Google's Project Zero says it discovered three variants of CPU attack, affecting AMD, ARM, and Intel; Android devices with latest security update are safe

Last year, Google's Project Zero team discovered serious security flaws caused by “speculative execution,” a technique used by most modern processors …

Google Online Security Blog 2018-01-04

Discussion

@stevesi @stevesi on x
Google Online Security Blog:Today's CPU vulnerability: what you need to know https://security.googleblog.com/ ... via @google STEP 1: “To take advantage of this vulnerability, an attacker first must be able to run malicious code on the targeted system.”
@fioraaeterna Atelier Fiora on x
okay i actually f**king LOVE this bug so much omg. this is even better than i thought it was. sorry, i apologize, i'm gonna fangirl a little bit here sorry https://twitter.com/...
@bryanbma Bryan Ma on x
Busy morning talking abt Meltdown/Spectre. My quick take: Meltdown should be contained quickly via patches. Agree w/INTC that most users won't likely feel perf hit. But bigger Q is Spectre's long term impact to chip design
@stevesi @stevesi on x
Yes. Re-reading this would be good for many people right now. The reason this is not the same level of issue across platforms is because of how much more difficult it is to get malicious code onto machines. https://twitter.com/...
@bittrexexchange Bittrex on x
Azure accelerated a planned reboot due to the public Intel disclosure. Wallets will be online again once they complete post reboot audits. http://azure.microsoft.com/...
@lizthegrey Liz Fong-Jones on x
Just to correct: ChromeOS 63 is protected. Chrome desktop 64 *will be* protected but chrome desktop 63 requires: “Full Site Isolation can be turned on by enabling a flag found at chrome://flags/#enable-site-per- process.” http://support.google.com/...
@gossithedog Kevin Beaumont on x
Azure statement, they're rebooting customer VMs to patch hypervisor layer, expect little performance impact. http://azure.microsoft.com/...
@mjg59 Matthew Garrett on x
This (from http://developer.arm.com/...) reads uh pretty badly tbh. If exploitation via Javascript is viable then you can't put the onus on users to avoid malicious Javascript. http://twitter.com/...
@andrewwrites Andrew Cunningham on x
Keep your phones and computers updated to avoid the worst of these processor-related security flaws, but at least one of them apparently CAN'T be fixed with software: http://googleprojectzero.blogspot.com/ ... http://twitter.com/...
@rlove Robert Love on x
[THREAD] The details of the CPU vulnerability are now public. Through flaws in speculative execution, which is a CPU optimization, malicious code may read from (but not write to) memory of which they should not have access. 1/5 http://security.googleblog.com/ ...
@grittygrease Nick Sullivan on x
The first computer security must-read of 2018: http://googleprojectzero.blogspot.co.uk / ...
@k8em0 Katie Moussouris on x
Especially appropriate guidance from the researchers, who coordinated w the vendors on these bugs. “we believe that the processor vendors are in a much better position than we are to design & evaluate mitigations, and we expect them to be the source of authoritative guidance” htt…
@laparisa Parisa Tabriz on x
Incredible research by @tehjh of Google Project Zero forthcoming soon: http://security.googleblog.com/ ...
@selenalarson Selena Larson on x
Google on the CPU flaws, said they reported to chipmakers in June https://googleprojectzero.blogspot.co.u k/ ...
@campuscodi Catalin Cimpanu on x
Android Security Bulletin for January 2018 is out http://source.android.com/... http://twitter.com/...
@tomwarren Tom Warren on x
Google confirms its Project Zero team disclosed processor vulnerabilities. Says CPUs from AMD, ARM, and Intel are affected https://security.googleblog.com/ ...
@attritionorg Sciuridae Hero on x
CERT brings the harsh truth. #Meltdown #Spectre pic.twitter.com/UFPiYA39hd
@nicoleperlroth Nicole Perlroth on x
1. Apparently I don't know how to thread, so here goes my second attempt at blasting you with critical news on this “Intel Chip problem” which is not an Intel problem but an entire chipmaker design problem that affects virtually all processors on the market.
@albertwenger Albert Wenger on x
Meltdown and Spectre Vulnerabilities are Good ... for Innovation http://continuations.com/... http://twitter.com/...
@agl__ Adam Langley on x
Architecture researchers: having caches be implicit was a decision; it doesn't have to be that way. Perhaps high-speed memories can be exposed in the address space with fixed timings at each level of the hierarchy. (1/4)
@dnvolz Dustin Volz on x
US-CERT says it is not aware of any active exploitation of Meltdown or Spectre https://twitter.com/...
@migueldeicaza Miguel de Icaza on x
Amazing: Mozilla confirms that the leak attack can be exploited from JavaScript. Update your browsers too. https://blog.mozilla.org/...
@malwarejake Jake Williams on x
Meltdown and Spectre will be a case study in how to totally screw up a vulnerability embargo. I wonder if this will discourage researchers from responsibly disclosing critical vulnerabilities in the future. http://meltdownattack.com/
@micahflee Micah Lee on x
The CPU vulnerability embargo was supposed to be Jan 9, but due to leaked details and public speculation, Google published about it today. And now it has branded bug website: http://meltdownattack.com/
@stephennellis Stephen Nellis on x
The one that works against Intel only is Meltdown, and the AMD/ARM/Intel one is Spectre. Read more here: https://meltdownattack.com/ and https://spectreattack.com/
@briankrebs @briankrebs on x
Leaving aside the brilliance of the people that found this Intel bug, may I submit that perhaps coining threat names and invoking cute icons is a gratuitous and disingenuous way to get people to care about an impossibly arcane flaw that they in all likelihood can't do much about?
@ow @ow on x
Oh God it has a logo http://meltdownattack.com/ http://twitter.com/...
@micahflee Micah Lee on x
It's a nitpick, but the Meltdown patch doesn't affect download speeds it all. It changes how fast your CPU can execute instructions and do math. Online services like streaming will only be affected if the web app is JavaScript heavy http://nytimes.com/... http://twitter.com/...
@tomwarren Tom Warren on x
Microsoft says most of its Azure customers “should not see a noticeable performance impact” due to the patches https://azure.microsoft.com/ ...
@_jonasschnelli_ Jonas Schnelli on x
The current privileged memory side channel attacks just confirms what many Bitcoin users already “know” (feel): * Don't trust your PC. * Don't think applications (and private keys) are shielded * Use a hardware wallet Background: http://blog.mozilla.org/... http://googleprojectze…
@aras_p @aras_p on x
Just about when WebGL was to get multi-threading capabilities, boom, Spectre and Meltdown happen (http://googleprojectzero.blogspot.lt/ ...), and both Firefox and Chrome disable SharedArrayBuffers (http://blog.mozilla.org/... and http://www.chromium.org/...). Sad :(((
@jschauma Jan Schaumann on x
The way #spectre / #meltdown trickle down to browser security is seriously scary. http://blog.mozilla.org/... “... experiments confirm that it is possible to use similar techniques from Web content to read private information between different origins.”
Phoronix Michael Larabel on x
Linux Gaming Performance Doesn't Appear Affected By The x86 PTI Work
@k8em0 Katie Moussouris on x
Today, infosec Twitter (re)learned the following are hard: 1. Fixing design bugs in chips 2. Multiparty Coordinated Vuln Disclosure 3. Differentiating authoritative fact vs speculative hype 4. Holding embargoes 5. Naming things so they don't sound goofy #Meltdown #Spectre pic.twi…
@internetofs**t Internet of S**t on x
Apple: we're slowing down processors cause your battery might be bad Intel: pic.twitter.com/qBR1MpcNXz
@nicoleperlroth Nicole Perlroth on x
2. Christmas didn't come for the computer security industry this year. A critical design flaw in virtually all microprocessors allows attackers to dump the entire memory contents off of a machine/mobile device/PC/cloud server etc.
@swiftonsecurity @swiftonsecurity on x
The CPU issues today are immensely interesting and consequential, but I hesitate hyping this to the public. Same as always: Make sure autoupdates are on and working. People have been working on addressing this for six months. It's not a surprise to the people defending you.
@nicoleperlroth Nicole Perlroth on x
6) Now, Meltdown and Spectre, show that it is possible for attackers to exploit these design flaws to access the entire memory contents of a machine. The most visceral attack scenario is an attacker who rents 5 minutes of time from an Amazon/Google/Microsoft cloud server and
@nicoleperlroth Nicole Perlroth on x
17. Google says its systems have been updated to defend against Meltdown https://security.googleblog.com/ ... . Microsoft issued an emergency update today. Amazon said it protected AWS customers running Amazon's tailored Linux version, and would roll out the MSFT patch for other …
@gossithedog Kevin Beaumont on x
If you're a business relying on virtualisation security for boundaries, eg you're a cloud provider, drop everything and patch. If you're a regular business, follow your regular patching process when patches are available. If you're a consumer, let OS apply usual patches.
@nicoleperlroth Nicole Perlroth on x
15. The flaws were originally discovered last June by a researcher at Google Project Zero (shout out @ Jann Horn) and then separately by Paul Kocher and a crew of highly impressive researchers at Rambus and academic institutions. Originally public disclosure was set for next week
@zackwhittaker Zack Whittaker on x
This is a crazy bad bug, affecting two-decades worth of Intel chips and some ARM chips, that can let an attacker steal data from the memory of running apps, such as data from password managers, browsers, emails, and photos and documents. http://zd.net/2lSEtKF pic.twitter.com/5YEU…
@erratarob @erratarob on x
So the #meldown steps are: 1. Load a byte of memory from kernel. This crashes. 2. Use that byte to load one of 256 cache-lines. This happens before the crash is registered, so while the data is discarded, the data is still cached. 3. Measure which of the 256 cache-lines are fast
@aallan Alasdair Allan on x
So that's proof of concept for the #IntelBug. That's potentially game over for every Intel processor manufactured in the last 10 years, slowdowns could be between 5 and 30% after patching, http://www.theverge.com/.... http://twitter.com/...
@tomwarren Tom Warren on x
It constantly feels like we're edging closer to a tech doomsday scenario. The Wi-Fi attack vulnerability was less than 3 months ago, and now we have two major flaws in processors. What's next?
@kimzetter Kim Zetter on x
For those looking for basic info about whether they're affected by the Intel bug, scroll to bottom of this page put together by the researchers who discovered it - https://meltdownattack.com/ pic.twitter.com/JTRykdSbjv
@mattblaze Matt Blaze on x
Meltdown and Spectre are serious problems. I look forward to seeing the innovative ways in which their impact will be both wildly exaggerated and foolishly dismissed over the coming weeks.
@pwnallthethings @pwnallthethings on x
The Intel bug is a really cool bug that took a lot of work to find, exploit and fix, but most folks don't need to do anything other than install OS updates when they arrive.
@nicoleperlroth Nicole Perlroth on x
4. We're dealing with two serious threats. The first is isolated to #IntelChips, has been dubbed Meltdown, and affects virtually all Intel microprocessors. The patch, called KAISER, will slow performance speeds of processors by as much as 30 percent.
@martinsfp Martin Bryant on x
Well this is a hot mess. http://twitter.com/...
@tomwarren Tom Warren on x
Google was planning to disclose next week with the rest of the industry, but “existing public reports and growing speculation in the press and security research community about the issue” pushed them to publish today.
@internetofs**t Internet of S**t on x
Every Intel processor since 1995 has a critical security flaw. Good news: - it's kinda sorta patched Bad news: - the patch slows down your machine - you can't avoid the patch http://www.zdnet.com/...
@ow @ow on x
Oof. Critical Intel bug affects processors all the way back to 1995. Patches out today. http://www.zdnet.com/...
@alexeheath Alex Heath on x
- Intel was made aware of materially impactful chip vulnerability in June 2016 - CEO unloads $24m in stock in November to meet only bare minimum of shares he's required to hold - Intel won't confirm whether CEO knew of vulnerability when he sold How is this not insider trading?
@swiftonsecurity @swiftonsecurity on x
Azure got the Windows CPU fix first, they're not seeing issues: “We've worked to optimize the CPU and disk I/O path and are not seeing noticeable performance impact after the fix has been applied.” https://azure.microsoft.com/ ...
@tomwarren Tom Warren on x
If you have an Intel Skylake or newer processor you shouldn't experience slow downs due to the firmware and software updates. If you have an older CPU... cross your fingers. http://www.theverge.com/...
@briankrebs @briankrebs on x
Right, so this is the upshot of the Intel flaw, as it relates to cloud services that the entire internets relies upon: “We apologize for the disruption. This is only a test. If this had been an actual emergency, you'd be totally fscked.”
@pressed250 Bruce Kleinman on x
And the “disruptions” are being scheduled RSN: - Microsoft's Azure cloud will undergo maintenance and reboots on January 10, presumably to roll out the above fixes - Amazon Web Services also warned customers via email to expect a major security update to land on Friday this week
@selenalarson Selena Larson on x
So is Intel saying all chips that perform speculative execution are affected? That would be .... a lot http://twitter.com/...
@atbwebb Alex Webb on x
The silence from Apple on this Intel issue is deafening. Not responding to calls or messages seeking comment.
@sharatibken Shara Tibken on x
Here's what @Arm says about the chip exploit also impacting @Intel. The flaw could be used in mobile chips based on ARM, but typically not IOT devices using different chip tech. Vast majority of world's phones use ARM-based chips. Including @Apple, @Samsung pic.twitter.com/946p79…
@nicoleperlroth Nicole Perlroth on x
11. Chipmakers like Intel will have to do a full recall— unclear if there's even manufacturing capacity for this— OR customers will have to wait for secure processors to reach the market, and do their own risk analysis as to whether they need to swap out all affected hardware.
@cloud_opinion Cloud Opinion on x
Do any self driving cars use Intel chips?
@timgostony Tim Gostony on x
Impact of the patch for the Intel bug on my AWS EC2 instances running Linux, a t1.micro and m3.medium. #KPTI pic.twitter.com/n3uZsZ38iV
@internetofs**t Internet of S**t on x
bugs, ranked Heartbleed: whoops, the internet is burning Shellshock: oh no, bash is broken sorry Meltdown/spectre: we had a nuclear reactor accident twenty years ago and just found it uhhhh yeah good luck
@eastdakota Matthew Prince on x
And if it turns out AMD isn't vulnerable to this bug (and the tech folks around here think think they're likely not) then this press release (on which $AMD fell and $INTC recovered) will come to haunt Intel. #ugly http://newsroom.intel.com/...
@nicoleperlroth Nicole Perlroth on x
4) Spectre is harder to exploit, but has no easy fix, and is far more pervasive. Researchers say it is highly likely the threat from Spectre will be with us for the decade to come.
@dguido Dan Guido on x
If you have an Intel CPU with the “PCID” feature, then the security fix for Spectre/Meltdown will have less performance overhead. On macOS, check if you have PCID by opening a terminal and running: ‘sysctl machdep.cpu.features | grep -o PCID’ pic.twitter.com/C6aFBbaU8D
@internetofs**t Internet of S**t on x
Here's a thread of AWS customers saying their CPU went to s**t when Amazon quietly patched this out this week https://forums.aws.amazon.com/ ...
@dinabass Dina Bass on x
Intel says it sees no material impact to its business
@nicoleperlroth Nicole Perlroth on x
3) Meltdown presents an urgent crisis and administrators need to implement the KAISER patch ASAP (even though it will slow performance speeds by as much as 30%), but the Spectre flaw is far more pervasive and will require a complete rearchitecture of virtually all microprocessors
@nicoleperlroth Nicole Perlroth on x
1) The #IntelChip is only one piece of a much bigger security problem. There are two critical security flaws in microprocessors. The first, called Meltdown, affects virtually all Intel microprocessors.
@nicoleperlroth Nicole Perlroth on x
2) The second, dubbed Spectre, is a design flaw that affects virtually all modern microprocessors (not just Intel, but AMD and ARM) and has NO PATCH.
@gossithedog Kevin Beaumont on x
Reason I haven't commented on Intel CPU issue - detail is behind a non-disclosure, few people have signed it (incl me), there's little detail in public, erik's PoC people are highlighting is just a screenshot. Ultimately: it's patchable.
@suka_hiroaki Andreas Proschofsky on x
Wow. What a highly unprofessional response. Angrily written counter-arguments to arguments nobody made. Also: PR spin galore. And oh: The media is totally evil. Suprised to see put out something like that by such a big company. http://twitter.com/...
@never_released Longhorn on x
https://newsroom.intel.com/... “Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect.” is wrong, it's at worst a KASLR bypass on other manufacturers, not a kernel memory read like Intel here.
@donal888 Don Clark on x
Intel disputes the notion that there is a bug in its chips—cites research into software issues. But it is issuing fixes. http://newsroom.intel.com/...
@swiftonsecurity @swiftonsecurity on x
Props to the AMD PR department this last week.
@iblametom Thomas Fox-Brewster on x
AMD says it's not affected. From researcher re AMD being affected: “Spectre works super reliably on AMD. We wrote that in the paper and on the website.” https://www.forbes.com/...
@aionescu Alex Ionescu on x
Official AMD response shows that they _are_ susceptible to at least some of these variants, so again, Intel's response was *not* dishonest, just cleverly crafted. This is a design-level issue affecting many, many chip vendors. https://twitter.com/...
@internetofs**t Internet of S**t on x
Here's AMD claiming it's not affected and Google VERY SPECIFICALLY saying it is. Turns out we're all screwed. pic.twitter.com/0GGktFC5hw

Chronicles

Google's Project Zero says it discovered three variants of CPU attack, affecting AMD, ARM, and Intel; Android devices with latest security update are safe

Related Coverage

Discussion