Meltdown and Spectre
Initially I was hesitant to post about these low level flaws in today's computing architectures. But I learned over the past days that these flaws are too big and the impact to vast to not write about them.What is happening / what flaws? So in my own words: Researchers discovered new security holes and described scary hacking scenarios. These attack scenarios focus on the fact, that everything that a PC or smart device works on is saved in memory. Memory areas are kept separate (generally by tech built into your CPU and your operating system). But there are also techniques that allow to jump between memory areas (kind-of). These incredibly smart and complex technologies can be attacked as we know now. So some complex malware running in your browser could theoretically access memory data used by your password manager. That's surely not what you want. But to put a disclaimer on this statement: You i.e. the user would have to get this malware and actually run it (under favorable conditions as described in the researchers works) - so what I've heard all the time is, that the attack scenarios are highly theoretical and that computer systems in the cloud are more likely to get attacked (as opposed to your personal laptop).With this post I wanted to make people aware that this is really a big issue. It is a low level attack scenario on the CPU / RAM level. It affects many many kinds of devices - old and new ones. It is hard to patch.I wanted to gather some 'good' sources here to help you read more details:
- Short Meltdown and Spectre Explanation with links to research papers by Daniel Miesslerhttps://danielmiessler.com/blog/simple-explanation-difference-meltdown-spectre/
- Special Website providing explanations and links to patches:https://meltdownattack.com/
- The Verge - virtual story telling explanation of Spectre and Meltdownhttps://www.theverge.com/2018/1/6/16854668/meltdown-spectre-hack-explained-bank-heist-analogy
P.S.I started reading about these attacks around 31st of December 2017. Intel may have been aware of the issue since July 2017. And in my view the media did not really know how to explain and talk about these attack scenarios. Just this week I started seeing simple logos and more adequate explanations and videos about these complex topics. I had a look at meltdownattack.com and I found great resources including the logos. Thanks for allowing free use of these logos and full image credit goes to designer: Natascha Eibl.