A new class of side-channel attacks have been appeared, which exploit the following CPU vulnerabilities:
Meltdown and Spectre rely on them and allow the hackers to read the memory content of other programs, it means they can access the stored sensitive data like passwords, photos, emails, secret documents, etc. The original coordinated disclosure date of this issue was planned for January 9, but the issue became public 6 days earlier. Both are side effect attacks, but there’s a bit difference between them:
Memory isolation is the basis of the security on computers. It prevents that different user applications can access each other’s memories and read/write the kernel memory. That’s why multiple users can use one single machine safely.
Meltdown breaks this isolation and gives a single way to read the kernel memory (from user space), including all the secrets in it. It doesn’t exploit any software vulnerabilities, so it doesn’t matter what kind of operating system are you using.
The biggest strength of Meltdown is the side effects caused by out-of-order execution*.
Meltdown can be used on Intel processors. KAISER patch is widely applied to mitigating the Meltdown attack, but there are also other tips for patching it.
* It’s an optimization technique for maximizing the utilization of all execution units of a CPU core as exhaustive as possible.
This attack induces the processor with branch prediction for achieving speculatively executing* instructions, which shouldn’t have occurred during a correct program execution. This way, the information of the victim’s memory can be leaked. Spectre attack can work on non-Intel processors too, such as AMD and ARM processors. For the hackers, this technique is more difficult but also harder to mitigate it. Unfortunately, KAISER patch cannot protect against them.
*It’s a technique to increase the performance of the high-speed processors.
To the server owners, we raise the attention to do everything you can in order to take care of your servers’ security, as there are no patches for Ubuntu and Debian yet, only for the following distros *:
*against Meltdown SUSE also released patches for most recent SUSE Linux Enterprise (SLE) versions yesterday. Desktops, laptops, smartphones, tablets, cloud devices, servers… All of them are endangered by Meltdown and Spectre . Also, once you have been attacked, it’s hard to detect, as none of these attacks leaves traces in the traditional log files. It’s not easy to distinguish them from regular benign applications, so antivirus cannot solve the problem.
Start the 7-day free trial with full functionality without spending a cent.
After the “Hello, Peppa!” zero-day botnet, our Attack Vector Miner detected another zero-day...
At the end of the last year, we made...
