As you may have heard, some new vulnerabilities have been publicized recently called Meltdown and Spectre. Many people have asked us what it is, what it does, and if their iPhones will suddenly melt or get haunted. Here’s what you should know:
What is Meltdown?
Before we answer that question, you need to know a little about computer architecture. I’ll do my best to keep it simple! Your operating system has something called a “kernel.” The kernel is the core of your OS. It handles all processes, transactions, and is the sole point of communication between the hardware of a computer and the software. All these instructions are loaded into memory in what’s known as the “kernel space”. Since the kernel often handles sensitive data (passwords, encrypted data, etc) it carves out chunks of memory which are offered to each program running on your computer. Each chunk can only be accessed by its parent application. This is what’s known as “protected memory” and essentially it means that Program A can’t arbitrarily access information that Program B has given to the kernel, and vice versa. Seems sensible.
Meltdown melts down (get it?!) these barriers, allowing a program to access information that doesn’t belong to it. Meltdown affects devices with Intel or ARM processors. While Intel chips are primarily found in your desktops and laptops, ARM chips can be found in mobile phones, game systems, smart TVs, satnavs, networking equipment, and the list goes on…
What is Spectre?
While Meltdown targets one specific vulnerability on a chip, Spectre is a bit more sinister, and as a result, harder to fix. Spectre takes advantage of whats called “speculative execution.” Speculative execution is something that computers do to optimize performance. Essentially, the processor begins working on a task before it knows whether or not the task is actually needed. If it turns out to be needed the work is already underway, if not, the work is stopped and any data that was being processed is removed from the kernel’s memory. The spectre vulnerability allows a malicious program to determine the location of that cached information before it is removed and trick the application into accessing it again. Imagine going to a bank and asking to access a safety deposit box. Obviously the bank will want to make sure that you are authorized to access the box, but to save time they bring the box out of the vault and place it on the table in front of you. For a brief moment, the location of that box is known and it is accessible by someone of “low moral fibre” who happens to be walking past.
Spectre is even more widespread than Meltdown. Devices containing Intel, ARM, AMD, and IBM processors are affected, as well as browser-based JavaScript.
What should I do now?
Don’t panic. Although these two vulnerabilities are considered to be at the “catastrophic” level, there isn’t anything currently known in the wild that exploits them. That being said, you’ll still want to install your security updates as soon as they are released to ensure that you are protected from any future exploits. Apple has already released security updates for Meltdown, so if you’re running iOS 11.2, macOS 10.13.2, or tvOS 11.2 you’re in good shape. With regards to Spectre, iOS 11.2.2, the macOS High Sierra 10.13.2 Supplemental Update, and Safari 11.0.2 for macOS Sierra and OS X El Capitan are your latest patches. If you have an Apple Watch, you’ll be happy to hear that it is not affected by either Meltdown or Spectre.
If you feel anything here is inaccurate or perhaps too vague, let me know in the comments. Alternatively, if I’ve sparked your interest and you want some further reading, here are a few links:
General information, official papers, and FAQ
https://spectreattack.com or https://meltdownattack.com
Apple
About speculative execution vulnerabilities in ARM-based and Intel CPUs
Microsoft
Protect your Windows devices against Spectre and Meltdown
Mitigations Against CPU Speculative Execution Attack Methods
Amazon AWS
Processor Speculative Execution Research Disclosure
Ubuntu
Raspberry Pi
Why Raspberry Pi isn’t vulnerable to Spectre or Meltdown
If you need any more help with Meltdown or Spectre, then please do get in touch!
Dave Deslauriers
Dave is a director and co-founder at Crossover Solutions. He has been looking after Apple devices and their users for over 20 years.
Recent Comments