Posted on Jan 12, 2018
5
5
0
https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/meltdown-and-spectre/?cid=232536&lang=en-us&lcid=1033&langid=1&culture=en-US&rcode=WSS1605&version=16.5&wuiv=11.0&ContentIterationID=6.4.4003&OCVersion=3.0&affid=739&coreui_enabled=0&coreui_version=1&hres=1366&vres=768&build=16.5.190&pkgs=273_739_en-us_0_9F2E06D9-1745-4FDF-A746-4F6D6C5F9529_20180506_0_0&hardware_id=2e51fba51961e69957b5437f8f3204eb5816155b [login to see] 6b1c785505077a310d4b4d5a [login to see] 3e407a595407&windows_id=1e809eb44cf4dc7d72fb618647deee0e3008325c5403031c156e097a [login to see] 5d [login to see] 03647e6a140c555f0375645f4a465a1c&pk=653296b62531f9151d5d509772a [login to see] [login to see] c7e69137e544b000a13295e355b [login to see] 6e607c [login to see] 5d4a&pkgid=273&os_country=US&os_culture=en&cui=26074487d6a044349b654d38308a809c-4204d719068e&segid=8&segtyid=1&expdt=20180506&xexpdt=20180804&rnwsrc=ngm&clicksrc=ngmalert&sessionId=4B0DDB5C-8FF9-4018-8D53-D85625BD95AF&messageId=13bbb067-81b7-4f47-b883-539d826decec&experimentId=1657&cohortid=0&clientId=26074487d6a044349b654d38308a809c-4204d719068e&isReboot=False&campaignId=0&pir=1
Between the Blueborne vulnerabilities and the High Sierra Mac flaw – we saw some nasty bugs in 2017. Now, 2018 has already introduced us to some powerful new exploits: Meltdown and Spectre. These are cyber-attack techniques that seek to exploit operating system technologies that normally function safely, as designed, but researchers have cleverly identified a way to use these benign technologies for malicious purposes. They basically manipulate the protections that separate applications from operating systems, as well as applications from other applications running on the same computer. They also affect a wide range of devices that we use in our daily lives, including both PCs and phones.
So, how exactly could Meltdown and Spectre have such an impact? First, let’s back up and explore the role they play in operating systems. Most modern operating systems perform speculative execution, and even execute instructions before it is certain that those instructions need to be executed. This makes it possible for one process to infer that some data belongs to another process.
As McAfee CTO Steve Grobman views it, we should think of these vulnerabilities in the sense of modern banking — we rely on banks to perform operations on our behalf, and when we request that a payment is made, our banks will move things around behind the scenes to ensure successful transactions we couldn’t execute as individuals. Just like with banking, we rely on these operating systems to perform services on our behalf, which often involves important data.
Now, what’s dangerous about Meltdown and Spectre is that these attacks can “melt” the barriers between unprivileged applications and the privileged operating system. Essentially, this means pulling back the curtains on all the behind-the-scenes data involved in these services. This allows attackers that leverage Meltdown and Spectre to potentially steal passwords, financial data or information from other applications.
So, the next question is – how do you ensure your devices and data are protected from these exploits? You can start by following these tips:
Turn on auto-update. Make sure Windows auto-update is turned on as a best practice, and that you’re connected to the internet so that McAfee auto-update can work too. If Windows auto-update is turned on, there’s nothing else you need to do. But if you manually update Windows, it will succeed no later than Tuesday once McAfee’s auto-update occurs.
Update everything immediately. Beyond applying any updates received from Windows, it’s crucial you update everything else too. That way, you can apply any patch you receive from all PC, phone, and mobile app providers that have been affected.
Lock down your devices with comprehensive security. McAfee products are not affected by this vulnerability nor the Windows changes that address it. Therefore, after you’ve updated your devices with the latest software, be sure to install comprehensive security. A solution like McAfee LiveSafe can ensure your devices are protected from cybercriminals wishing to leverage this vulnerability in order to steal your personal data.
Between the Blueborne vulnerabilities and the High Sierra Mac flaw – we saw some nasty bugs in 2017. Now, 2018 has already introduced us to some powerful new exploits: Meltdown and Spectre. These are cyber-attack techniques that seek to exploit operating system technologies that normally function safely, as designed, but researchers have cleverly identified a way to use these benign technologies for malicious purposes. They basically manipulate the protections that separate applications from operating systems, as well as applications from other applications running on the same computer. They also affect a wide range of devices that we use in our daily lives, including both PCs and phones.
So, how exactly could Meltdown and Spectre have such an impact? First, let’s back up and explore the role they play in operating systems. Most modern operating systems perform speculative execution, and even execute instructions before it is certain that those instructions need to be executed. This makes it possible for one process to infer that some data belongs to another process.
As McAfee CTO Steve Grobman views it, we should think of these vulnerabilities in the sense of modern banking — we rely on banks to perform operations on our behalf, and when we request that a payment is made, our banks will move things around behind the scenes to ensure successful transactions we couldn’t execute as individuals. Just like with banking, we rely on these operating systems to perform services on our behalf, which often involves important data.
Now, what’s dangerous about Meltdown and Spectre is that these attacks can “melt” the barriers between unprivileged applications and the privileged operating system. Essentially, this means pulling back the curtains on all the behind-the-scenes data involved in these services. This allows attackers that leverage Meltdown and Spectre to potentially steal passwords, financial data or information from other applications.
So, the next question is – how do you ensure your devices and data are protected from these exploits? You can start by following these tips:
Turn on auto-update. Make sure Windows auto-update is turned on as a best practice, and that you’re connected to the internet so that McAfee auto-update can work too. If Windows auto-update is turned on, there’s nothing else you need to do. But if you manually update Windows, it will succeed no later than Tuesday once McAfee’s auto-update occurs.
Update everything immediately. Beyond applying any updates received from Windows, it’s crucial you update everything else too. That way, you can apply any patch you receive from all PC, phone, and mobile app providers that have been affected.
Lock down your devices with comprehensive security. McAfee products are not affected by this vulnerability nor the Windows changes that address it. Therefore, after you’ve updated your devices with the latest software, be sure to install comprehensive security. A solution like McAfee LiveSafe can ensure your devices are protected from cybercriminals wishing to leverage this vulnerability in order to steal your personal data.
Meltdown and Spectre 101: What to Know About the New Exploits | McAfee Blogs
Posted from securingtomorrow.mcafee.com
Posted 7 y ago
Responses: 2
0
0
0
Thanks for sharing TSgt Joe C. the background and some remediation strategies to interdict and neutralize Meltdown and Spectre before either takes down a system.
(0)
(0)
0
0
0
Read This Next
Continue with Facebook 
Continue with Google