Meltdown and Spectre Complicate Government’s Cybersecurity Posture

The dust had hardly settled on the New Year celebrations when the world was rocked by the cybersecurity vulnerability revelations dubbed Meltdown and Spectre. While neither vulnerability constitutes an active threat, the potential footprint, affecting nearly every Intel and Apple chip manufactured over the past 15 years, makes 2014’s Heartbleed look like an op-forces training exercise.

The vulnerabilities were discovered by researchers working with Google’s Project Zero. Meltdown and Spectre are related, but do distinctly different things. Both are hardware vulnerabilities, meaning that the pending software fixes may not be ideal solutions. The Homeland Security Department, which is in the process of cataloging all government systems that are vulnerable to the newly discovered exploits, estimates that software fixes could slow performance by as much as 30 percent. Apple, which says it will release a patch for the Meltdown part of the problem in the coming days, gives a rosier outlook, stressing that their internal tests on iOS devices like smartphones are showing only a 2.5 percent slowdown after patching.

Intel has not made any predictions on the performance hit users will experience after the patches but says that the slowdown should improve over time, presumably as the company refines the way the patches work and update them. A statement on the Intel website stresses that this issue is obviously a top priority for the company, likely the top priority for the near future. “Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively,” the statement reads.

So, what are Meltdown and Spectre?

It’s important to note that neither vulnerability is a threat in itself. But they can be exploited by malware to steal confidential information from computers in ways that should not be possible.

Meltdown breaks down or melts the barriers, hence the name, that should exist between programs and memory. Operating systems work by isolating all the various programs running on a system from each other, and also from memory. It then acts like a traffic cop, allowing different programs to access memory as needed to process data, and keeping the entire system running smoothly with the available resources.

The danger with Meltdown is that it allows a program to jump those barriers. Theoretically, a corrupted version of a browser or other program, or even a dedicated piece of malware, could be set to listen in on memory processes occurring for other programs. So, if you have a classified program that is walled off from the rest of the system, it still needs to use the pool of system memory to process its data. The Meltdown vulnerability would allow malware to snoop that process from the safety of its own little walled garden within a corrupted program. This makes cloud computing especially vulnerable to Meltdown, because users may have no control over how resources are configured within that shared environment. Another user’s corrupted program might be able to listen in on memory processes occurring within the same cloud.

Compared with Meltdown, the Spectre vulnerability would likely require a much more targeted type of attack, plus a much more skilled attacker. The downside is that it might be more difficult to fix. Spectre works because of branching and predictive processes built into processors, which is why the little cartoon ghost icon that has come to represent this vulnerability is carrying a branch in one hand.

Predictive analysis is used to counter memory latency, thus speeding up modern CPUs. What happens is that the processor ends up guessing how programs will next need to use memory. Some of those requests end up simply wasting computing cycles, never used by programs. However, when the guess is correct, it’s like predicting the future, with the CPU having the results ready before the program even asks for it. The correct guesses far outweigh the wrong ones in terms of overall performance.

An attacker exploiting Spectre could—again this is just theory at this point—have a corrupted program send predictive requests into memory and record the time it takes to return results. Blocked or unused requests would come back after a certain amount of time, while those that get through or are used would come back at a different time interval. Now, if you know the nature of another program with classified data that you are trying to snoop, those return times could actually mean something, because it would let you figure out which predictive memory requests are being processed. That could allow an attacker to piece together numbers or other data and form some idea of the classified information being processed in memory by the other program.

Obviously, exploiting Spectre requires a lot of skill, as well as some knowledge of the targeted system and the type of data that would be stolen. It’s highly specific, whereas Meltdown is simply another general tool that hackers could use to, for example, steal passwords from memory or browser histories. However, the types of attackers who go after government at the highest level, with some of them supported by rival nation-states, could possess this skill, or at least have the time and resources to train on how to obtain it. And that could be a problem because the only surefire solution right now to kill Spectre would be to turn off branching prediction, which will lead to that 30 percent or so slowdown that Homeland Security predicts.

I’m not sure slowing government computers down by a third to compensate for a possible vulnerability is the way to go. It might be better to simply modify existing security programs and SIEMs to look for Spectre type exploits and shut them down individually if they happen. There would be almost no way to camouflage a Spectre based attack crossing memory thresholds if a security program is looking for it.

There are few really good options at this point. As Homeland Security notes in Alert TA18-004A, issued on Jan. 4, “patching may not fully address these vulnerabilities in all cases.” If that holds true in the coming days and weeks, the only solution might be a massive replacement of all government hardware, a gargantuan expense that was not included in any agency’s fiscal 2018 budget planning.

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys