{"id":234,"date":"2019-03-20T13:40:51","date_gmt":"2019-03-20T11:40:51","guid":{"rendered":"https:\/\/www.mozdomains.com\/blog\/en\/?p=234"},"modified":"2020-05-31T01:38:11","modified_gmt":"2020-05-30T23:38:11","slug":"tips-to-protect-your-devices-from-spectre-meltdown","status":"publish","type":"post","link":"https:\/\/www.mozdomains.co.mz\/blog\/en\/website-security\/tips-to-protect-your-devices-from-spectre-meltdown\/","title":{"rendered":"Tips To Protect Your Devices From Spectre Meltdown"},"content":{"rendered":"

The Meltdown and Spectre processor vulnerabilities have affected nearly every modern processor from Intel, AMD, and ARM. Discovered by the\u00a0Google Project Zero team<\/strong>, the vulnerabilities allow Reading privileged memory with a side-channel. It means it can read personal data, passwords and other critical data from arbitrary kernel-memory locations. The hardware bugs would allow a malicious program to read the memory of other running programs \u2013 even in browsers, and password managers. The bugs can affect the device security of desktops, laptops, smartphones and cloud servers.<\/p>\n

The Meltdown Security Flaw<\/strong><\/p>\n

Meltdown exploits “side effects of out-of-order execution” on modern processors. It reads arbitrary kernel-memory locations such as personal data and passwords. However, the out-of-order execution is an essential feature needed in modern processors. The attack is OS independent, and also does not depend on any software vulnerabilities. Even without any permissions or privileges,\u00a0Meltdown<\/strong>\u00a0allows an attacker to read the memory of other processes or virtual machines in the cloud. Hence, this flaw virtually affects device security of every computer user.<\/p>\n

The Spectre Security Flaw<\/strong><\/p>\n

Exploiting this flaw, attackers can induce a victim to perform operations that would not occur during correct program execution. This would then leak confidential information of the victim.<\/p>\n

Flaw Discovery<\/strong><\/p>\n

The Project Zero team reports: “We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts.
\nVariants of this issue are known to affect many modern processors, including certain processors by Intel, AMD and ARM. For a few Intel and AMD CPU models, we have exploits that work against real software<\/strong>.”<\/p>\n

Intel Issues Updates<\/strong><\/p>\n

On 1st June 2017, the Google Project Zero team had alerted this vulnerability issue to Intel, AMD and ARM. Since then, Intel and its partners have issued and deployed updates in the form of firmware updates and software patches to ensure device security. Intel reports that it has issued updates to over 90% of its processor products that it had released over the past 5 years.<\/p>\n

OS Vendors, Device Manufacturers Release Updates<\/strong><\/p>\n

Additionally, operating system vendors such as Microsoft and Apple, device manufacturers, public cloud service providers, and others have released device security updates for their products and services.<\/p>\n

Microsoft<\/strong><\/p>\n

Microsoft has rolled out security patches, however, the updates were not compatible with some antivirus solutions \u2013 it even led to the Blue Screen of Death (BSOD<\/strong>). Microsoft has requested\u00a0antivirus\u00a0vendors to update their software to make it compatible with the security updates.<\/p>\n

Apple<\/strong><\/p>\n

Apple has revealed that all iOS and Mac systems are vulnerable to Meltdown and Spectre, and it has released iOS 11.2, macOS 10.13.2, and tvOS 11.2 that provide protection against these vulnerabilities.<\/p>\n

How to protect from Meltdown And Spectre<\/strong><\/p>\n

1.Updates<\/strong><\/p>\n

Computer users worldwide must immediately update their operating systems and other computer (device) software. Even if automatic updates has been set up, immediately perform a manual update, and ensure that your systems are up-to-date. Do check if any other updates are available.<\/p>\n