In a responsible disclosure posted Wednesday, security researchers from Google’s Project Zero working on the recently revealed Meltdown & Spectre attacks have issued warnings to all users from different industries who are using Intel, AMD & ARM processors. The highlighted threats reveal possible ways in which hackers may access privileged data in any device running processors from these manufacturers.
MELTDOWN & SPECWHAT?!
Modern processors, or at least those built from 1995 onward perform “speculative execution,” a process in which they anticipate a layer of instructions based on a previous memory of related commands stored in the kernel level. Processors do this to maximize performance by avoiding repetition and execute the instructions before they are verified as necessary.
Essentially, the processors are doing guesswork over what should happen to data. If they get it right the first time, there’s no problem. If the processors make a wrong guess, the results are thrown out and they go back to executing the correct set.
This process of speculative execution won’t affect program behaviors, but the research team behind Google Project Zero suggests that it can modify the processor’s state. This modification can be seen by looking into the differences in duration between certain operations. By comparing the time between these operations, one process can derive properties of data belonging to another process. This kind of info can then be used to directly extract and deploy passwords stored in a browser. What’s more, because it’s already leaked, info accessed through this process can bypass existing protections such as address space layout randomization (ASLR), enabling JavaScript exploits using buffer overflows to perform better.
The Meltdown & Spectre exploits may be initiated from remote or physical instances, compromising a computer’s memory architecture to access previously protected areas, while also decoding and reading privileged data without permission. This access to sensitive data embedded into a computer’s security provides leverage to a potential hacker, who may use the info extracted for financial gain, as is the case with recent hackings in the crypto sphere.
WHAT TO DO THEN?
What does this mean for people who use cryptocurrencies?
While alarming at first glance, these vulnerabilities can be mitigated by ensuring that best practices in crypto security are implemented (in this case, #6 is most important). Short and simple: all access to user wallets should be provided with industry-standard authentication protocols, and private keys should remain private, or even stored mnemonically, where possible (here’s a tool you may use if you’re using weak passwords/keys).
While the vulnerabilities have been identified as early as June last year, the researchers had to gather enough data to properly execute the disclosures to the major processor and chip manufacturing companies involved (here are links to the initial responses from Intel, AMD, and ARM) without raising the alarm and inordinately informing hackers looking to exploit it for malicious purposes. Apple and Microsoft, who both make use these chips for their devices, have also responded with official statements.
Prior to the leakage of discrete info on the matter, a coordinated release of security patches was scheduled by the security researchers for January 9, 2018. However, as a report by The Verge notes, the patches are estimated to impact on the processors, with a range of between 5 to 30% decrease in overall performance for affected devices. This led end users to ponder whether the updates were worth it. Recent benchmarks of devices updated with the security patches show that a category average of 17% in performance decrease may be seen across devices and platforms once patches are installed and systems are updated.
Major tech firms, as well as blockchain-based and cryptocurrency businesses like mainstream exchanges, have been scrambling for the past days to find adequate patches to curb the critical flaws which affect processors constructed with proprietary architecture. Cloud-based services and execution platforms will suffer the most, though. Because of the lucrative prospect that Amazon Web Services, Google Cloud, IBM, and Microsoft Azure represent with their suite of enterprise platforms, hackers looking to exploit Spectre, specifically, will be tempted to glance at crypto wallets provided by exchanges, as well as vulnerabilities in devices connecting to hardware wallets.
Steps to mitigate the vulnerabilities have been a primary cause of concern for the tech world in general for the past few days, especially leading to tensions in the issue of net neutrality, with the cryptocurrency industry joining the fight.
CERT, an arm of the U.S. Department of Homeland Security, issued these official descriptions of the side-channel attacks and how they work, advising users across different platforms to update their systems accordingly. In a recent report, however, Microsoft has paused its updates after reports of bricked devices.
For the technically inclined, a summarized description of how these exploits work can be found in this informative Twitter thread by user @gsuberland, an independent security researcher. You may also search through this repository of CPU security bugs caused by speculative execution.
New to blockchain? Check out CoinGeek’s Blockchain for Beginners section, the ultimate resource guide to learn more about blockchain technology.
