Security researchers have found a new class of vulnerabilities in Intel chips which, if exploited, can be used to steal sensitive information directly from the processor.,

The bugs are reminiscent of Meltdown and Spectre, which exploited a weakness in speculative execution, an important part of how modern processors work. Speculative execution helps processors predict to a certain degree what an application or operating system might need next and in the near-future, making the app run faster and more efficient. The processor will execute its predictions if they’re needed, or discard them if they’re not.

Both Meltdown and Spectre leaked sensitive data stored briefly in the processor, including secrets — such as passwords, secret keys and account tokens, and private messages.

Now some of the same researchers are back with an entirely new round of data-leaking bugs.

“ZombieLoad,” as it’s called, is a side-channel attack targeting Intel chips, allowing hackers to effectively exploit design flaws rather than injecting malicious code. Intel said ZombieLoad is made up of four bugs, which the researchers reported to the chip maker just a month ago.

Almost every computer with an Intel chips dating back to 2011 are affected by the vulnerabilities.

ZombieLoad takes its name from a “zombie load,” an amount of data that the processor can’t understand or properly process, forcing the processor to ask for help from the processor’s microcode to prevent a crash. Apps are usually only able to see their own data, but this bug allows that data to bleed across those boundary walls. ZombieLoad will leak any data currently loaded by the processor’s core, the researchers said. Intel said patches to the microcode will help clear the processor’s buffers, preventing data from being read.

Practically, the researchers showed in a proof-of-concept video that the flaws could be exploited to see which websites a person is visiting in real-time, but could be easily repurposed to grab passwords or access tokens used to log into a victim’s online accounts.

Like Meltdown and Spectre, it’s not just PCs and laptops affected by ZombieLoad — the cloud is also vulnerable. ZombieLoad can be triggered in virtual machines, which are meant to be isolated from other virtual systems and their host device.

Daniel Gruss, one of the researchers who discovered the latest round of chip flaws, said it works “just like” it does on PCs and can read data off the processor. That’s potentially a major problem in cloud environments where different customers’ virtual machines run on the same server hardware.

Although no attacks have been publicly reported, the researchers couldn’t rule them out nor would any attack necessarily leave a trace, they said.

What does this mean for the average user? There’s no need to panic, for one.

These are far from drive-by exploits where an attacker can take over your computer in an instant. Gruss said it was “easier than Spectre” but “more difficult than Meltdown” to exploit — and both required a specific set of skills and effort to use in an attack.

But if exploit code was compiled in an app or delivered as malware, “we can run an attack,” he said.

There are far easier ways to hack into a computer and steal data. But the focus of the research into speculative execution and side channel attacks remains in its infancy. As more findings come to light, the data-stealing attacks have the potential to become easier to exploit and more streamlined.

But as with any vulnerability where patches are available, install them.

Intel has released microcode to patch vulnerable processors, including Intel Xeon, Intel Broadwell, Sandy Bridge, Skylake and Haswell chips. Intel Kaby Lake, Coffee Lake, Whiskey Lake and Cascade Lake chips are also affected, as well as all Atom and Knights processors.

But other tech giants, like consumer PC and device manufacturers, are also issuing patches as a first line of defense against possible attacks.

Computer makers Apple and Microsoft and browser makers Google have released patches, with other companies expected to follow.

In a call with TechCrunch, Intel said the microcode updates, like previous patches, would have an impact on processor performance. An Intel spokesperson told TechCrunch that most patched consumer devices could take a 3 percent performance hit at worst, and as much as 9 percent in a datacenter environment. But, the spokesperson said, it was unlikely to be noticeable in most scenarios.

And neither Intel nor Gruss and his team have released exploit code, so there’s no direct and immediate threat to the average user.

But with patches rolling out today, there’s no reason to pass on a chance to prevent such an attack in any eventuality.

Read more: </s> “Researchers with Alphabet Inc’s Google Project Zero, in conjunction with academic and industry researchers from several countries, discovered two flaws,” Busvine and Nellis report. “The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.”

“Speaking on CNBC, Intel’s Krzanich said Google researchers told Intel of the flaws ‘a while ago’ and that Intel had been testing fixes that device makers who use its chips will push out next week,” Busvine and Nellis report. “Before the problems became public, Google on its blog said Intel and others planned to disclose the issues on Jan. 9. Google said it informed the affected companies about the ‘Spectre’ flaw on June 1, 2017 and reported the ‘Meltdown’ flaw after the first flaw but before July 28, 2017.”

“Intel denied that the patches would bog down computers based on Intel chips,” Busvine and Nellis report. “ARM spokesman Phil Hughes said that patches had already been shared with the companies’ partners, which include many smartphone manufacturers. ‘This method only works if a certain type of malicious code is already running on a device and could at worst result in small pieces of data being accessed from privileged memory,’ Hughes said in an email. AMD chips are also affected by at least one variant of a set of security flaws but that it can be patched with a software update. The company said it believes there ‘is near zero risk to AMD products at this time.’””

Read more in the full article here.

Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed. Intel believes these exploits do not have the potential to corrupt, modify or delete data. Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits. Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time. Intel is committed to the industry best practice of responsible disclosure of potential security issues, which is why Intel and other vendors had planned to disclose this issue next week when more software and firmware updates will be available. However, Intel is making this statement today because of the current inaccurate media reports. Check with your operating system vendor or system manufacturer and apply any available updates as soon as they are available. Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied. Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers. 

 Intel’s massive chip flaw could hit Mac where it hurts – January 3, 2018 </s> Two major security flaws found by a group of academic and industry researchers have taken over the tech world by storm. Dubbed ‘Meltdown’ and ‘Spectre’, reports say that Intel chips are most vulnerable, however researchers have said these serious security flaws can also affect AMD and ARM chips.

According to a report, parts of a computer’s memory dedicated to protect things like passwords can be taken over by the bug. The report also says that computers with Intel chips as much as 10 years old can be affected and Windows and Mac OS X patches are required immediately to fix the issue. Steve Smith, Intel’s engineering lead who is investigating the issues has said “Someone has figured out a way to exploit the architecture that is built into all modern computer systems.”

In an official statement, Intel has said “Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

Intel is already facing pressure as its shares fell by 5.5 percent which is the biggest drop since October 2016.

The security threat is not restricted to just computers. Modern microprocessors present on smartphones and other smart device are equally at risk and will require patches to be secure. Now security threats keep coming and going, however, the reason why this is actually a big deal is because chip design flaws are quite rare. Flaws in chip design, if not fixable through software updates, can be really difficult to fix. It usually means a recall of the product, but a recall of this level could potentially be really tedious task. Apart from consumers, major servers, corporates and even a major backbone of the internet is reliant on Intel chips. To put this into perspective, Intel’s chips have over 80 percent market share in PCs overall and over 90 percent in laptops and servers around the world.

What is Meltdown and Spectre?



 A chip architecture contains infringed spaces where data passes through raw and unencrypted form. Say for instance the kernel, which is the most central software unit in the architecture, or in system memory and is kept separate from other applications. This data is protected so it stays safe from any interference or be accessed by any entity say a process or application.

Meltdown and Spectre are two such techniques, rather than a flaw or bug, that can penetrate this protection. Essentially this means that they can expose almost any type of data that the processor processes including passwords, confidential information and even encrypted data.

Meltdown targets Intel processors and bypasses the security system protecting random locations in the kernel memory. It makes the process of segregating and protecting memory spaces to prevent applications from accidentally interfering with one another’s data, or malicious software from being able to see and modify, ineffective.

On the other hand, Spectre can affect Intel, AMD, and ARM processors which brings smartphone and portable smart devices under the radar as well. This means almost anything with a chip, like an air purifier, TV, gaming consoles, to name a few.

Spectre can trick applications into revealing information that is usually inaccessible and safe inside the protected memory area. Since it is based on an established practice in multiple chip architectures, it is a little more difficult to fix. </s> FRANKFURT/SAN FRANCISCO (Reuters) - Security researchers on Wednesday disclosed a set of security flaws that they said could let hackers steal sensitive information from nearly every modern computing device containing chips from Intel Corp, Advanced Micro Devices Inc and ARM Holdings.

One of the bugs is specific to Intel but another affects laptops, desktop computers, smartphones, tablets and internet servers alike. Intel and ARM insisted that the issue was not a design flaw, but it will require users to download a patch and update their operating system to fix.

“Phones, PCs, everything are going to have some impact, but it’ll vary from product to product,” Intel CEO Brian Krzanich said in an interview with CNBC Wednesday afternoon.

Researchers with Alphabet Inc’s Google Project Zero, in conjunction with academic and industry researchers from several countries, discovered two flaws.

The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.

The researchers said Apple Inc and Microsoft Corp had patches ready for users for desktop computers affected by Meltdown. Microsoft declined to comment and Apple did not immediately return requests for comment.

Daniel Gruss, one of the researchers at Graz University of Technology who discovered Meltdown, called it “probably one of the worst CPU bugs ever found” in an interview with Reuters.

Gruss said Meltdown was the more serious problem in the short term but could be decisively stopped with software patches. Spectre, the broader bug that applies to nearly all computing devices, is harder for hackers to take advantage of but less easily patched and will be a bigger problem in the long term, he said.

Speaking on CNBC, Intel’s Krzanich said Google researchers told Intel of the flaws “a while ago” and that Intel had been testing fixes that device makers who use its chips will push out next week. Before the problems became public, Google on its blog said Intel and others planned to disclose the issues on Jan. 9. Google said it informed the affected companies about the “Spectre” flaw on June 1, 2017 and reported the “Meltdown” flaw after the first flaw but before July 28, 2017.

The flaws were first reported by tech publication The Register. It also reported that the updates to fix the problems could causes Intel chips to operate 5 percent to 30 percent more slowly. (bit.ly/2CsRxkj)

Related Coverage Factbox: What you need to do about newly discovered computer chip flaws

Intel denied that the patches would bog down computers based on Intel chips.

“Intel has begun providing software and firmware updates to mitigate these exploits,” Intel said in a statement. “Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

ARM spokesman Phil Hughes said that patches had already been shared with the companies’ partners, which include many smartphone manufacturers.

“This method only works if a certain type of malicious code is already running on a device and could at worst result in small pieces of data being accessed from privileged memory,” Hughes said in an email.

AMD chips are also affected by at least one variant of a set of security flaws but that it can be patched with a software update. The company said it believes there “is near zero risk to AMD products at this time.”

Google said in a blog post that Android phones running the latest security updates are protected, as are its own Nexus and Pixel phones with the latest security updates. Gmail users do not need to take any additional action to protect themselves, but users of its Chromebooks, Chrome web browser and many of its Google Cloud services will need to install updates.

Amazon Web Services, a cloud computing service used by businesses, said that most of its internet servers were already patched and the rest were in the process of being patched.

The defect affects the so-called kernel memory on Intel x86 processor chips manufactured over the past decade, The Register reported citing unnamed programmers, allowing users of normal applications to discern the layout or content of protected areas on the chips.

That could make it possible for hackers to exploit other security bugs or, worse, expose secure information such as passwords, thus compromising individual computers or even entire server networks.

Dan Guido, chief executive of cyber security consulting firm Trail of Bits, said that businesses should quickly move to update vulnerable systems, saying he expects hackers to quickly develop code they can use to launch attacks that exploit the vulnerabilities. “Exploits for these bugs will be added to hacker’s standard toolkits,” said Guido.

FILE PHOTO: Intel's logo is pictured during preparations at the CeBit computer fair, which will open its doors to the public on March 20, at the fairground in Hanover, Germany, March 19, 2017. REUTERS/Fabian Bimmer/File Photo

Shares in Intel were down by 3.4 percent following the report but nudged back up 1.2 percent to $44.70 in after-hours trading while shares in AMD were up 1 percent to $11.77, shedding many of the gains they had made earlier in the day when reports suggested its chips were not affected.

It was not immediately clear whether Intel would face any significant financial liability arising from the reported flaw.

“The current Intel problem, if true, would likely not require CPU replacement in our opinion. However the situation is fluid,” Hans Mosesmann of Rosenblatt Securities in New York said in a note, adding it could hurt the company’s reputation. </s> After building speculation fueled by media reports (including our own) ahead of a planned coordinated release, researchers at Google, academic institutions, and other companies have revealed a pair of attack classes this afternoon that exploit fundamental operating principles of modern CPUs to allow attackers to arbitrarily read data from the memory of vulnerable systems.

The first, called "Meltdown," breaks down CPU-level protections that prevent unprivileged applications from reading arbitrary system memory, including privileged memory locations corresponding to the operating system's kernel, using what the researchers describe as side effects of out-of-order execution on modern processors.

According to the Meltdown paper, the researchers were able to successfully perform the Meltdown attack using unprivileged code on Intel microarchitectures because of a privilege escalation vulnerability specific to that company's CPUs, but could not successfully execute the full version of the attack on AMD and ARM CPUs.

The researchers warn that every Intel CPU employing out-of-order execution could be vulnerable to the Meltdown attack, which is to say all Intel chips dating back to the Pentium Pro are vulnerable outside of some in-order Atom cores. The principle of kernel page table isolation (KPTI) described in our earlier news post on this topic was not specifically designed to mitigate this attack, according to the researchers, but it does effectively stop an attacker from exploiting this vulnerability.

The researchers urge the adoption of KPTI-style mitigations for Meltdown as soon as possible—something that macOS, Windows, and Linux have done or are in the process of doing.

The second class of attack, called Spectre, apparently allows similar leaking of memory contents through misdirection of certain speculative execution features present in all modern CPUs. The researchers say they have verified the attack on processors from Intel, AMD, and ARM. The researchers further note that Spectre attacks are harder to carry out but also defy easy mitigation, as with Meltdown.

Intel has not provided information regarding its response to these attacks beyond its initial statement this afternoon, but AMD claims that at worst its CPUs have a "near zero risk of exploitation" in a dedicated page on its site. ARM has provided a detailed list of affected products and potential workarounds on its site.

At the software level, Google has detailed steps that it's taking to limit the scope of these vulnerabilities in its own products. Microsoft has also pushed an out-of-band security update for Windows and plans to aggressively begin rebooting affected Azure virtual machines this afternoon. As always when discussing this type of vulnerability, we suggest keeping all software as up-to-date as possible as soon as possible. </s> Intel says that claims Meltdown or Spectre are due to flaws or bugs on processors are incorrect.

Chip giant Intel has dismissed suggestions that the Meltdown and Spectre exploits represent bugs or flaws in its chips, and said that other manufacturers are equally susceptible to the vulnerabilities.

The world awoke today to a terrifying reality that virtually all phones and computers in the world are potentially at risk because of security vulnerabilities that exist on chips manufactured in the last 10 years.

Discovered by Google’s Project Zero team last June, the tech industry was due to provide a jointly coordinated response to the exploits on 9 January, but now the issue is out in the open. Security researchers warn that the industry is in a race against time before hackers figure out how to exploit the vulnerabilities.

Meltdown concerns laptops, desktop computers and internet servers that have Intel chips, and allows a rogue programme to access the memory and other secrets of programs and the operating system contained in the central processing unit (CPU).

Spectre is an exploit that breaks the isolation between different applications on chips from Intel, AMD and ARM, and potentially allows hackers to ‘trick’ error-free programmes that normally follow best practices into ‘leaking’ their secrets.

IDC estimated that there are 1.5bn PCs in use around the world today, out of which 90pc are powered by Intel processors.

Intel said it is working with AMD and ARM as well as operating system-makers to develop an industry-wide approach to resolving the issue. Microsoft and Linux Foundation are working on patches to fix the vulnerabilities while Apple has yet to make a statement on the matter.

In a statement, Intel said that the exploits surfaced through security research and, while they have the potential to gather sensitive data, the company does not believe these exploits have the potential to corrupt, modify or delete data.

“Recent reports that these exploits are caused by a ‘bug’ or a ‘flaw’ and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices – with many different vendors’ processors and operating systems – are susceptible to these exploits.

“Intel is committed to product and customer security, and is working closely with many other technology companies – including AMD, ARM Holdings and several operating system vendors – to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits.

“Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

The electronics giant urged consumers and businesses to check with operating system vendors and device manufacturers for updates.

“Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied.

“Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers.” </s> Jan. 3 (UPI) -- Billions of devices might be at risk after researchers found two security flaws inside Intel chips that allow hackers to enter processors and steal sensitive data.

Intel chips have been installed in devices since 1995 and the researchers said every device now contains those security flaws. But the flaws aren't limited to personal devices. Cloud providers like Amazon Web Services, Microsoft Azure and Google Cloud Platform may also be affected.

The two bugs are called Meltdown and Spectre, with the latter being potentially more widespread.

"Almost every system is affected by Spectre," researchers said in a report. "Desktops, laptops, cloud servers, as well as smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD and ARM processors."

"More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995, except Intel Itanium and Intel Atom before 2013."

The researchers said they successfully tested Meltdown on Intel processor generations released as early as 2011.

"Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown," they said.

The main difference between the two bugs is that Meltdown "breaks the mechanism that keeps applications from accessing arbitrary system memory," while Spectre "tricks other applications into accessing arbitrary locations in their memory."

After researchers released their assessment of the bugs, Intel issued a statement that the security flaw is not unique to their chips.

"Based on the analysis to date, many types of computing devices -- with many different vendors' processors and operating systems -- are susceptible to these exploits," Intel said.

Intel advised people with Intel chips in their devices to contact their operating system vendor or system manufacturer and apply any available updates.

Daniel Gruss, a security researcher who discovered the Meltdown bug, told ZDNet that any data can be accessed through the security flaws.

They are "going to haunt us for years," he said. </s> Today will be a crucial test of the market’s response to news of a massive security vulnerability that affects chips made by Intel, as well as a separate problem that hits all microprocessors, regardless of manufacturer.

News of the Intel security problem, known as the “Meltdown” bug, sent the company’s stock price plunging 3.5% yesterday (Jan. 3). The stock recovered by the end of the session, but it’s down around 1.7% in pre-market trading today.

On the heels of the news about the vulnerabilities were reports this morning that Intel chief executive Brian Krzanich made $25 million from selling Intel stock in late November, when he knew about the bugs, but before they were made public.

Meanwhile, rival chip-maker AMD’s stock price was up as much as 5% in yesterday’s trading, before closing the session flat. The stock is up 2.6% in pre-market trading today.

The Meltdown bug means Intel chips dating back to 1995 could be exploited for unauthorized access to their memories. That means passwords, photos, and other content could be accessed by hackers. The other bug, dubbed “Spectre,” gives hackers similar access although it is more difficult to execute, and it affects all modern microprocessors, not just those made by Intel.

The potential for damage from the security loopholes, which were discovered by researchers at a number of companies and universities including Google and the University of Pennsylvania, remains unclear. The chip-makers have issued contradictory statements downplaying the severity of the bugs, but security experts are less sanguine.

Independent security researcher Lukasz Olejnik pointed out that although the bugs are currently difficult to execute, now that they are public, malicious parties will develop increasingly effective ways to carry them out. He points to the potential for the bugs to be triggered through website code, mentioned in the paper released by the researchers, as one cause for concern. “I think it’s fair to expect these techniques to definitely improve,” he said. “But it’s difficult to estimate how soon and to what extent.” There’s currently no evidence that the bugs have been successfully exploited.

Intel issued a statement yesterday denying that the Meltdown bug is unique to its chips, and claimed the problems “do not have the potential to corrupt, modify or delete data.” It also said it was working with other chip and operating-system makers to fix the problems. Intel’s claim that it is working with other chip-makers including AMD prompted the latter to reply that its products were unaffected. The company said in a statement that its product designs meant that there is a “near zero risk to AMD processors at this time.”

Whatever the case may be around the hardware, software makers aren’t taking any chances. Microsoft, Apple, and the Linux open-source community are releasing fixes that will be implemented in their respective operating systems. The trade-off is that these fixes are expected to slow computers down by as much as 30%. It’s not a great time to have Intel inside your machine.

Read next: Most processors produced since 1995 have a flaw that could let hackers steal sensitive information </s> Big tech is stepping in to patch newly disclosed security flaws affecting almost every Intel chip since 2011.

Researchers on Tuesday released details of the vulnerability, known as ZombieLoad — or microarchitectural data sampling (MDS) as its technical name — which can leak sensitive data stored in the processor, such as passwords, secret keys and account tokens and private messages.

You can read our coverage here. In short, don’t panic — but you should patch your systems. Here’s how.

Apple released macOS fixes

Apple has fixes out for every Mac and MacBook released during and after 2011.

The tech giant said in an advisory that any system running macOS Mojave 10.14.5, released Monday, is patched. This will prevent an attack from being run through Safari and other apps. Most users won’t experience any decline in performance. But some Macs could face up to a 40% performance hit for those who opt-in to the full set of mitigations.

The security update will also be pushed to Sierra and High Sierra versions. iPhones, iPads and Apple Watch devices aren’t affected by the bugs.

Google patches Android, will update Chrome

The search and browser maker also confirmed it has released patches to mitigate against ZombieLoad.

Google said the “vast majority” of Android devices aren’t affected but Intel-only devices will need to be patched once device makers make updates available.

Chrome OS devices, such as Chromebooks, are already protected in the latest version, and permanent mitigations will be pushed to devices in the next version.

And, the company’s Chrome team has a technical advisory out, but said users should rely on patches for their computer. “Operating system vendors may release updates to improve isolation, so users should ensure they install any updates and follow any additional guidance from their operating system vendor,” said Google. In other words, make sure your Windows PC or your Mac is patched.

Google also rolled out patches to its data centers, so cloud customers are already patched, but should be aware of the company’s guidance.

Mozilla plans long-term Firefox fix

Firefox browser maker Mozilla said it’s got a long-term fix on the way.

“Firefox has applied the mitigation recommended by Apple on macOS,” said a Mozilla spokesperson. “The macOS mitigation will be part of our upcoming Firefox release (67) and Extended Support Release update (60.7), both scheduled for May 21.”

“Firefox Beta and Firefox Nightly already include the change,” the spokesperson said, adding that no action was recommended for browsers on Windows and Linux.

Microsoft rolls out Windows updates

Microsoft has released patches for its operating system and cloud.

Jeff Jones, a senior director at Microsoft, said the software and cloud giant has been “working closely with affected chip manufacturers to develop and test mitigations” for its customers. “We are working to deploy mitigations to cloud services and release security updates to protect Windows customers against vulnerabilities affecting supported hardware chips,” he said.

In a TechNet article, the company said customers may need to obtain directly from their device maker microcode updates for their processor. Microsoft is pushing many of the microcode updates itself through Windows Update, but they are also available from its website.

Software updates will be released Tuesday also through Windows Update. Microsoft also has a page with guidance for how to protect against the new attacks.

Microsoft Azure customers are already protected, the company said.

Amazon patches AWS

A spokesperson for Amazon has confirmed its cloud service Amazon Web Services has been updated to prevent attacks.

“AWS has designed and implemented its infrastructure with protections against these types of bugs, and has also deployed additional protections for MDS,” said an advisory posted on Amazon’s website. “All EC2 host infrastructure has been updated with these new protections, and no customer action is required at the infrastructure level.”

Updated article and headline to include remarks from Amazon and Mozilla.

Read more:
Security researchers from Graz University of Technology and Catholic University of Leuven discover a major new class of Microarchitectural Data Sampling vulnerabilities called ZombieLoad in Intel processors, which, if exploited, can be used to steal sensitive information directly from the processor. Almost every computer with an Intel chip dating back to 2011 is affected by these vulnerabilities.