Meltdown and Spectre (by Army General (2S) Watin-Augouard, Founder of the FIC)

As if we needed to give you one more reason to attend FIC2018 (23&24 January in Lille), researchers of Google’s Project Zero program, whose mission is to spot zero day vulnerabilities [1], revealed on January 3 that they discovered two new flaws called Meltdown and Spectrum which allow attackers to steal sensitive data.

Intel’s processors and those of his competitors, AMD and ARM, are directly involved. Numerous devices used by individuals, administrations or organisations, contain these chips : smartphones, computers, tablets, servers, etc. Processors are components used in most computing devices and have, in theory, a protected memory. Now Meltdown and Specter tend to prove the opposite. Processors allow for real-time processing of data, and execute instructions that computer programs send to machines. But Meltdown provides access to the « kernel, » which is the part of an operating system that enables programs to run and that makes the connection between hardware and software. As for Spectrum, which will be more difficult to get rid of because of its perimeter as it affects all processors, it goes as far as creating a permeability between virtual machines and hypervisors.

All operating systems, which act as interfaces between processors and softwares, are likely to be affected. Two types of attack could then be launched, which would make it possible to circumvent data protections mechanisms and thus enable attackers to access and extract it. Data likely to be extracted include passwords, identifiers, banking details, etc. Apart from replacing all chips, which is unlikely in the immediate future, there are no solutions but workarounds. At the risk of losing performance…

Cloud providers are directly involved, especially since it is the very partitioning of virtual machines, which are at the core of their business model, that is being questioned. And the more these flaws are corrected, the more performances will be impacted, and the higher the cost of clogging will rise. Octave Klaba, now a master in computer crisis communication, explained in real time on his Twitter account how OVH managed the situation.

After Wannacry and NotPetya, Meltdown and Specter underline the great fragility of a hyperconnected digital space. In this case, the problems comes from the fact that the chips have not been secured from “by design.” Manufacturers should therefore consider themselves accountable.

[1] ie. unknown flaws that have not yet been corrected