Go Back  DVD Talk Forum > General Discussions > Tech Talk
Reload this Page >

Meltdown and Spectre: patch your computers/phones/lives now!

Tech Talk Discuss PC Hardware, Software, Internet and Other Technology

Meltdown and Spectre: patch your computers/phones/lives now!

Old 01-04-18, 11:22 AM
  #1  
DVD Talk Hero
Thread Starter
 
Join Date: Aug 1999
Posts: 26,366
Meltdown and Spectre: patch your computers/phones/lives now!

This probably belongs in the tech forum, but who reads that? In any case, feel free to move it.

Major vulnerabilities were publicly revealed recently. This happens every day, right? But this is actually on the hardware side of things, and while software patches are being rolled out to mitigate the effect, Spectre itself can only currently be patched for known exploits as they are discovered.

This url covers both vulnerabilities. Meltdown is more Intel-specific, supposedly can be mitigated by software patching, and there is as of yesterday a Windows update out for it (variations of Linux have been patched as well and MacOS patched it last month). As stated before Spectre can be software patched only for known exploits.

https://meltdownattack.com/

Questions & Answers
Am I affected by the bug?

Most certainly, yes.

Can I detect if someone has exploited Meltdown or Spectre against me?

Probably not. The exploitation does not leave any traces in traditional log files.

Can my antivirus detect or block this attack?

While possible in theory, this is unlikely in practice. Unlike usual malware, Meltdown and Spectre are hard to distinguish from regular benign applications. However, your antivirus may detect malware which uses the attacks by comparing binaries after they become known.

What can be leaked?

If your system is affected, our proof-of-concept exploit can read the memory content of your computer. This may include passwords and sensitive data stored on the system.

Has Meltdown or Spectre been abused in the wild?

We don't know.

Is there a workaround/fix?

There are patches against Meltdown for Linux ( KPTI (formerly KAISER)), Windows, and OS X. There is also work to harden software against future exploitation of Spectre, respectively to patch software after exploitation through Spectre .

Which systems are affected by Meltdown?

Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Which systems are affected by Spectre?


Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.
Which cloud providers are affected by Meltdown?

Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.

What is the difference between Meltdown and Spectre?

Meltdown breaks the mechanism that keeps applications from accessing arbitrary system memory. Consequently, applications can access system memory. Spectre tricks other applications into accessing arbitrary locations in their memory. Both attacks use side channels to obtain the information from the accessed memory location. For a more technical discussion we refer to the papers ( Meltdown and Spectre)

Why is it called Meltdown?

The bug basically melts security boundaries which are normally enforced by the hardware.

Why is it called Spectre?

The name is based on the root cause, speculative execution. As it is not easy to fix, it will haunt us for quite some time.
The other side effect of this is that the fix basically turns off speculative execution, which will probably affect speed of things like database calls and VM performance.
fujishig is offline  
Old 01-04-18, 12:04 PM
  #2  
Suspended
 
Join Date: Jan 2002
Posts: 52,192
Re: Meltdown and Spectre: patch your computers/phones/lives now!

What is the difference between Meltdown and Spectre?
Meltdown: Intel processors

Spectre: AMD processors & Intel processors, and maybe others
DVD Polizei is offline  
Old 01-04-18, 03:07 PM
  #3  
DVD Talk Special Edition
 
Join Date: Feb 2000
Posts: 1,622
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by DVD Polizei View Post

Spectre: AMD processors & Intel processors, and maybe others
And ARM meaning it just about covers most devices made in the last 15 years.
Kdogg is offline  
Old 01-04-18, 03:10 PM
  #4  
DVD Talk Hero
Thread Starter
 
Join Date: Aug 1999
Posts: 26,366
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by Kdogg View Post
And ARM meaning it just about covers most devices made in the last 15 years.
Hence the first question:

Am I affected by the bug?

Most certainly, yes.
fujishig is offline  
Old 01-04-18, 10:42 PM
  #5  
DVD Talk Legend
 
Sonic's Avatar
 
Join Date: May 1999
Posts: 17,484
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Just got the security fix update from Firefox.

Have not gotten any Windows Update yet.
Sonic is offline  
Old 01-04-18, 11:40 PM
  #6  
DVD Talk Legend
 
Abob Teff's Avatar
 
Join Date: Aug 1999
Location: Not necessarily Formerly known as Solid Snake
Posts: 20,003
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Using the doll, can you show us where Spectre and Meltdown touched you?

I guess I have just become resolved to the fact that nothing is safe and I just don't get worked up.

Abob Teff is offline  
Old 01-05-18, 07:31 AM
  #7  
Admin-Thanos
 
VinVega's Avatar
 
Join Date: Nov 2000
Location: Caught between the moon and NYC
Posts: 31,151
Re: Meltdown and Spectre: patch your computers/phones/lives now!

This looks pretty bad. I guess we wait for patches or just don't use our devices.
VinVega is offline  
Old 01-10-18, 04:53 PM
  #8  
DVD Talk Hero
Thread Starter
 
Join Date: Aug 1999
Posts: 26,366
Re: Meltdown and Spectre: patch your computers/phones/lives now!

The windows updates are out for windows 7 and up.

Intel, however, seemingly won't patch the Bios for anything pre Skylake (introduced in 2015), so I hope you guys bought a computer in the last couple of years. This is BS. So at least we all have to upgrade our computers by buying more stuff from the people who screwed us over in the first place.
fujishig is offline  
Old 01-10-18, 06:29 PM
  #9  
DVD Talk Legend
 
Sonic's Avatar
 
Join Date: May 1999
Posts: 17,484
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by fujishig View Post
The windows updates are out for windows 7 and up.

Intel, however, seemingly won't patch the Bios for anything pre Skylake (introduced in 2015), so I hope you guys bought a computer in the last couple of years. This is BS. So at least we all have to upgrade our computers by buying more stuff from the people who screwed us over in the first place.
Here's hoping there are some lawsuits against Intel.
Sonic is offline  
Old 01-10-18, 10:58 PM
  #10  
DVD Talk Hero
 
Josh-da-man's Avatar
 
Join Date: Sep 2000
Location: The Bible Belt
Posts: 30,348
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by Sonic View Post
Here's hoping there are some lawsuits against Intel.
Maybe there will be a class action lawsuit and we'll get a $5 rebate on the next i7 system we buy.
Josh-da-man is offline  
Old 01-10-18, 11:12 PM
  #11  
DVD Talk Legend
 
Sonic's Avatar
 
Join Date: May 1999
Posts: 17,484
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by Josh-da-man View Post
Maybe there will be a class action lawsuit and we'll get a $5 rebate on the next i7 system we buy.
Sonic is offline  
Old 01-12-18, 03:26 PM
  #12  
DVD Talk Ultimate Edition
 
kahuna's Avatar
 
Join Date: Mar 1999
Location: Hawaii
Posts: 4,956
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by fujishig View Post
The windows updates are out for windows 7 and up.

Intel, however, seemingly won't patch the Bios for anything pre Skylake (introduced in 2015), so I hope you guys bought a computer in the last couple of years. This is BS. So at least we all have to upgrade our computers by buying more stuff from the people who screwed us over in the first place.
I gave my Mom my old HP Computer after her much older Vista HP computer kicked the bucket.

I just checked her HP Pavilion p6710f Desktop computer which is about 7-8 years old now & runs Win 7. There are no new upgrades. Last Win upgrade was in 2016. I have Norton, Malwarebytes, & SuperAntiSSpyware installed on her computer. All she uses her computer for is to check her accounts at her the bank she uses & play freecell. I also notice her HP desktop has a AMD Processor. So I guess it would be a waste of time to install any upgrades if she got one.

I told her she could use my computer to check her accounts & just play FreeCell game on her computer after I disconnect it from the internet. I have a Dell with a Intel i7 chip & i just got the upgrade for Win 8.1 but have not installed it yet.
kahuna is offline  
Old 01-12-18, 03:40 PM
  #13  
Dan
DVD Talk Legend
 
Dan's Avatar
 
Join Date: Feb 2005
Location: \_(ツ)_/
Posts: 19,107
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by kahuna View Post
I gave my Mom my old HP Computer after her much older Vista HP computer kicked the bucket.

I just checked her HP Pavilion p6710f Desktop computer which is about 7-8 years old now & runs Win 7. There are no new upgrades. Last Win upgrade was in 2016. I have Norton, Malwarebytes, & SuperAntiSSpyware installed on her computer. All she uses her computer for is to check her accounts at her the bank she uses & play freecell. I also notice her HP desktop has a AMD Processor. So I guess it would be a waste of time to install any upgrades if she got one.

I told her she could use my computer to check her accounts & just play FreeCell game on her computer after I disconnect it from the internet. I have a Dell with a Intel i7 chip & i just got the upgrade for Win 8.1 but have not installed it yet.
That... doesn't seem right. MS still publishes Windows 7 updates regularly; at minimum on "patch Tuesday" every month.
Dan is offline  
Old 01-12-18, 03:45 PM
  #14  
DVD Talk Godfather
 
fumanstan's Avatar
 
Join Date: Oct 2002
Location: Irvine, CA
Posts: 55,343
Re: Meltdown and Spectre: patch your computers/phones/lives now!

I know Microsoft pulled the AMD patch in Windows Updates because it was causing issues with old AMD CPU's, but that was a few days ago.

https://www.theverge.com/2018/1/9/16...amd-pcs-issues
fumanstan is offline  
Old 01-12-18, 05:29 PM
  #15  
DVD Talk Hero
Thread Starter
 
Join Date: Aug 1999
Posts: 26,366
Re: Meltdown and Spectre: patch your computers/phones/lives now!

There's also something with antivirus programs that will stop this particular windows update from happening unless the antivirus manufacturer updates their product:

https://support.microsoft.com/en-us/...virus-software

but there should at least be updates from 2017 for windows 7...
fujishig is offline  
Old 01-12-18, 05:36 PM
  #16  
DVD Talk Ultimate Edition
 
kahuna's Avatar
 
Join Date: Mar 1999
Location: Hawaii
Posts: 4,956
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by fujishig View Post
There's also something with antivirus programs that will stop this particular windows update from happening unless the antivirus manufacturer updates their product:

https://support.microsoft.com/en-us/...virus-software

but there should at least be updates from 2017 for windows 7...
Well I'm not sure what the heck is going on. I had it set for auto update & notify me & let me pick which ones I want. And I have been checking since this problem started & there has been no updates since sometime in 2016.

I would of upgraded her computer to win 10 but that would of just confused her more. And now that she has Alzthemizer I'm surprised that still can log into her account. Although there has been times she has been locked out since she typed in the wrong pswd more that 3 times.
kahuna is offline  
Old 01-12-18, 06:10 PM
  #17  
DVD Talk Legend
 
Sonic's Avatar
 
Join Date: May 1999
Posts: 17,484
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by kahuna View Post
Well I'm not sure what the heck is going on. I had it set for auto update & notify me & let me pick which ones I want. And I have been checking since this problem started & there has been no updates since sometime in 2016.
I'm on Windows 7 and I get updates all the time. Just the past week I received 4 important updates.

You may want to visit the Windows Update site manually and see if you can get the updates there. Windows 7 is still greatly used today.

I don't care about this spectre shit to be honest. I already got my info compromised thanks to Equifax what more damage can be done.
Sonic is offline  
Old 01-12-18, 08:09 PM
  #18  
DVD Talk Limited Edition
 
Join Date: Feb 2000
Location: Sunny Hawaii
Posts: 6,615
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Originally Posted by kahuna View Post
Well I'm not sure what the heck is going on. I had it set for auto update & notify me & let me pick which ones I want. And I have been checking since this problem started & there has been no updates since sometime in 2016.
Make sure you have Service Pack 1 installed. After that, you can install this convenience rollup update here (you probably want the last one in the list):

http://www.catalog.update.microsoft....px?q=kb3125574

Maybe that will jumpstart further updates through Windows Update.
TheBang is offline  
Old 01-13-18, 02:52 PM
  #19  
DVD Talk Ultimate Edition
 
kahuna's Avatar
 
Join Date: Mar 1999
Location: Hawaii
Posts: 4,956
Re: Meltdown and Spectre: patch your computers/phones/lives now!

Finally got here computer to get the current Win 7 updates. It had not been updated since 06/2016.

At first I was getting this error msg. "Windows update cannot currently check for updates, because the service is not running. You may need to restart your computer".

No matter how many times I restarted the computer I get the same msg. At first I updated each update manually. But after checking each one failed. Now it kept on telling me the Win Update program was still running. I was ready to say the hell with it & just the recovery discs I created when I first brought the computer. Or a brand new Win 7 Professional that a friend gave me years ago when his sister worked for Microsoft. But one last restart & it seemed to correctly install all 5 updates correctly.
kahuna is offline  
Old 01-16-18, 11:52 AM
  #20  
DVD Talk Gold Edition
 
Inhumans99's Avatar
 
Join Date: May 2005
Location: Fremont, CA
Posts: 2,947
Re: Meltdown and Spectre: patch your computers/phones/lives now!

I think my home desktop was having some issues updating (I was getting the cannot complete download message several days back), but after at least two do not turn off your computer while update is in progress cycles it appears my machine accepted the update (I know I had to try and force it the first time around, but the second time I went to wake up my machine and it automatically forced me to wait while it downloaded an upgrade/patch).

Last edited by Inhumans99; 01-16-18 at 03:21 PM.
Inhumans99 is offline  
Old 01-16-18, 02:50 PM
  #21  
DVD Talk Hero
 
Josh-da-man's Avatar
 
Join Date: Sep 2000
Location: The Bible Belt
Posts: 30,348
Re: Meltdown and Spectre: patch your computers/phones/lives now!

My 7 laptop takes forever to update.

When I shut down, the blue screen telling me not to unplug sits there for about ten minutes. Once, a while back, it took over thirty.
Josh-da-man is offline  

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Thread Tools
Search this Thread

Archive Advertising Cookie Policy Privacy Statement Terms of Service

Copyright 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.