There’s a lot of hoopla floating around the major processor vulnerabilities called Meltdown and Spectre. If you still don’t know, Meltdown is the name of the latest vulnerability involving Intel microprocessors, which in theory will allow hackers to steal valuable information directly from processor memory. Spectre is the same thing but extends to other processor brands including ARM. What makes this big a news is that this vulnerability has been around for over a decade meaning this vulnerability includes processors made since then. If not for ARM, the world is more or less an Intel world of home PCs, company servers and cloud platforms. A world made vulnerable, if it hasn’t yet been exploited in secret.
When security experts said that there has so far been no evidence of any external agent feeding off these vulnerabilities, that doesn’t necessarily mean that someone hasn’t cracked them. If those that discovered these vulnerabilities thought that extracting data from protected memory was possible, so have others. At least a dozen of those others could have tried, and at least one may have been successful and that one person could easily choose between making that discovery public, or making money out of that discovery. Somewhere out there is a supervillain skimming off unsuspecting computers and he could have been at it for years.
When the Meltdown issue first came out, it’s difficult to wrap one’s head around how anyone, even the most talented hacker can figure out and decipher a bunch of random characters loaded into the processor cache during the process called speculative execution. This would probably be another non-issue that can be solved by Patch Tuesday if the scope of the problem only involved one or two microprocessors. But this vulnerability spanned decades, and billions of processors and left the world feeling naked and spied on, similar to a subject being spied on a mile away through a sniper’s telescope. As I’ve said, the world was only made aware now but what if someone’s been exploiting it for years. Well, those happy times are over thanks to software patches. Those patches though are another issue that blew this one out of proportion.
So you bought the latest generation i7 processor for your gaming rig or web server for your company. You chose the latest generation i7 for maximum performance of course but what if someone told you that if you took the blue pill against Meltdown, that expected performance would go down 30 percent? Of course you’d be pissed. The same goes for whatever processor you choose below and before that fancy i7. You’ll be left with the choice of the red pill, that is, to take the chance that you won’t be hacked in order to keep your 30 percent. With Meltdown and Spectre now public, hackers are now having a field day trying out both vulnerabilities in hopes of getting to those sweet, unpatched systems. Well, let’s not further feed the hysteria. The performance downgrade isn’t as large as 30 percent. It should be between 1 to 5 percent depending on the workload. Though people would still bat an eyelash over 5 percent.
Again, is the threat real? Something we can patch and forget, or something we should really worry about and bash people’s heads for? It’s both. The threat is very real according to those guys from Graz, Austria. The researchers who found the meltdown flaw. Was it possible to get real data and not just random characters from a processor’s protected cache? Yes it was and it was then that this writer realized, thanks to an article from Wired that we should really be concerned. There’s a reason Meltdown and Spectre became bigger than Patch Tuesday.
“It was really, really scary… You don’t expect your private conversations to come out of a program with no permissions at all to access that data.”
— Daniel Gruss, security researcher, Graz University, Austria
“Suddenly I could see strings that shouldn’t belong there… I thought, oh god, this is really working.”
— Moritz Lipp, security researcher, Graz University, Austria
The guys above managed to prove that readable data can be taken from protected areas in the processor. That there’s a gap in the processor’s basic defense mechanism that isolates untrusted programs from accessing other processes. With that in mind, other talented hackers can do the same.
Well, we can patch but we won’t be able to forget especially when we’re not getting the performance we’ve been promised. Have we been getting that performance in the first place? Then that question gets compounded because we’re going to have to further lower that performance already in question, in order to fix a flaw that shouldn’t be there.
Let’s be fair though. The more complex a program gets; the more bugs it may have to deal with. The same goes for hardware. There are billions of transistors in the modern multi-core processor. There has to be a flaw in there somewhere. A flaw we’ll have to pay for and live with so long as the thing works as expected.
And even though flaws are normal with processors, this one cannot be ignored as it affects billions of systems and the consequences include a security vulnerability and performance downgrade. Unless they come up with a more acceptable solution, Intel and other manufacturers will have to answer for Meltdown and Spectre.