Industry Downplays Performance Impact of Meltdown and Spectre, Releases Patches
Intel, Micrsoft, Google, ARM and other tech companies have all downlpayed the impact of the recently disclosed "Meltdown" and "Spectre" chip vulnerabilities, working for months under a so-called responsible disclosure.
Starting with the facts, the first security flaw was the 'Meltdown'. It was revealed on Wednesday, but was first discovered by Daniel Gruss, a 31-year-old information security researcher and post-doctoral fellow at Austria's Graz Technical University. The flaw affects most processors manufactured by Intel since 1995.
Separately, a second defect called 'Spectre' has been found that also exposes core memory in most computers and mobile devices running on chips made by Intel, Advanced Micro Devices (AMD) and ARM Holdings.
Both would enable a hacker to access secret passwords or photos from desktops, laptops, cloud servers or smartphones. It's not known whether criminals have been able to carry out such attacks as neither Meltdown nor Spectre leave any traces in log files.
A possible early disclosure of the security flaws could be a marketing disaster for all the tech industry, so Intel, Microsoft, AMD, ARM and more companies have been working
under so-called responsible disclosure for months, where researchers inform affected companies of their findings to give them time to prepare 'patches' to repair flaws they have exposed.
But the plan for an industry-wide disclosure of the flaws and a coordinated release of the corresponding patches for both hardware and software did not work as planned, after the issue was unveiled a bit earlier by The Register publication.
It took some hours for Intel to respond, trying to downlpay the impact of the security patches in the performance of its chips. Amazon, Microsoft, ARM, Apple and Google followed up with similar announcements.
Intel says it has started providing software and firmware updates to mitigate the security issues. ARM has also said it was working with AMD and Intel on security fixes.
Apple said all Mac computers and iOS devices, like iPhones and iPads, are affected by chip the security flaws unearthed this week, but the company stressed there are no known exploits impacting users.
The company said recent software updates for iPads, iPhones, iPod touches, Mac desktops and laptops, and the Apple TV set-top-box mitigate one of the vulnerabilities known as Meltdown. The Apple Watch, which runs a derivative of the iPhone's operating system is not affected, according to the company.
The company will release an update to its Safari web browser in coming days to defend against Spectre.
Browser makers Google, Microsoft and Mozilla's Firefox all confirmed that they currently have patches in place.
Google said its users of Android phones - more than 80 percent of the global market - were protected if they had the latest security updates.
Currently, security researchers claim that patches for Meltdown, have been readied for Microsoft and Apple operating systems, as well as for the Linux open-source system.
There is as yet no fix for Spectre, which tricks programmes into leaking their secrets but is viewed as a harder exploit for a hacker to carry out.
Generally speaking, Spectre is more difficult to exploit but also to mitigate.
As an interesting note, Intel's CEO sold shares in his company several months after Google informed the chipmaker of the serious security problem affecting its products.
CEO Brian Krzanich sold about $39 million in stocks and options in late November, before the security vulnerability was publicly known. Intel says it was notified about the bugs in June.
Intel spokeswoman told MarketWatch that Krzanich's move was unrelated to the security flaws.
In any case, Intel may be on the hook for costs stemming from lawsuits claiming that the patches would slow computers and effectively force consumers to buy new hardware, and big customers will likely seek compensation from Intel for any software or hardware fixes they make.
Johnson Fistel, LLP is a U.S.-based shareholder rights law firm, is already investigating potential violations of the federal securities laws by Intel and certain of its officers.
Following the dicslosure of the "fundamental design flaw" of some Intel processors by The Register on January 2, 2018, as well as the fact that the first Linux patches had already been devised and were being distributed by the end of October 2017, followed soon by Microsoft patches in November 2017, the price of Intel stock declined.
On October 27, 2017, Intel revised the 2017 outlook upward based on it achieving double-digit growth; Intel share price increased 5% that day. Then on November 29, 2017, Intel Chief Executive Officer Brian Krzanich sold over $39 million of Intel shares. After the sale, it left Krzanich holding just 250,000 shares, the bare minimum under Intel's corporate governance guidelines that he will be required to hold in May 2018 - his 5th anniversary of being named CEO.
The law firm is calling for any information that could
assist its investigation, including from Intel shareholders that recently purchased Intel shares and lost their money.