credentials (even via manual typing) surely write to & recall the info from somewhere (memory & physical disk) for authentication. In other words, they certainly aren’t storing user info in human brains & using eyeball power to perform authentication. Would all of their PCs be patched, especially for non-giant service providers ?
Also, there are “Smart Nations” where the government happily stores everyone’s entire range of info within a single national online database for all public institutions (govt departments, schools, police, courts, etc.) & commercial entities (eg. hospitals, banks, insurance agents, etc.) to access upon request. Would all of their CPUs & vulnerable software be patched ? Probably not.
-
“So are you OK if you don’t store your passwords anywhere on your PC, don’t deliberately store them in your browser and don’t use a password manager?”
My answer would be “no.” An example from https://twitter.com/hackerfantastic/status/948709444602515457: “Blackhats will be weaponizing spectre to steal session cookies from additional websites opened in the browser, especially financial sites. […]”
4 users thanked author for this post.
-
-
-
Given the lack of scenario information I have been trying to imagine “use cases” of these vulnerabilities.
This is speculation so far… What if…
You visit a malicious page. Sites serving such pages are probably not going to be common, but let’s say there are enough out there that even though you might surf cautiously and you might have ad and malware blockers, you end up at one that delivers a script that for your particular browser can read blocks of your computer’s memory.
Let’s say it can do so reasonably rapidly, so while you’re reading whatever’s on the page (or watching a long video or whatever) your browser is busy dumping memory into packets that are being uploaded to a waiting system, which is gobbling up those packets and putting the raw data into a database. Let’s assume typical internet speeds of up to a few megabytes per second could be uploaded.
A question is: What memory? It would make a difference if it were any and all memory on the system vs. just the browser’s memory. In the latter case you could develop the habit to ALWAYS close your browser after you’ve used it to log into your bank web site, for example, and that would help keep you more secure.
But let’s assume it can access any and all of the memory on your system. Gigabytes upon gigabytes. Then the question morphs into: What’s left in the memory on your system and where after you’ve done certain things. Again, it will matter not only whether it’s possible something important to your safety and security is in there (which it almost certainly is at least sometimes), but how expensive it will be to find it and exploit it.
Now, maybe there are important things in your RAM in certain, known places because of the way the OS works. That’s almost certainly true. These will be targets of those who wish to exploit you inexpensively and quickly.
And if there are databases accumulated with huge blocks of information from your RAM that may contain valuable bits, let’s not forget the bad guys have computers with which to comb through the data later. Will you be subject to an attack in the future, presuming you don’t change your passwords regularly?
We can try the hypothesis that if it’s more difficult to get your username, password, or other sensitive data (not to mention difficult to actually USE them once obtained) than it is to work at a real job, it’s less likely we’ll be targets for exploit. But there are always exceptions. Those who might think it’s “cool” to break into things. To some extent this is all a societal problem (as in, “If it weren’t a given that every vulnerability would certainly be exploited by SOME miscreant somewhere, we wouldn’t be in this mess“).
But yeah, in the end we can only imagine what could be done with THESE latest vulnerabilities.
I’ve never been under the impression that my data or systems (or me) have been or are invulnerable. I just try to work to make it as expensive as possible to get at. And that deserves a small clarification: Expensive for them, while trying to minimize my cost. That last sentence there is why I would have to think long and hard and know the risks a bit better before accepting a patch that will reduce performance markedly just to protect against the uncertainty of a worst case scenario of just visiting a web site resulting in an upload of my RAM contents.
At best, doesn’t this seem like a situation where just browsers quickly need updating, and should not demand an installation of a hastily prepared kernel change or processor microcode fix?
-Noel
5 users thanked author for this post.
-
I think there are different scenarios of threat. Targeting a specific fish, or many fish in a small barrel, or schools of fish + pods of whales + smears of jelly fish in a big ocean.
Every thing you say is true. But I also wonder about globally collecting a list of passwords that are actually in use. As opposed to all these password lists that are compiled from voluntary answers to polls of ‘what is your favorite password’. Such a list, even if anonymized by not being able to cross-reference usernames, would give better data for more dangerous algorithms in the future. Cloud-level, crowd-sourced algorithms.
I dislike myself for using ‘Cloud’ in a sentence.
1 user thanked author for this post.
-
At best, doesn’t this seem like a situation where just browsers quickly need updating, and should not demand an installation of a hastily prepared kernel change or processor microcode fix?
Don’t we think they’ve been working on this for about six months? The CVEs were issued a year ago. Is that really hasty?
1 user thanked author for this post.
-
CPU security bugs caused by speculative execution lists some attack scenarios.
2 users thanked author for this post.
-
-
-
-
Ubuntu Updates for the Meltdown / Spectre Vulnerabilities
By Dustin Kirkland | 4 January 2018
For up-to-date patch, package, and USN links, please refer to: https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown
Unfortunately, you’ve probably already read about one of the most widespread security issues in modern computing history — colloquially known as “Meltdown” (CVE-2017-5754) and “Spectre” (CVE-2017-5753 and CVE-2017-5715) — affecting practically every computer built in the last 10 years, running any operating system. That includes Ubuntu.I say “unfortunately”, in part because there was a coordinated release date of January 9, 2018, agreed upon by essentially every operating system, hardware, and cloud vendor in the world. By design, operating system updates would be available at the same time as the public disclosure of the security vulnerability. While it happens rarely, this an industry standard best practice, which has broken down in this case.
At its heart, this vulnerability is a CPU hardware architecture design issue. But there are billions of affected hardware devices, and replacing CPUs is simply unreasonable. As a result, operating system kernels — Windows, MacOS, Linux, and many others — are being patched to mitigate the critical security vulnerability.
Read the full article here -
My current understanding of the registry key for third party antivirus software is to prevent an incompatibility with the Windows kernel patch for Meltdown. As I understand it, the dual page fault testing that the patch imposes to prevent privileged memory reads was found to cause potential BSODs during testing because several third party antivirus programs make unsupported calls on kernel memory which can cause a BSOD with failure to reboot. I believe the January patch will not be offered through WU if the appropriate registry key is not set indicating that the antivirus software is compatible. MS says it may drop the requirement at such time as it believes that basically all antivirus programs have been made compatible. I do not know if you can manually download and install the patch but I would assume you would not want to do so until you were sure your antivirus software will not cause an unbootable BSOD.
The situation is quite fluid and some of what I am writing may need to be tweaked a bit as additional information becomes available. I am running AVG 2017 and they say that they are updating the registry key to indicate compatibility as of Jan/3/18.
-
Yes, we have found that to be correct.
An additional fact: Lack of the Registry key does not prevent the manual installation of the patches. So manual installation is risky if the AV is not compatible.See https://www.askwoody.com/forums/topic/best-explainer-yet-for-meltdown-and-spectre/#post-156588
-
My current understanding of the registry key for third party antivirus software is to prevent an incompatibility with the Windows kernel patch for Meltdown.
Yes, but what happens if, for example, Bitdefender were to set the “all clear for update” registry key, but Malwarebytes Anti-Exploit was still incompatible? It would only work as intended if there’s only one anti-malware or other program on the PC that won’t work if the wrong memory paradigm is in effect. In this case, MBAE is meant to be used with a regular antimalware program; it is not itself designed for that purpose.
It’s also not inconceivable that other security software (HIPS, software firewalls, etc.) could also depend on the code being a specific way in order to function properly. Having a single program setting an “all clear” registry key would not suffice.
As for the other stuff, I was pondering the possibility of using the aforementioned registry key to act sort of as a manual control for the patch. From what has been written here, though, it does not seem that it would be as useful as I had hoped.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)1 user thanked author for this post.
-
I was pondering the possibility of using the aforementioned registry key to act sort of as a manual control for the patch. From what has been written here, though, it does not seem that it would be as useful as I had hoped.
That thought had crossed my mind as well.
A few days ago I found the key set by MSE on my Win 7 system, so I renamed it to have the word “Disabled” in the name as an experiment. Sure enough, at some time since then it’s been regenerated. So either you have to disable your antivirus software, create a tool that competes with it, or just be selective about update installation and just not try to use this registry value to control anything.
And on a scary note, given that it’s being used to push a “bitter pill for your own good” patch on us, do we have to up our worry level that our own antivirus software is working more and more against us?
-Noel
1 user thanked author for this post.
-
This has been a working suspicion of mine for quite a while now. I posted this: https://www.askwoody.com/forums/topic/microsoft-response-to-spectre/#post-157196 before reading you here.
Is there a log to view timestamps for registry changes? I have not seen an option to add that column of information directly in the regedit viewer.
1 user thanked author for this post.
-
-
-
-
Why Raspberry Pi isn’t vulnerable to Spectre or Meltdown
…Both vulnerabilities exploit performance features (caching and speculative execution) common to many modern processors to leak data via a so-called side-channel attack. Happily, the Raspberry Pi isn’t susceptible to these vulnerabilities, because of the particular ARM cores that we use.
Read the full article here -
From zdnet.com:
How the Meltdown and Spectre security holes fixes will affect you
Get ready to patch every piece of computing gear in your home and company to deal with this CPU nightmare.By Steven J. Vaughan-Nichols | January 5, 2018
4 users thanked author for this post.
-
Sort of think Moore’s Law pushed every chip maker into other areas to gain speed. Wouldn’t doubt Apple’s own ARM chips use a design heavily focused on this type of execution. Probably why Intel has managed to maintain a edge against AMD. Now thinking back to when Apple dumped Power PC chips from IBM they knew Intel had proven a better memory management design. Who knew that over a decade later we would find a flaw in that?
1 user thanked author for this post.
-
Good point. Kind of says that in the competition for ever bigger numbers with which to sell chips the designers just chose to ignore some really fundamental issues, doesn’t it?
-Noel
1 user thanked author for this post.
-
-
(Business Insider – 04 Jan 2018):
The Computer Emergency Response Team Coordination Center (CERT/CC) issued a security update that said the only way to protect against Spectre in particular would be to replace affected processors.
But on Thursday, the group deleted that recommendation. Its newly updated security bulletin simply says that “operating system and some application updates mitigate these attacks,” and provides a list of vendors that have updated their software to help guard against Meltdown and Spectre.
Below is what CERT deleted from their advisory. Was anyone unduly pressured ?
Solution: Replace CPU hardware
The underlying vulnerability is primarily caused by CPU architecture design choices. Fully removing the vulnerability requires replacing vulnerable CPU hardware.Screenshot (by nicoleperlroth) of the aforementioned deleted solution:
https://pbs.twimg.com/media/DSra1W3VMAAwp5x.jpg2 users thanked author for this post.
-
From Spectre & Meltdown: tapping into the CPU’s subconscious thoughts:
“In this post I will attempt to fully explain the Spectre and Meltdown vulnerabilities in an accessible way. I decided to write it up after I realised it took me more than a day to figure it out, even though I’ve been doing security related stuff on CPUs for 20 years.
You will find many explanations of Meltdown elsewhere. This document is as far as I know the only one so far that makes the hardest part of Spectre accessible.”
3 users thanked author for this post.
-
Excellent article.
I’m convinced that there are no more than 100 people in the world who could put together a real Meltdown or Spectre attack. Not just demo code, but a genuine attack. And it’s most likely that the attacks reaching the general public will be Spectre attackes running JavaScript on browsers – not something esoteric in firmware or in the operating system itself.
Time will tell, I guess.
1 user thanked author for this post.
-
-
I haven’t spent much time yet either trying to understand the technical details, but from reading the “Spectre & Meltdown: tapping into the CPU’s subconscious thoughts” link above it seems that the forbidden memory isn’t actually being read from the cache. Instead, the “bad” code invokes speculative execution of a “if forbidden memory location = a given value, then read allowed memory location” instruction. Later, the “bad” code times reads of the contents of the allowed memory location that it may or may not have read speculatively in the previous “if” instruction. If the read of the allowed memory location is really fast (due to being present in the memory cache), then the “bad” code makes the inference that the “if” instruction was true, and hence knows the value of the forbidden memory location. I hope I didn’t bungle my explanation too badly.
1 user thanked author for this post.
-
Ok, reading your response three times, I now understand!
So you can easily check for any value possible in a forbidden location that way. That seems like it could be terrible, as you could dump whole segments of memory that way providing you can execute as many instructions as required to check for a certain value at a specific address while the protected content is not changed. This is very bad.
And if it is possible the create timers many other ways despite the quick fix browsers provided, this could be terrible and maybe not fixable, unless they could disable speculative execution entirely by a firmware update and thus slow down computers even more?
But returning quickly to the Spectre paper, I wasn’t able to see if what you just described also applied to the javascript code as well as normal machine code. I didn’t see any direct addressing to forbidden memory location in the javascript code and I am not familiar with assembly (I am a bit old, but too young to have studied it in school) to understand if there was an underlying consequence I don’t understand.
If that particular addressable aspect doesn’t apply to javascript, it would mitigate the risk of easily grabbing non random parts of memory by confining it to malware executing locally as this particular aspect would not apply to browsers and javascript? I am just trying to understand how in the javascript example, the memory grabbed is not from a random location. Maybe it is clear to you.
Again, I am very humble here and try to just understand. It’s been years I haven’t coded anything so please excuse me if it seems obvious from the code.
1 user thanked author for this post.
-
Which forbidden memory could possibly be accessed depends on which of the three vulnerabilities is involved. See More details about mitigations for the CPU Speculative Execution issue.
1 user thanked author for this post.
-
I would guess that the JavaScript proof-of-concept in the Spectre paper exploits Spectre vulnerability CVE-2017-5753 (“bounds check bypass”). See attack scenarios at CPU security bugs caused by speculative execution.
1 user thanked author for this post.
-
“But returning quickly to the Spectre paper, I wasn’t able to see if what you just described also applied to the javascript code as well as normal machine code.”
JavaScript code that exploits Spectre vulnerability CVE-2017-5753 (“bounds check bypass”) could try to access an array element beyond the upper bound of the array.
1 user thanked author for this post.
-
Ok, thanks. I see it in the example. I don’t see that the code knows where the address of the array is and although I don’t know javascript I would have thought it is not a language that should give that kind of information to you, but I guess it doesn’t matter, as you can iterate up or down and get whatever you want from physical memory even if you didn’t know exactly from where you start because array bound checks don’t matter at the level the vulnrability is. This is terrible and a genius idea.
What this all teach me is that we sometimes have very strong assertions about computer security than can be suddenly be shattered by something completely unexpected, as when I understood for the first time that a buffer overflow could in fact turn files or data in general into a virus and that all my level of comfort with security would go down a good notch. Previously, it seemed easy to not click on executable code you don’t trust. The game had changed. There is also this WPA2 vulnerability that changed some assumptions I had. And the next one might be the quantum computers breaking current encryption and for which we don’t seem to have an alternative.
We haven’t been lucky in the last two years with the SMB vulnerability too. It seems the situation in security is not improving, as creativity seems to work in the favor of bad guys and with agencies like the NSA loosing their vulnerability toolkits to hackers.
Maybe this Spectre vulnerability is only the first of a new field of discovery where it is much harder to patch design flaws because there is a physical aspect to it. That doesn’t look good for the future.
I am very impressed to see again how my expectations are shattered. Having some javascript code that would in theory be quite limited in capabilities even in the user space, that should have array bound checks, be able to use clever techniques to read memory from another VM, in fact any physical memory on the hardware, bypassing all levels of protection up to the hardware, is quite amazing and disturbing.
1 user thanked author for this post.
-
-
-
-
Viewing 13 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Microsoft: Over 394,000 Windows PCs infected by Lumma malware, affects Chrome..
by 15 minutes ago
-
Signal vs Microsoft’s Recall ; By Default, Signal Doesn’t Recall
by 27 minutes ago
-
Internet Archive : This is where all of The Internet is stored
by 39 minutes ago
-
iPhone 7 Plus and the iPhone 8 on Vantage list
by 44 minutes ago
-
Lumma malware takedown
by 7 hours, 58 minutes ago
-
“kill switches” found in Chinese made power inverters
by 9 hours, 32 minutes ago
-
Windows 11 – InControl vs pausing Windows updates
by 9 hours, 26 minutes ago
-
Meet Gemini in Chrome
by 13 hours, 31 minutes ago
-
DuckDuckGo’s Duck.ai added GPT-4o mini
by 13 hours, 40 minutes ago
-
Trump signs Take It Down Act
by 21 hours, 39 minutes ago
-
Do you have a maintenance window?
by 8 hours, 48 minutes ago
-
Freshly discovered bug in OpenPGP.js undermines whole point of encrypted comms
by 22 minutes ago
-
Cox Communications and Charter Communications to merge
by 1 day ago
-
Help with WD usb driver on Windows 11
by 1 day, 6 hours ago
-
hibernate activation
by 1 day, 9 hours ago
-
Red Hat Enterprise Linux 10 with AI assistant
by 1 day, 13 hours ago
-
Windows 11 Insider Preview build 26200.5603 released to DEV
by 1 day, 16 hours ago
-
Windows 11 Insider Preview build 26120.4151 (24H2) released to BETA
by 1 day, 16 hours ago
-
Fixing Windows 24H2 failed KB5058411 install
by 12 hours, 52 minutes ago
-
Out of band for Windows 10
by 1 day, 21 hours ago
-
Giving UniGetUi a test run.
by 2 days, 4 hours ago
-
Windows 11 Insider Preview Build 26100.4188 (24H2) released to Release Preview
by 2 days, 12 hours ago
-
Microsoft is now putting quantum encryption in Windows builds
by 7 hours, 52 minutes ago
-
Auto Time Zone Adjustment
by 2 days, 16 hours ago
-
To download Win 11 Pro 23H2 ISO.
by 2 days, 14 hours ago
-
Manage your browsing experience with Edge
by 13 hours, 43 minutes ago
-
Fewer vulnerabilities, larger updates
by 1 day, 7 hours ago
-
Hobbies — There’s free software for that!
by 7 hours, 21 minutes ago
-
Apps included with macOS
by 1 day, 11 hours ago
-
Xfinity home internet
by 1 day, 8 hours ago
Remembering Woody
