[ad_1]
Current processors have design flaws. Spectrum has exposed them, but attacks like Foreshadow and now ZombieLoad exploit similar weaknesses. These "speculative execution" flaws can only truly be corrected by buying a new processor with built-in protection.
Patches often slow down existing processors
The industry was desperately trying to fix "hidden channel attacks" like Specter and Foreshadow, forcing the processor to reveal information that it should not. Current processor protection is available through firmware updates, operating system patches, and patches for applications such as web browsers.
Specter patches have slowed down computers with old processors, although Microsoft is about to speed them up again. Fixing these bugs often slows the performance of existing processors.
Now, ZombieLoad raises a new threat: To completely lock and secure a system from this attack, you must disable Intel's hyper-threading. That's why Google just turned off hyperthreading on Intel Chromebooks. As usual, CPU firmware, browser updates, and operating system patches are about to fill the hole. Most people should not need to disable hyper-threading once these fixes are in place.
New Intel processors are not vulnerable to ZombieLoad
But ZombieLoad is not a danger on systems with new Intel processors. As Intel says, ZombieLoad "is tackled in hardware from some 8th and 9th generation Intel® Core ™ processors, as well as the 2nd generation Intel® Xeon® scalable processor family." Systems with these modern processors are not vulnerable to this new attack.
ZombieLoad only affects Intel systems, but Specter has also affected AMD and some ARM processors. This is a problem that affects the entire industry.
Processors have design flaws, activating attacks
As industry has figured out when Specter's head was ugly, modern processors have some design flaws:
The problem here is with "speculative execution". For performance reasons, modern processors automatically execute the instructions they think they should execute, and if they do not, they can simply go back and return the system to its previous state …
The main problem with Meltdown and Spectrum is the processor cache. An application may try to read memory and, if it reads something in the cache, the operation will finish faster. If he's trying to read something that is not in the cache, the operation will end more slowly. The application can see if something is ending quickly or slowly, and while everything else during speculative execution is cleansed and cleared, the time it took to complete the operation can not be hidden. He can then use this information to create a map of everything in the computer's memory, one at a time. Caching speeds things up, but these attacks take advantage of this optimization and turn it into a security breach.
In other words, performance optimizations in modern processors are the object of abuse. The code running on the processor (perhaps even just the JavaScript code running in a web browser) can take advantage of these flaws to read the memory outside of its normal sandbox. In the worst case, a web page located in a browser tab could read your banking password online from another browser tab.
Or, on cloud servers, a virtual machine might monitor data from other virtual machines on the same system. It's not supposed to be possible.
RELATED: How will fusion and spectrum defects affect my PC?
Hotfixes are just dressings
It is not surprising that to avoid this type of secondary channel attack, patches have allowed CPUs to run a little slower. The industry is trying to add additional controls to a layer of performance tuning.
The suggestion to disable hyper-threading is a fairly typical example: by disabling a feature that speeds up the execution of your processor, you make it more secure. Malware can no longer use this feature, but it will not speed up your PC.
Thanks to the work of many intelligent people, modern systems have been reasonably protected from attacks such as Spectrum without significant slowdown. But patches like these are only dressings: these security flaws must be corrected at the hardware level of the CPU.
Hardware level fixes will provide increased protection without slowing down the processor. Companies will not have to worry about whether they have the appropriate combination of firmware updates, operating system patches, and software versions to protect their systems. .
As a team of security researchers summarizes in a research paper, it is not "bugs, but actually the basis for optimization." The design of the processors will have to change.
Intel and AMD build patches in new processors
Fixes at the hardware level are not only theoretical. Processor manufacturers are working hard on architectural changes to solve this problem at the hardware level. Or, as Intel said in 2018, Intel was "advancing silicon security" with 8th generation CPUs:
We have redesigned some parts of the processor to introduce new levels of protection through partitioning that will protect you at once [Spectre] Variants 2 and 3. Consider this partitioning as an additional "wall of protection" between applications and user privilege levels to create a barrier for bad actors.
Intel previously announced that its 9th generation processors include additional protection against Foreshadow and Meltdown V3. These attacks are unaffected by the newly revealed ZombieLoad attack. These protections must therefore help you.
AMD is also working on changes, even if nobody wants to reveal a lot of details. Lisa Su, CEO of AMD, said in 2018: "In the longer term, we have made changes to our future processor cores, starting with our Zen 2 design, to better respond to potential spectrum feats." .
For those looking for the fastest performance without any fix to slow down the task – or just a company that wants to be completely sure that its servers are as protected as possible – the best solution is to buy a new processor with these hardware patches. Hopefully hardware improvements will prevent future attacks before they are discovered.
Unexpected obsolescence
While the press sometimes speaks of "planned obsolescence" – a company's plan that the material will become obsolete, you will have to replace it – it's an unexpected obsolescence. Nobody expected to have to replace as many processors for security reasons.
The sky does not fall. Everyone makes it harder to exploit by bug attackers such as ZombieLoad. You do not have to buy a new processor at the moment. But a complete fix that does not affect performance will require new hardware.
[ad_2]
Source link