#Specter meltdown software#
#Specter meltdown code#

But such a system is still quite insecure, since one chef can get a pretty good idea of others’ recipes by seeing which pots and pans they take from the common area. One approach would be to have the chefs set up their work on different sides - that’s essentially what happens with the “Cache Allocation Technology” (CAT) that Intel started using in 2016. Imagine an industrial kitchen shared by chefs who all want to keep their recipes secret.

#Specter meltdown code#

Even if the code fails, it could still leak data that the attacker can then access.Ī common way to try to prevent such attacks is to split up memory so that it’s not all stored in one area. Specifically, the attacker could make the processor speculatively execute some code to read a part of memory it shouldn’t be able to. While it pays off in performance speed, it also creates new security issues. To keep performance up, engineers employ a trick: they give the processor the power to execute multiple instructions while it waits for memory - and then, once memory is ready, discards the ones that weren’t needed. If systems always had to wait for memory before doing the next step of an action, they’d spend much of their time sitting idle. To use a simplified example, someone who’s guessing a PIN might first try combinations “1111” through “9111.' If the first eight guesses take the same amount of time, and '9111' takes a nanosecond longer, then that one most likely has at least the '9' right, and the attacker can then start guessing '9111' through '9911', and so on and so forth.Īn operation that’s especially vulnerable to these so-called “timing attacks” is accessing memory. With Meltdown and Spectre, hackers exploited the fact that operations all take slightly different amounts of time to execute. Their method could have immediate applications in cloud computing, especially for fields like medicine and finance that currently limit their cloud-based features because of security concerns.

Lebedev and his colleagues believe that they’ve made an important new breakthrough in this field, with an approach that makes it much harder for hackers to cash in on such vulnerabilities. “They’ve shown that we need to be paying much more attention to the microarchitecture of systems.” “These attacks fundamentally changed our understanding of what’s trustworthy in a system, and force us to re-examine where we devote security resources,” says Ilia Lebedev, a PhD student at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL).

Instead, they arose from the architecture of the processors themselves - that is, the millions of transistors that work together to execute operations.

#Specter meltdown software#

Perhaps the most alarming thing about these vulnerabilities is that they didn’t stem from normal software bugs or physical CPU problems. In January the technology world was rattled by the discovery of Meltdown and Spectre, two major security vulnerabilities in the processors that can be found in virtually every computer on the planet.