Home Blog. The security of pretty much every computer on the planet has just gotten a lot worse, and the only real solution—which of course is not a solution—is to throw them all away and buy new ones. An attacker who controls one process on a system can use the vulnerabilities to steal secrets elsewhere on the computer. The research papers are here and here. This means that a malicious app on your phone could steal data from your other apps. Cloud services, which often share machines amongst several customers, are especially vulnerable.
This affects corporate applications running on cloud infrastructure, and end-user cloud applications like Google Drive. Someone can run a process in the cloud and steal data from every other user on the same hardware. Information about these flaws has been secretly circulating amongst the major IT companies for months as they researched the ramifications and coordinated updates.
The details were supposed to be released next week, but the story broke early and everyone is scrambling. By now all the major cloud vendors have patched their systems against the vulnerabilities that can be patched against. It is also unworkable. Pretty much every major processor made in the past 20 years is vulnerable to some flavor of these vulnerabilities. Patching against Meltdown can degrade performance by almost a third. This is bad, but expect it more and more.
Several trends are converging in a way that makes our current system of patching security vulnerabilities harder to implement. The first is that these vulnerabilities affect embedded computers in consumer devices. Unlike our computers and phones, these systems are designed and produced at a lower profit margin with less engineering expertise. This is much harder to walk consumers through, and is more likely to permanently brick the device if something goes wrong. It also requires more coordination.
In November, Intel released a firmware update to fix a vulnerability in its Management Engine ME : another flaw in its microprocessors. Some antivirus software blocks the patch, or—worse—crashes the computer. The final reason is the nature of these vulnerabilities themselves. These vulnerabilities are in the fundamentals of how the microprocessor operates. And those who did were too busy finding normal software vulnerabilities to examine microprocessors.
