http://1.bp.blogspot.com/-XnD_9G6Yfp4/WmqNokBmqpI/AAAAAAAAOKw/rUBZ05s-mEoUFMqZt0MQsVFlTT_NTk7OACK4BGAYYCw/s1600/2018-01-26_7-37-44.png
My Microsoft Surface Book is protected against the Meltdown and Spectre security flaws, but my Sony Vaio Pro remains vulnerable to Spectre. Both laptops run Windows 10 and have been updated via Windows Update. The Surface Book’s BIOS has also been updated by Microsoft, but there is no BIOS update for the Vaio – and, I suspect, for millions of other machines.
What is the risk of continuing to run the Vaio with this known critical vulnerability? Is there another way to mitigate it? Or, in the end, do thousands of people have to dump otherwise good machines and buy new ones? John Piatt
It’s too soon to say. Bear in mind that, so far, there are no known exploits for these vulnerabilities, so the current level of risk is low. Companies will try to defend against threats as and when they appear. In the short term, we’ll just have to see how well that goes.
In the long run, millions of PCs and other devices will have to be replaced. That would be true even if the Spectre and Meltdown vulnerabilities had not been discovered. The difference is that some may have to be replaced sooner rather than later.
Intel says it has “issued firmware updates for 90 percent of Intel CPUs introduced in the past five years, but we have more work to do”. We don’t know if it will go further back than that, but the biggest threat is to old PCs that probably aren’t worth very much.
Over time, I expect the strategy will develop roughly as follows:
First, update your operating systems, browsers and other vulnerable software to defend against potential threats.
Second, if necessary, update your PC’s firmware (BIOS or UEFI etc). There is no desperate hurry. In fact, this week Intel told suppliers to “stop deployment of current versions [of fixes], as they may introduce higher than expected reboots and other unpredictable system behavior”.
Third, replace the processor, if you can. In many cases, this could also mean replacing the motherboard. Whether it’s worth it depends on the residual value of the machine.
Fourth, the solution of last resort: replace the device.
By the time we get to that stage, the software options should be clearer. You might still get away with using older versions of Windows if you’re careful when browsing using one tab per process (see below), and only downloading trusted code. If not, it may be possible to make some PCs secure enough by installing Linux (which you can run on the fly from a DVD or USB thumbdrive) or ChromeOS or CloudReady or whatever.
Otherwise, people will still be able to use insecure devices offline or on local networks. For example, you could use your Vaio Pro 13 for word processing, accounts, and playing videos, music and games, among other things. Even today, you don’t have to do everything online.
What’s the problem?
The Meltdown and Spectre vulnerabilities arise from the way most modern processors work, using speculative “out of order” execution of instructions. As such, they affect some but not all processors from Intel, AMD, ARM, IBM and others. Intel seems to be worst affected, and it has published a list of vulnerable chips online.
The vulnerabilities enable attackers to steal information from memory that is being used by other programs, or by the operating system, but not to launch malware attacks. A typical scenario could involve code from one web page collecting information, such as passwords, from another browser tab. Other attacks may be developed later.
There are actually three vulnerabilities. The first, “bounds check bypass” (CVE-2017-5753), requires a firmware update or for any vulnerable programs to be recompiled.
The second, “branch target injection” (CVE-2017-5715) AKA Spectre, can be fixed via a firmware update. However, it can be mitigated by software changes, and Google has proposed a novel mitigation called Retpoline.
The third, “rogue data cache load” (CVE-2017-5754) AKA Meltdown, can be mitigated by patching the operating system.
The Google Security Blog has a good description of the flaws. It says the second variant, Spectre, “is difficult to use, but has great potential power as it crosses arbitrary protection domains”.
You should be able to use your Sony Vaio until Spectre-based attacks appear, and by that time, there may be better software mitigations to reduce the risk.
Are you vulnerable?
If you are not sure if your PC is vulnerable, you can run software to check. You used GRC’s InSpectre, which seems to work well. Ashampoo offers an alternative Spectre Meltdown CPU Checker, which is also for Microsoft Windows.
Note that Microsoft did not patch some PCs because they were running anti-virus software that makes “unsupported calls into Windows kernel memory”, which can cause blue-screen crashes. If your PC has not been protected, try updating your anti-virus software. If that doesn’t work, turn off your third-party AV software and turn on Windows Defender until your PC is patched.
In general, older processors appear to be more vulnerable than recent ones, and they are more likely to suffer a performance hit. In my case, with a new PC running Windows 10 on an Intel Core i5-8400, fixes appeared quickly and before-and-after benchmarks show no loss of performance.
There are web pages that will tell you if popular smartphones are vulnerable or will receive updates, such as riCompro’s Smartphone Security Check. (This is not a tester.) Apple is updating Macs, iPhones, iPads and Apple TVs so make sure you install the latest patches.
Browser risks
You’re most likely to be attacked via your web browser, and browser suppliers are already updating their software. It’s now particularly important to keep your browsers up to date.
You can reduce the risk by using “site isolation” in the Chrome browser. As Google explains: “Site Isolation offers a second line of defense to make such attacks less likely to succeed. It ensures that pages from different websites are always put into different processes, each running in a sandbox that limits what the process is allowed to do.”
To enable it, type (or paste) chrome://flags/#enable-site-per-process into the address bar and click Enable. This should work in other Chromium-based browsers such as Opera and Vivaldi.
If Chrome is already eating all your PC’s resources, site isolation will make things worse. You will probably have to manage with fewer tabs.
A partial solution is to isolate only a few risky sites, but this involves starting Chrome from a command line (–isolate-origins=https://risky1.com, https://risky2.com etc).
Spectre exploits also require very precise timing, so Mozilla has temporarily reduced the precision of Firefox’s timers to make attacks harder.
Restricted access to high-precision timers is one of the mitigations that helps to protect Android smartphones, though users should check for other fixes as they appear.
Life goes on…
Initial reports of Meltdown and Spectre made them sound apocalyptic, but the bugs were secretly disclosed to suppliers in June, and patching is now well under way. Today, it looks as though careful users of reasonably recent PCs don’t have too much to worry about… pending the appearance of some devastating Spectre malware.
If all your software and firmware is patched, if you only download trusted code, and you avoid clicking malware links in emails etc, then you should be able to continue as normal.
If your PC has been orphaned by its manufacturer, or is more than five years old, keep an eye open for Spectre exploits that can’t be mitigated by other software. You should anticipate replacing these machines with fast, new PCs, but you should have been doing that anyway.
Have you got a question? Email it to Ask.Jack@theguardian.com
guardian.co.uk © Guardian News & Media Limited 2010
Published via the Guardian News Feed plugin for WordPress.
What can I do to protect my PC from the Meltdown and Spectre flaws?https://goo.gl/mbJE8Q
Posts
0 comments:
Post a Comment