Processor bugs and future scenarios
The recent failures of Intel, Arm and Amd processors, which have been the subject of much discussion of late, mean that computers and smartphones produced in the last decade are at risk. Even though the microchip producers and operating system developers are trying to find solutions, the situation remains critical because it involves the hardware.
Something needs to be done quickly, in as much as someone might take advantage of this vulnerability, but Intel reassures users that they are now taking precautions to help protect processors produced in the last five years. As far as users are concerned, the recommendation is to install all available updates immediately.
Although some say that such updates will slow down the devices by as much as 30%, Intel maintains that any slow-down will depend on the workload of the chips, and will not have serious repercussions for consumers. Regarding the processor failures, according to the Kaspersky Lab, the real problems are linked to:
- Meltdown (which eliminates the screen shown between applications and sensitive data about the operating system);
- Spectre (makes apps remove content from the memory).
In order to understand this issue better, these two failures allow anyone who wants to launch an attack to enter the system memory of the devices and access confidential information, such as passwords for the browser or password manager, as well as chats, photos, files, emails etc. In other words, anyone can easily take possession of the information contained in millions of devices.
Both Meltdown and Spectre use speculative action to improve their performance. The attacks are focused on this: they exploit to their own advantage the fact that processors (which must be seen to be fast) follow superfluous instructions which they then eliminate, but only after saving them in a non-permanent way. Thanks to this procedure, those who carry out these attacks can enter the secured memory using a malicious app.
Although Intel has announced that this is not a matter of bugs or failures, but rather of exploitation involving certain operating systems and producers, nevertheless, the security problems deriving from a defect in design are present and must be resolved.
Cloud services are at the greatest risk, because they are based on a mechanism which imposes the collective sharing of a single device. Personal computers are also under threat, but in that case in order to obtain the desired results, the attacker must use code on the device, in order to download a program or make it access a malicious site.
In addition to the recommended updates to reduce the chance of running into a variety problems and dangers, the experts suggest the use of ad-blockers. Naturally, all the manufacturers are moving extremely fast to check this issue, but it will also require some effort from users.
Processor failures are causing considerable difficulties, because they make a huge number of devices vulnerable: everyone is a potential victim and (under present circumstances) nobody has the capability to fully defend themselves. Obviously, there is no shortage of comments and suggestions from the experts.
For example, this is the case of a member of the Governing Council of the AIIC, which supports a drastic overhaul of the approach used in technology production. In fact, the EU has already chosen to adopt secure programming, entrusting this to organisations such as EOS and ECSO. Having said that, there is still a long way to go and there is certainly no time to waste, but at least everyone is now aware of this issue.
Translated by Joanne Beckwith
