Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Security
General Security Discussions
Spectre and Meltdown
Message
<blockquote data-quote="Deleted member 65228" data-source="post: 712623"><p>Even if you were a high value target, the chances of being affected by Meltdown or Spectre is low. Rumours claim that there were many samples found in the wild exploiting either of them, however more trustworthy sources claimed that to be false. I've neither seen any samples in the wild exploiting either vulnerabilities yet.</p><p></p><p>If an attacker wanted to exploit your system using the Spectre vulnerabilities, they'd need local access as far as I am aware. I am not sure if it can be done via JavaScript (which in all fairness is indeed "local" -> the browser process) however you can use security features like [USER=37647]@shmu26[/USER] said which is supported by most mainstream browser vendors, and they also usually come equipped with sandboxing mechanisms now.</p><p></p><p>Microsoft Edge uses AppContainer, and all Chromium-based browsers do support sandbox containing (unless of course someone re-compiled the source code with the feature removed or disabled it via the settings programmatically - both of which are possible). I am not sure about Firefox but I'm sure they have some security features by now at-least.</p><p></p><p>Exploitation of both vulnerabilities have some form of issue. For example, performance... It isn't "efficient" in the sense that it'd take awhile to actually recover data which shouldn't be read by the attacker which is actually meaningful. Some memory locations are harder than others and even if the potential for exploitation is there, it's using the exploitation to it's true potential which can be difficult for a majority of attackers in the real-world. </p><p></p><p>Let proof-of-concepts be... Proof-of-concepts. A proof-of-concept is one thing but real-world usage is another.</p><p></p><p>Microsoft released a rather big update for Windows (big in the sense of the changes) and it changes how the Windows Kernel operates with user-mode to kernel-mode transition. This is why there were rumours about potential performance degradation, although it's been proven now that it wasn't so bad after all and only really affects businesses who are dependent on servers or home users/businesses who are using software which is user-mode based and is quite demanding. This 'rather big update' mitigates the Meltdown vulnerability to a good level from software-side. Prior to the patch update, the Operating System kernel was simply "hidden" and not truly "separated", although thanks to Kernel Page Table Isolation implementation, this is no longer true... It is genuinely separated now. This pretty much stops Meltdown exploitation from being effective.</p><p></p><p>The Spectre vulnerabilities aren't <em>as </em>bad anymore because Microsoft released an update to one of the biggest Integrated Development Environment's (IDE) dubbed Visual Studio (which they actually own) which supports a new linker feature to automatically insert an instruction when required. There's an Assembly instruction for the x86 architecture LFENCE and it basically causes a hold up until all previous checks have been performed, and thus is inserted where vulnerable code is automatically identified - which prevents the speculation execution from being effective and "mitigates" one of the Spectre vulnerabilities to a good level. </p><p></p><p><strong>As long as you keep all of your software up-to-date and make use of browser security features, you'll be fine. </strong></p><p></p><p>I'm going to quote something very important 3 times.</p><p></p><p><strong></strong></p><p><strong></strong></p><p><strong></strong></p><p></p><p>Remember that!</p></blockquote><p></p>
[QUOTE="Deleted member 65228, post: 712623"] Even if you were a high value target, the chances of being affected by Meltdown or Spectre is low. Rumours claim that there were many samples found in the wild exploiting either of them, however more trustworthy sources claimed that to be false. I've neither seen any samples in the wild exploiting either vulnerabilities yet. If an attacker wanted to exploit your system using the Spectre vulnerabilities, they'd need local access as far as I am aware. I am not sure if it can be done via JavaScript (which in all fairness is indeed "local" -> the browser process) however you can use security features like [USER=37647]@shmu26[/USER] said which is supported by most mainstream browser vendors, and they also usually come equipped with sandboxing mechanisms now. Microsoft Edge uses AppContainer, and all Chromium-based browsers do support sandbox containing (unless of course someone re-compiled the source code with the feature removed or disabled it via the settings programmatically - both of which are possible). I am not sure about Firefox but I'm sure they have some security features by now at-least. Exploitation of both vulnerabilities have some form of issue. For example, performance... It isn't "efficient" in the sense that it'd take awhile to actually recover data which shouldn't be read by the attacker which is actually meaningful. Some memory locations are harder than others and even if the potential for exploitation is there, it's using the exploitation to it's true potential which can be difficult for a majority of attackers in the real-world. Let proof-of-concepts be... Proof-of-concepts. A proof-of-concept is one thing but real-world usage is another. Microsoft released a rather big update for Windows (big in the sense of the changes) and it changes how the Windows Kernel operates with user-mode to kernel-mode transition. This is why there were rumours about potential performance degradation, although it's been proven now that it wasn't so bad after all and only really affects businesses who are dependent on servers or home users/businesses who are using software which is user-mode based and is quite demanding. This 'rather big update' mitigates the Meltdown vulnerability to a good level from software-side. Prior to the patch update, the Operating System kernel was simply "hidden" and not truly "separated", although thanks to Kernel Page Table Isolation implementation, this is no longer true... It is genuinely separated now. This pretty much stops Meltdown exploitation from being effective. The Spectre vulnerabilities aren't [I]as [/I]bad anymore because Microsoft released an update to one of the biggest Integrated Development Environment's (IDE) dubbed Visual Studio (which they actually own) which supports a new linker feature to automatically insert an instruction when required. There's an Assembly instruction for the x86 architecture LFENCE and it basically causes a hold up until all previous checks have been performed, and thus is inserted where vulnerable code is automatically identified - which prevents the speculation execution from being effective and "mitigates" one of the Spectre vulnerabilities to a good level. [B]As long as you keep all of your software up-to-date and make use of browser security features, you'll be fine. [/B] I'm going to quote something very important 3 times. [B] [/B] Remember that! [/QUOTE]
Insert quotes…
Verification
Post reply
Top