Saturday, June 22, 2024

Nearly Every CPU’s Since 1995 are Vulnerable to “Meltdown” and “Spectre” Attacks

A critical vulnerability published by Google which affects almost all the processors since 1995, the vulnerability resides in “speculative execution” a technique used by modern processors for processor optimization.

The hardware bugs Meltdown and Spectre allows an attacker to steal the data that currently processed on the computer it includes the process of personal photos, Emails, Password manager, instant messages and sensitive documents.

Security researchers from Google Project Zero discovered the vulnerability and it is similar to the bug reported in Intel Processors. Programs are not allowed to read other programs, Researchers says “a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs”.

What is Meltdown and Spectre

Meltdown breaks the separation between the user accounts and the operating systems, it allows access to the memory where attacker extract secret information from other programs and operating systems.

It breaks all security assumptions given by address space isolation as well as para-virtualized environments and, thus, every security mechanism building upon this foundation.There is no software vulnerability involved in Meltdown.

Spectre breaks the isolation between the applications, it allows an attacker to trick legitimate applications into leaking their secrets.

Spectre attacks involve inducing a victim to speculatively perform operations that would not occur during correct program execution and which leak the victim’s confidential information via a side channel to the adversary.

Devices Affected

The attack works on mobile devices, personal computers and cloud infrastructure depends on the cloud providers.

Antivirus won’t detect as like malware and it may detect may detect malware which uses the attacks by comparing binaries after they become known.

Meltdown affects Desktop, Laptop, and Cloud computers, it affects every processor starting from 1995 except Intel Itanium and Intel Atom before 2013. Researchers tested the exploits only with Intel processors at this time where as ARM and AMD processors are not tested.

Spectre affects Laptops, Smartphones, Desktops and Cloud Servers, it affects all the modern processors which keeps data on the flight, they have Intel, AMD, and ARM processors.

CVE in Reference

CVE-2017-5753 and CVE-2017-5715 are the references to Spectre, CVE-2017-5754 is for Meltdown Mitigation Spectre can be mitigated if speculative execution can be halted on potentially sensitive execution paths.

serialization instructions may not be an effective countermeasure on all processors or system configurations.

Website

Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles