Posted on May 3, 2021 at 8:29 PM
Researchers Discover Flaw That Could Expose Billions Of Computers To Hackers
An Indian-origin researcher has revealed that a vulnerability called “Spectre” can expose billions of computers and other devices to hacks. The researcher said the vulnerability was initially discovered in 2018. However, it’s now open and available to hackers to exploit.
Top computer scientists all over the world have worked hard to see that the Spectre vulnerability is patched to prevent any exploitation from threat actors. They have been working on patches and hardware defenses, which have protected the most vulnerable areas without compromising the speed of the computer.
Hackers can use “micro-op” cache to exploit computers
A discovery from the University of Virginia’s School of Engineering and Applied Science (UVE) has shown that billions of computers are now vulnerable to hackers again.
The research was led by Ashish Venkat, who presented their discovery and warned users about the imminent risk from the vulnerability.
They discovered that hackers can use a new method of exploitation known as “micro-op” cache.” According to the report, it increases the speed of the processor when it stores simple commands and allows the processor to retrieve them quickly in the speculative execution process.
Since the micro-op cash was built into all Intel processors manufactured in 2011, it means all the computers produced after this time may be vulnerable to attacks.
Venkat and his team found out that threat actors can compromise data from the victim’s computer when the micro-op cache sends commands to the processor. Venkat likened the vulnerability scenario to an airport security scenario.
“Think about a hypothetical airport security scenario where TSA lets you in without checking your boarding pass,” he said
A processor in this case predicts that the check will scale through and may allow instructions into the pipeline.
The exploit can affect billions of computers all over the world
When the processor’s prediction is not correct, it will discard those initial instructions. However, the damage may have been done already because the instructions could have a side-effect that the threat actor can exploit to gather vital details such as passwords, Venkat reiterated.
The research team discovered variants of the attacks that can effectively steal speculatively accessed information from AMD and Intel processors, making it open to billions of computers all over the world.
Intel knows about the vulnerability and advised users to use a defense against Spectre, known as LFENCE. It drops vital code in the waiting area pending when the security checks are executed. The code is only allowed to execute when the security checks are executed.
However, Venkat said it looks like the waiting area is prepared for such code, as the researchers have discovered. A threat actor can use the code as a covert channel to smuggle secrets through the micro-op cache. This makes the bug a much difficult proposition to correct, according to Venkat.
Researchers say it’s much difficult to fix the new flaw
In the past when the first sets of ‘Spectre’ attacks were discovered, developers and computer scientists come up with an easy way of preventing any form of attack without any performance lag for the computers. But based on the recent discoveries on the recent open vulnerability, it will not be easy to get the fix.
The difference between the previous attack and this one, according to Venkat, is the fact that a much greater performance penalty is needed compared to the previous attacks.
The research team has also informed the security teams at AMD and Intel about the new vulnerability. The researchers have also presented their research findings at the International Symposium Computer Architecture (ISCA), which has already been accepted.
