Malware Exploiting Spectre, Meltdown Flaws Emerges (more than 130 malware samples)

[LASER_oneXM]

January 31, 2018
Researchers have discovered more than 130 malware samples designed to exploit the recently disclosed Spectre and Meltdown CPU vulnerabilities. While a majority of the samples appear to be in the testing phase, we could soon start seeing attacks.

The Meltdown and Spectre attack methods allow malicious applications to bypass memory isolation mechanisms and access passwords, photos, documents, emails, and other sensitive data. Shortly after Spectre and Meltdown were disclosed on January 3, experts warned that we could soon see remote attacks, especially since a JavaScript-based proof-of-concept (PoC) exploit for Spectre had been made available.

On January 17, antivirus testing firm AV-TEST reported that it had seen 77 malware samples apparently related to the CPU vulnerabilities, and the number had increased to 119 by January 23.

On Wednesday, AV-TEST told SecurityWeek that it has obtained 139 samples from various sources, including researchers, testers and antivirus companies.

“Most appear to be recompiled/extended versions of the PoCs - interestingly, for various platforms like Windows, Linux and MacOS,” Andreas Marx, CEO of AV-TEST, told SecurityWeek. “We also found the first JavaScript PoC codes for web browsers like IE, Chrome or Firefox in our database now.”

Fortinet, which also analyzed many of the samples, confirmed that a majority of them were based on available PoC code.

Marx believes different groups are working on the PoC exploits to determine if they can be used for some purpose. “Most likely, malicious purposes at some point,” he said.

The expert believes the current malware samples are still in the “research phase” and attackers are most likely looking for ways to extract information from computers, particularly from web browsers. He would not be surprised if we started seeing targeted and even widespread attacks in the future.

In addition to installing operating system and BIOS updates, Marx has two other recommendations that should reduce the chances of a successful attack: switching off the PC when it’s not needed for more than an hour, and closing the web browser during work breaks. “This should decrease your attack surface a lot and also save quite some energy,” Marx said.

 

[lcarol]

Oh wonderful. So what's the average Joe supposed to do in a situation like this? I've only installed the updates from Microsoft, was going to install the firmware from Dell but apparently they didn't make one for my model which is more or less a good thing seeing how both Intel and Dell have taken back what they've said.

 

[shmu26]

Oh wonderful. So what's the average Joe supposed to do in a situation like this? I've only installed the updates from Microsoft, was going to install the firmware from Dell but apparently they didn't make one for my model which is more or less a good thing seeing how both Intel and Dell have taken back what they've said.

The article says that the malware samples are still in the experimental stage, they don't seem to be actively attacking anyone yet, but they are trying to become operational before the world's computers are successfully patched. Let's wait and see whether the cat is faster than the mouse.

 

[ForgottenSeer 58943]

Fortinet is tracking a surge in Meltdown/Spectre malware in the wild now. Also, Fortigate devices AND the Free FortiClient protect against all current strains and the situation is very fluid and will continue to be monitored closely.

Meltdown/Spectre Update

Fortinet Antivirus Signatures for Meltdown and Spectre
The FortiGuard Labs team is actively working to protect customers and organizations from any exploits that might emerge that target these vulnerabilities. We have released the following set of antivirus signatures to address all Meltdown and Spectre samples that have been discovered thus far. As always, we will continue to monitor this situation and provide updates as they become available.

Riskware/POC_Spectre

W64/Spectre.B!exploit

Riskware/SpectrePOC

Riskware/MeltdownPOC

W32/Meltdown.7345!tr

W32/Meltdown.3C56!tr

W32/Spectre.2157!tr

W32/Spectre.4337!tr

W32/Spectre.3D5A!tr

W32/Spectre.82CE!tr

W32/MeltdownPOC