Meltdown and Spectre: What Do They Mean For You?

The tech world has been buzzing over Meltdown and Spectre. You know that they’re bad news, but exactly how bad? While the technical side of things may be complex, the part that you need to think about is much simpler. Take a deep breath and get ready for the answers to all of your Meltdown and Spectre questions.

What Are Meltdown and Spectre?

Of course, everyone is asking what exactly Meltdown and Spectre are. In short, they’re both severe security vulnerabilities, and they both break down barriers between running programs, allowing an attacker easier access to data from otherwise secure programs. There are key differences between them, though, and they bake a big difference.

Meltdown

Meltdown is a processor exploit that takes advantage of a flaw in all Intel CPUs and some ARM(cellphone) CPUs. It allows a process to read the memory addresses being used by every process, including core system ones. If a process can read another’s memory, it essentially “knows” what the other process does.

This all means that a rogue process(malware) can read everything going on on your system. If you enter a password, decrypt sensitive data, or access any information on your system, malware using the Meltdown exploit can access it, as if that memory were its own.

Spectre

Spectre is considerably more complex than Meltdown, but it’s also harder to prevent. It takes advantage of the way all modern processors execute a program.

All programs contain conditional logic. That means that there is code that will only execute if a specific condition is met. For example, if you’ve entered the correct username and password, you can sign in.

So, conditional logic creates two paths, one where the condition was met and another where it wasn’t. In order to execute programs faster, CPUs try to guess which it will be based on previous conditions. As a result, there is a time when data is loaded and stored in anticipation of the condition.

Spectre exploits that behavior to make a processor follow a completely erroneous path and allow an attacker a side channel to access data. Like Meltdown, Spectre allows a malicious program to access information that it shouldn’t be able to through the way the CPU operates.

Who Is Affected?

You definitely are affected by either or both of these vulnerabilities.

Meltdown

Meltdown impacts both phones and Intel CPUs. It affects all Intel CPUs. If you have a smartphone or a computer running on Intel, you are susceptible to Meltdown.

You may want to check other computerized devices, like streaming devices, to make sure that they aren’t running on an affected ARM CPU.

Spectre

Spectre affects virtually all modern CPUs. Any desktop computer, server, or mobile device can potentially be exploited with Spectre.

Should You Be Worried?

As of right now, no, you shouldn’t be too worried. There have been no known instances of these exploits actually being used in practice. They were only recently discovered by security researchers.

Keep monitoring the situation, though. It’s entirely possible that a practical exploit will arise or that malware will be designed to use either or both of these exploits. If hardware and software manufacturers don’t release fixes in a timely manner, the problem could become much worse.

What Can You Do?

Right now, there isn’t a whole lot you can do. Keep monitoring online for further developments. It’s also important that you pay attention to security updates from your device and software manufacturers. There are already plenty of patches out there.

Keep your devices updated. Make sure that the updates are stable, though. Windows has already had a couple of stability issues with Meltdown patches. Patches for Apple devices have been rolling out, and patches for the Linux kernel are already included for many distributions. Google is rolling out Android patches soon too.

Web browsers and software compilers are also affected by Spectre. Chrome and Firefox both have fixes implemented in their latest versions. LLVM has also released updated version with a Spectre fix applied.

None of these, though, are entirely airtight. Meltdown, and Spectre in particular, will take some time to be entirely resolved. They exploit key functionality in the design of processors. That’s not something that’s easy to undo.

What Does It All Mean?

In short, it means that everyone has to be more vigilant. Pay attention to continuing developments, and keep your devices updated.

It also means that CPU manufacturers need to change their architecture, and they need to create updated microcode to try to mitigate the problem.

Keep an eye out to see how the hardware and software manufacturers respond to this problem. These are easily among the most widespread and potentially dangerous exploits to arise in recent history. If Intel, Microsoft, AMD, Apple, or any of the others don’t do their part in mitigating the existing problems or resolving them in the future, vote with your wallet. Don’t purchase intentionally insecure products.

Even though this all sounds really bad, don’t freak out. Chances are, everything will be patched and updated before practical attacks start to surface. If you keep your devices updated, everything should be fine.