Intel to release all Meltdown and Spectre patches before the end of January & AMD issues

#5508820

RealNC

2018-01-09 10:34

So, what about people with CPUs older than 5 years? Middle finger and a FU from Intel?

#5508829

kruno

2018-01-09 10:45

RealNC:

So, what about people with CPUs older than 5 years? Middle finger and a FU from Intel?

From Intel with love : https://img00.deviantart.net/2860/i/2005/247/9/1/t_shirt_design__idiot_inside_by_darkxdelusions.png

#5508846

Darkiee

2018-01-09 11:23

Great... I hope i can be safe until i can get ryzen...

#5508850

sverek

2018-01-09 11:31

Is it gonna be chipset driver update? or bios update?

#5508852

386SX

2018-01-09 11:44

Darkiee:

Great... I hope i can be safe until i can get ryzen...

Same here. I use an "old" i7-3820 on an original Intel DX79TO board. It is 6 years old and already announced EOL on the Intel support website since 2014. 🙂

RealNC:

So, what about people with CPUs older than 5 years? Middle finger and a FU from Intel?

They will point you to a knowledgebase article which tells you to buy a new Intel system to circumvent the issue. It leads to the same, but pointing to some KB article sounds better. 🙂

Is it gonna be chipset driver update? or bios update?

The changes need to be done by firmware modification, therefore a BIOS update is needed. Depending on what to come, there could be a software / driver update, too. (MS patches are already available) Quote from the benchmark article:

Fact is that all OSes will need to be patched, yours as well. For Windows, this will be done through an incremental software update, and very likely your motherboard will need to be upgraded with a new BIOS as well.

Another quote:

A bit of a warning, for all I know (I do not expect it though), there might be more security patches released, as well as a mandatory firmware update to activate all protections, that all can have an adverse effect on performance.

Source: http://www.guru3d.com/articles-pages/windows-vulnerability-cpu-meltdown-patch-benchmarked,1.html

#5508858

alanm

2018-01-09 12:03

The bulk of Intel CPUs in use are probably Sandy & Ivy Bridge, which are before 5 years.

#5508859

airbud7

2018-01-09 12:05

what if I just do nothing? I've ended all Financial transactions on this computer. what's the worst that can happen?

#5508860

Fox2232

2018-01-09 12:12

airbud7:

what if I just do nothing? I've ended all Financial transactions on this computer. what's the worst that can happen?

In worst case some java code in browser makes you part of botnet. In case you do not run any external code, you are safe as OS is. In other words, if you just play games, then you are safe till one of games is actually malware. But considering there are huge botnets, you are more likely to be infected due to MS not patching some OS component.

#5508865

mbk1969

2018-01-09 12:21

Fox2232:

In worst case some java code in browser makes you part of botnet. In case you do not run any external code, you are safe as OS is. In other words, if you just play games, then you are safe till one of games is actually malware. But considering there are huge botnets, you are more likely to be infected due to MS not patching some OS component.

I would correct you comment: neither Meltdown nor Spectre are vulnerabilities which help hackers to take ownership of your OS. Both are only about getting access to a memory.

#5508868

386SX

2018-01-09 12:45

mbk1969:

I would correct you comment: neither Meltdown nor Spectre are vulnerabilities which help hackers to take ownership of your OS. Both are only about getting access to a memory.

Correct me if I am wrong, but if you are able to write to memory, you are able to inject code into it and run it, which is the same like you run a program from the harddisk. It won't survive a reboot in RAM, but when executed, it may write data (files) to the harddisk and those will stay after a reboot. Today, you have soooo many possibilities to infect a computer, you cannot rule out it would be impossible to infect a computer using one (or both) of these two methods, Meltdown or Spectre to help you with.

#5508873

mbk1969

2018-01-09 12:57

386SX:

Correct me if I am wrong, but if you are able to write to memory, you are able to inject code into it and run it, which is the same like you run a program from the harddisk. It won't survive a reboot in RAM, but when executed, it may write data (files) to the harddisk and those will stay after a reboot. Today, you have soooo many possibilities to infect a computer, you cannot rule out it would be impossible to infect a computer using one (or both) of these two methods, Meltdown or Spectre to help you with.

I will correct you: I have not met mentions of write access in all Meltdown/Spectre descriptions. If you have then share the link, please.

#5508876

sverek

2018-01-09 13:03

airbud7:

what if I just do nothing? I've ended all Financial transactions on this computer. what's the worst that can happen?

Everything that on your memory can be read. Including passwords and all information you input in sites (credit card number, pin number, etc...)

#5508877

nosirrahx

2018-01-09 13:05

airbud7:

what if I just do nothing? I've ended all Financial transactions on this computer. what's the worst that can happen?

This actually brings up something I tell a lot of people. In a world where a craptop could cost you literally $300 and still be 100% overkill for a machine dedicated to online banking, purchases ... anything where critical info is involved why not do exactly this? Keep this system locked down, use an alternate OS, keep it 100% updated, save 0 passwords ..... anything that might make a pain for general use but for being secure online is exactly what you want. This makes it a lot easier trying to figure out how to handle security on your "fun" rig. As far as what could happen, these exploits will make their way into existing compound exploit kits allowing them to attack from more angles. All in all the "bad guys" just got weapon upgrades. They will be able to gain easier/more access from more initial entry points. Creating a botnet is always one of the major goals and can be used to everything from sending spam to creating artificial site traffic to up a sites price to mining crypto to DDoSing.

#5508881

Embra

2018-01-09 13:19

alanm:

The bulk of Intel CPUs in use are probably Sandy & Ivy Bridge, which are before 5 years.

It seems Intel considers this to be a great opportunity for upgrades. *shifty eyes*

#5508883

fantaskarsef

2018-01-09 13:20

nosirrahx:

This actually brings up something I tell a lot of people. In a world where a craptop could cost you literally $300 and still be 100% overkill for a machine dedicated to online banking, purchases ... anything where critical info is involved why not do exactly this? Keep this system locked down, use an alternate OS, keep it 100% updated, save 0 passwords ..... anything that might make a pain for general use but for being secure online is exactly what you want. This makes it a lot easier trying to figure out how to handle security on your "fun" rig. As far as what could happen, these exploits will make their way into existing compound exploit kits allowing them to attack from more angles. All in all the "bad guys" just got weapon upgrades. They will be able to gain easier/more access from more initial entry points. Creating a botnet is always one of the major goals and can be used to everything from sending spam to creating artificial site traffic to up a sites price to mining crypto to DDoSing.

What do you exactly understand as "locked down"?

#5508893

AsiJu

2018-01-09 13:53

fantaskarsef:

What do you exactly understand as "locked down"?

Obv. can't speak for him/her but I see it as: - never visit sites other than your bank, PayPal etc. what you need to - install firewall and AV software + anti-malware/spyware software with browsing protection (no perf. consideration needed) - don't install Java or Flash if at all possible. AFAIK no financial transactions need either. - keep the system offline when it's not necessary to access the Internet or update OS. - never insert a single USB disk into the system other than OS installation media (if needed). Absolutely foolproof? No. Very unlikely to get an infection? Yes.

#5508894

kruno

2018-01-09 13:54

nosirrahx:

This actually brings up something I tell a lot of people. In a world where a craptop could cost you literally $300 and still be 100% overkill for a machine dedicated to online banking, purchases ... anything where critical info is involved why not do exactly this? Keep this system locked down, use an alternate OS, keep it 100% updated, save 0 passwords ..... anything that might make a pain for general use but for being secure online is exactly what you want. This makes it a lot easier trying to figure out how to handle security on your "fun" rig. As far as what could happen, these exploits will make their way into existing compound exploit kits allowing them to attack from more angles. All in all the "bad guys" just got weapon upgrades. They will be able to gain easier/more access from more initial entry points. Creating a botnet is always one of the major goals and can be used to everything from sending spam to creating artificial site traffic to up a sites price to mining crypto to DDoSing.

That what you suggest isn't possible, you do realize that this flow or bug or whatever you want to call it doesn't have anything to do with software. This is hardware flaw , there is no software in existence that can protect you against this hardware flaw

#5508897

fantaskarsef

2018-01-09 14:04

AsiJu:

Obv. can't speak for him/her but I see it as: - never visit sites other than your bank, PayPal etc. what you need to - install firewall and AV software + anti-malware/spyware software with browsing protection (no perf. consideration needed) - don't install Java or Flash if at all possible. AFAIK no financial transactions need either. - keep the system offline when it's not necessary to access the Internet or update OS. - never insert a single USB disk into the system other than OS installation media (if needed). Absolutely foolproof? No. Very unlikely to get an infection? Yes.

Well I see why this certainly reduces the risk, but sadly I've seen many things happen in even such an environment that's hardly used at all. You have lots of software on most systems that might be faulty in the first place, like keyloggers on laptops, broken windows updates, factory installed trojans, utility software that was injected with malware before it's even certified, or like we have now, basic hardware design flaws. As long as you're connected to the internet, there sadly won't be a really safe system at all, I guess. That's why I was asking. At least on the PC you have the most options and tools to take care of your own security if you have the knowledge and time, every other device is not that impressive. Yet most people use mobile apps for banking... I honestly don't trust those in the first place (and they are affected by Meltdown / Spectre too, aren't they? ARM chips?).

#5508903

AsiJu

2018-01-09 14:11

Yeah no way to be 100 % safe and mobile apps are just as if not more susceptible to harm. I would never use a phone to access my bank account either. Especially now that these flaws were discovered (yep ARM chips are affected too). I do enter PayPal login info via phone if necessary and while that's essentially access to my credit card should someone get the info, at least if compromised I don't need to close my credit card but just shut down the PayPal account.

#5508907

nosirrahx

2018-01-09 14:20

fantaskarsef:

What do you exactly understand as "locked down"?

Execution restrictions, IP access restrictions .... stuff that on a system you use for everything would be annoying but on a system only used for a few select things would not be intrusive at all.