MAJOR EXPLOIT FOUND IN MILLIONS OF COMPUTER CHIPS

![](https://steemitimages.com/DQmbT5WLCYwWPLJT57CZZhT1ASvJmo3DsGYjHjrDC2fK9QB/image.png) Google discovered a major exploit in Intel computer chips last year, and it also has leaked over to other manufacturers such as ARM and AMD. This exploit enables an attack on these millions of computer chips to reveal any system information while the system is running. This is a major security breach which can allow knowledgeable hackers to discover seemingly secure information such as "passwords, encryption keys, or sensitive information open in applications" according to Google's [website](https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html). Google pays a team of people, known as Project Zero, to find zero-day exploits, and better the security of everyone. In the middle of 2017, this team of people realized the depth of the problem and alerted Intel, ARM, and AMD of their findings. When an exploit such as this is discovered, it is not released to the public until much later, until security patches are created so hackers are not able to take advantage of them. Project Zero [released](https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html) the devices they tested and found the exploit on: Intel(R) Xeon(R) CPU E5-1650 v3 @ 3.50GHz AMD FX(tm)-8320 Eight-Core Processor AMD PRO A8-9600 R7, 10 COMPUTE CORES 4C+6G An ARM Cortex A57 core of a Google Nexus 5x phone However, all of these companies have had a lot of time to solve the problem, and Google has already pushed out updates. Check to see if any of your electronic devices have an update because practically everything is affected So how does this attack work and what is the vulnerability? Well, there are three types of possible attacks, two are categorized as "Spectre" and one as "Meltdown". Spectre attacks manipulate "side channel" data, or data that leaks from processers. How this data leaks, is through something called speculative computing. Meltdown is when a rouge program tricks the computer into handing up private information Speculative computing, in my opinion, is soooo cool. It takes time to retrieve data from an external drive, so while this data is being accessed, normally the computer is just stagnant, waiting for the response, but this is wasteful. So instead, intelligent programmers allow the computer to guess what the data will tell it. A program, on a basic level, is just ones and zeros. Imagine a computer circuit like a series of dots. The program tells the computer how to get from one dot to another one. The first thing the computer does is save where the starting dot is, then while it is retrieving the data telling it how to get to the finishing dot, it just guesses. If by the time it receives the data the computer had guessed right, it will not need to take any more time to execute the data saving a lot of resources, but if it is wrong, it will return to the saved dot and execute it. Sadly, however, this process actually leaks important data. So, this process will need to be retired for now, causing computers to process things slower since they will not have the chance to guess anymore. The good thing about this, is that it is very hard to exploit so it may not be a problem. Meltdown, on the other hand is a major problem. To read more about this attack, you can [here](https://spectreattack.com/spectre.pdf). Meltdown implements a similar vulnerability to Spectre, the idea that processors do other tasks while waiting for things to happen. In this case, while basic tasks are being executed, the computer chip is allowed to skip over processes to another one. This is known as "out-of-order execution" and can enable an attacker to bypass security protocals. If a hacker were to usually try to access restricted information, an exception would be flagged and the hacker would by instantly stopped. However, using the Meltdown attack, a hacker can force a computer to execute out-of-order and attack it repeatedly until it executes their restricted access request. The hacker could then attack all of the cache storage and simultaneously and they would each leak restricted information, and the hacker could then withdraw the information and empty the caches before the computer realizes restricted data was leaked and throws the exception. This exploit is much more likely to happen since it is pretty simple to implement because of already implemented cache attacking protocols like Flush+Reload. To learn more, you can read about this attack in detail [here](https://meltdownattack.com/meltdown.pdf). Most of these exploits have already been patched, but just to be safe make sure that all of your electronics are up to date and please don't click on spam e-mails or download things from unknown links, it is just not a good idea and all of your information can be stolen. After everything is up to date, you might find that your computer is running slowly, that is only because these attacks take advantage of shortcuts that allow chips to run faster, so now other methods to speed computer chips up will need to be researched.

Topics