T +44(0) 1225 290210
E info@rpspartnership.com
RPS Partnership FacebookRPS Partnership TwitterRPS Linked InRPS Partnership RSS Feed

"Giving you peace of mind in a challenging world"

Meltdown & Spectre: How to protect yourself from these CPU security flaws


9 January 2018 - RPS Partnership

With the start of 2018, RPS Partnership is bringing you news of the latest cyber issue to hit our computers. You may find this information useful. If you need any further information, do contact us on info@rpspartnership.com and we can get one of our cyber experts to get in touch with you.

Meltdown & Spectre: How to protect yourself from these CPU security flaws

By now you’ve likely heard about Meltdown and Spectre, the two major security flaws announced by computer experts on January 3. Last week news broke of possibly the biggest and most concerning technical vulnerability, affecting nearly every modern processor in our devices made since 1995.

According to Google’s research division, Project Zero, the flaws affect the microprocessors in the majority of the world’s computers, including mobile devices and cloud networks, and can allow hackers to access the entire contents of a computer’s memory.

The attacks take advantage of a feature in chips known as "speculative execution," a technique used by most modern CPUs to optimise performance.

Therefore, it is possible for such speculative execution to have "side effects which are not restored when the CPU state is unwound and can lead to information disclosure," which can be accessed using side-channel attacks.

Nearly all desktop, laptop, and cloud computers are affected by Meltdown.

The good news is that some anti virus software can help protect you against the types of malware that could take advantage of these vulnerabilities.

The advice from ESET, one of the very first security vendors to allow the Microsoft patch against the flaw to be enabled, is here. While ESET protects against potential malware infection, you should also take these steps to secure your computers and data:

  • Make sure your browser is up to date. For Chrome or Firefox users:
  • Mozilla has released information describing their response, including how Firefox 57 will address these security flaws.
  • Google has stated, "Chrome 64, due to be released January 23, will contain mitigations to protect against exploitation." In the meantime, you can enable "Site Isolation" found in current stable versions of Chrome to provide better protection.
  • Make sure you update your anti virus software, then update your Windows OS to protect against this exploit.
  •  see what mitigations they have implemented already to prevent Meltdown.

What You Should Do: Mitigations And Patches

Many vendors have security patches available for one or both of these attacks.

  • Windows — Microsoft has issued an out-of-band patch update for Windows 10, while other versions of Windows will be patched on the traditional Patch Tuesday on January 9, 2018
  • MacOS — Apple had already fixed most of these security holes in macOS High Sierra 10.13.2 last month, but MacOS 10.13.3 will enhance or complete these mitigations.
  • Linux — Linux kernel developers have also released patches by implementing kernel page-table isolation (KPTI) to move the kernel into an entirely separate address space.
  • Android — Google has released security patches for Pixel/Nexus users as part of the Android January security patch update.  Other users have to wait for their device manufacturers to release a compatible security update.

Mitigations for Chrome Users

Since this exploit can be executed through the website, Chrome users can turn on Site Isolation feature on their devices to mitigate these flaws.
Here's how to turn Site Isolation on Windows, Mac, Linux, Chrome OS or Android:

  • Copy chrome://flags/#enable-site-per-process and paste it into the URL field at the top of your Chrome web browser, and then hit the Enter key.
  • Look for Strict Site Isolation, then click the box labeled Enable.
  • Once done, hit Relaunch Now to relaunch your Chrome browser.

There is no single fix for both the attacks since each requires protection independently.

Information provided by ESET and Marclay ASsociates with thanks. Cyber security trends may be seen here in a blog for 2018.

Contact info@rpspartnership.com for all your security concerns and any advice and assistance required.