Security - Meltdown and Spectre - Revision history

Philip Lacey: /* Is bxp affected */

2018-01-04T12:20:09Z

‎Is bxp affected

Philip Lacey: /* Is bxp affected */

2018-01-04T12:19:37Z

‎Is bxp affected

Philip Lacey: /* Is bxp affected */

2018-01-04T12:15:26Z

‎Is bxp affected

Philip Lacey at 12:14, 4 January 2018

2018-01-04T12:14:38Z

Philip Lacey at 12:13, 4 January 2018

2018-01-04T12:13:54Z

Philip Lacey at 11:45, 4 January 2018

2018-01-04T11:45:09Z

Philip Lacey: Created page with "= Overview = A security issue has been found by Google researchers in Intel and AMD processors. ''Meltdown and Spectre exploit critical vulnerabilities in modern processor..."

2018-01-04T11:30:34Z

Created page with "= Overview = A security issue has been found by Google researchers in Intel and AMD processors. ''Meltdown and Spectre exploit critical vulnerabilities in modern processor..."

New page

= Overview =

A security issue has been found by Google researchers in Intel and AMD processors.

''Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

'''Which systems are affected by Meltdown?'''

Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

'''Which systems are affected by Spectre?'''

Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.

'' [[https://meltdownattack.com/]]

The good news is that is was found by White Hat hackers. The good guys. They reported the issue to Intel and AMD without telling the world first. This has given the companies a chance to develop responses.

If the issue has been used historically it cannot be detected.

The technical explanation is available here https://lwn.net/Articles/738975/

= Detection and correction =

The primary detection tool to identify if there is an issue is https://downloadcenter.intel.com/download/27150?v=t

The results are put into a text file [[File:security_spectre_001.png]]

The situation is developing globally with many agencies reporting updates as manufacturers create them https://www.cnet.com/uk/how-to/how-to-fix-meltdown-spectre-intel-amd-arm-windows-mac-android-ios/

= Is bxp affected =

All n One take their security and patch management very seriously.

* https://security-center.intel.com/advisories.aspx
* https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr

https://www.theverge.com/2018/1/3/16846840/intel-arm-processor-flaw-chipocalypse-windows-macos-linux

@@ Line 65: / Line 65: @@
 -01-04
-* Our one red needs its Firefox, Chrome and CCleaner updated.  On a laptop with a staff member not in the office until 2018-03-08.  Machine is currently powered off.
+* Our one red needs its Firefox, Chrome and CCleaner updated.  On a laptop with a staff member not in the office until 2018-01-08.  Machine is currently powered off.
 * Our one orange is an archived machine which needs its OS and hard drive updated.  Machine is currently powered off.
 * Our one yellow is a failed hard drive which is being replaced by Infrastructure.  Machine is currently powered off.

@@ Line 57: / Line 57: @@
-Our office solutions are managed using ManageEngine Desktop Central.  As of January 3rd 2018 we can instantly see which patches are and aren't applied based on all patches available globally.
+Our office solutions have been managed using ManageEngine Desktop Central for over a year now.  Our latest snapshot, as of January 4th 2018, we can instantly see which patches are and aren't applied based on all patches available globally, on machines throughout our organisation.
 [[File:security_spectre_003.png|800px]]
--01-03
 * Our one red needs its Firefox, Chrome and CCleaner updated.  On a laptop with a staff member not in the office until 2018-03-08.  Machine is currently powered off.

@@ Line 64: / Line 64: @@
 -01-03
-* Our one red needs its Firefox, Chrome and CCleaner updated.  On a laptop with a staff member not in the office until 2018-03-08
+* Our one red needs its Firefox, Chrome and CCleaner updated.  On a laptop with a staff member not in the office until 2018-03-08.  Machine is currently powered off.
 * Our one orange is an archived machine which needs its OS and hard drive updated.  Machine is currently powered off.
-* Our one yellow is a failed hard drive which is being replaced by Infrastructure.
+* Our one yellow is a failed hard drive which is being replaced by Infrastructure.  Machine is currently powered off.
@@ Line 73: / Line 73: @@
 We also maintain an actively running and what's installed application list to ensure no unauthorised programs are running.
 = Contact =

← Older revision		Revision as of 12:14, 4 January 2018
Line 60:		Line 60:


−	[[File:security_spectre_003.png]]	+	[[File:security_spectre_003.png\|800px]]

	2018-01-03		2018-01-03

@@ Line 37: / Line 37: @@
 The results are put into a text file
 [[File:security_spectre_001.png]]
@@ Line 56: / Line 59: @@
 Our office solutions are managed using ManageEngine Desktop Central.  As of January 3rd 2018 we can instantly see which patches are and aren't applied based on all patches available globally.
 -01-03
 * Our one red needs its Firefox, Chrome and CCleaner updated.  On a laptop with a staff member not in the office until 2018-03-08
 * Our one orange is an archived machine which needs its OS and hard drive updated.  Machine is currently powered off.
-https://www.theverge.com/2018/1/3/16846840/intel-arm-processor-flaw-chipocalypse-windows-macos-linux
+[[Category:Topic:Security]]

@@ Line 3: / Line 3: @@
 A security issue has been found by Google researchers in Intel and AMD processors.
-''Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.
+''Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents. ''
@@ Line 11: / Line 12: @@
-Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.
+''Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.''
 '''Which systems are affected by Spectre?'''
-Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.
+''Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.''
@@ Line 37: / Line 36: @@
-The results are put into a text file  [[File:security_spectre_001.png]]
+The results are put into a text file
@@ Line 48: / Line 48: @@
 All n One take their security and patch management very seriously.