Two severe vulnerabilities found in Intel’s hardware

Two severe vulnerabilities have been discovered in Intel chips, either of which could enable attackers to seize sensitive information from apps by accessing the core memory. The first vulnerability, Meltdown, can effectively remove the barrier between user applications and sensitive parts of the operating system. The second vulnerability, Spectre, also found in AMD and ARM chips, can trick vulnerable applications into leaking their memory contents.

Applications installed on a device generally run in “user mode,” away from the more sensitive parts of the operating system. If an app needs access to a sensitive area, for example the underlying disk, network, or processing unit, it needs to ask permission to use “protected mode.” In Meltdown’s case, an attacker could access protected mode and the core memory without requiring permission, effectively removing that barrier — and enabling them to potentially steal data from the memory of running apps, such as data from password managers, browsers, e-mails, and photos and documents.

In practical terms, that means arbitrary memory can be read using Meltdown. This can include passwords, encryption keys, logins, credit card information, and much more. With Spectre, on the other hand, the memory of a (vulnerable) application can be read. So for example, if you visit a website, JavaScript code on the website can read the logins and passwords that are stored in your browser’s memory.

Using #Meltdown to steal passwords in real time #intelbug #kaiser #kpti /cc @mlqxyz @lavados @StefanMangard @yuvalyarom https://t.co/gX4CxfL1Ax pic.twitter.com/JbEvQSQraP

— Michael Schwarz (@misc0110) January 4, 2018

Meltdown and Spectre are hardware bugs, so patching can be quite tricky. Patches against Meltdown have been issued for Linux, Windows, and MacOS, but work is still on the way to harden applications against Spectre. You can find more information here.

In the meantime it is important, as always, to install the latest security updates as soon as they’re available, because it won’t take long for malefactors to start exploiting these vulnerabilities — the sample code has already been published.

Kaspersky Lab’s products compatibility with Microsoft Windows Security update

As operating system vendors rushed to patch Meltdown, they published security updates on January 3 that turned out to be incompatible with a lot of security solutions, causing either some features of those solutions not to work properly or OS freezes and reboots.

Good news: Both business and consumer solutions from Kaspersky Lab are fully compatible with this update. Microsoft delivers the update only if the system is flagged as ready, and from our side, the readiness flag has been included in the updates that were delivered on December 28, 2017. If your antivirus databases are up to date, then your computer is ready to receive the Windows update that fixes Meltdown. If you haven’t received it yet, you soon will, and we strongly recommend you install it as soon as possible.