Big tech is stepping in to patch newly disclosed security flaws affecting almost every Intel chip since 2011.

Researchers on Tuesday released details of the vulnerability, known as ZombieLoad — or microarchitectural data sampling (MDS) as its technical name — which can leak sensitive data stored in the processor, such as passwords, secret keys and account tokens and private messages.

You can read our coverage here. In short, don’t panic — but you should patch your systems. Here’s how.

Apple released macOS fixes

Apple has fixes out for every Mac and MacBook released during and after 2011.

The tech giant said in an advisory that any system running macOS Mojave 10.14.5, released Monday, is patched. This will prevent an attack from being run through Safari and other apps. Most users won’t experience any decline in performance. But some Macs could face up to a 40% performance hit for those who opt-in to the full set of mitigations.

The security update will also be pushed to Sierra and High Sierra versions. iPhones, iPads and Apple Watch devices aren’t affected by the bugs.

Google patches Android, will update Chrome

The search and browser maker also confirmed it has released patches to mitigate against ZombieLoad.

Google said the “vast majority” of Android devices aren’t affected but Intel-only devices will need to be patched once device makers make updates available.

Chrome OS devices, such as Chromebooks, are already protected in the latest version, and permanent mitigations will be pushed to devices in the next version.

And, the company’s Chrome team has a technical advisory out, but said users should rely on patches for their computer. “Operating system vendors may release updates to improve isolation, so users should ensure they install any updates and follow any additional guidance from their operating system vendor,” said Google. In other words, make sure your Windows PC or your Mac is patched.

Google also rolled out patches to its data centers, so cloud customers are already patched, but should be aware of the company’s guidance.

Mozilla plans long-term Firefox fix

Firefox browser maker Mozilla said it’s got a long-term fix on the way.

“Firefox has applied the mitigation recommended by Apple on macOS,” said a Mozilla spokesperson. “The macOS mitigation will be part of our upcoming Firefox release (67) and Extended Support Release update (60.7), both scheduled for May 21.”

“Firefox Beta and Firefox Nightly already include the change,” the spokesperson said, adding that no action was recommended for browsers on Windows and Linux.

Microsoft rolls out Windows updates

Microsoft has released patches for its operating system and cloud.

Jeff Jones, a senior director at Microsoft, said the software and cloud giant has been “working closely with affected chip manufacturers to develop and test mitigations” for its customers. “We are working to deploy mitigations to cloud services and release security updates to protect Windows customers against vulnerabilities affecting supported hardware chips,” he said.

In a TechNet article, the company said customers may need to obtain directly from their device maker microcode updates for their processor. Microsoft is pushing many of the microcode updates itself through Windows Update, but they are also available from its website.

Software updates will be released Tuesday also through Windows Update. Microsoft also has a page with guidance for how to protect against the new attacks.

Microsoft Azure customers are already protected, the company said.

Amazon patches AWS

A spokesperson for Amazon has confirmed its cloud service Amazon Web Services has been updated to prevent attacks.

“AWS has designed and implemented its infrastructure with protections against these types of bugs, and has also deployed additional protections for MDS,” said an advisory posted on Amazon’s website. “All EC2 host infrastructure has been updated with these new protections, and no customer action is required at the infrastructure level.”

Updated article and headline to include remarks from Amazon and Mozilla.

Read more: </s> All users of the 5.1 kernel series must upgrade. Well, kind of, let me rephrase that...



All users of Intel processors made since 2011 must upgrade.



Note, this release, and the other stable releases that are all being released right now at the same time, just went out all contain patches that have only seen the "public eye" for about 5 minutes. So be forwarned, they might break things, they might not build, but hopefully they fix things. Odds are we will be fixing a number of small things in this area for the next few weeks as things shake out on real hardware and workloads. So don't think you are done updating your kernel, you never are done with that :)

Following today's disclosure of the new MDS vulnerabilities affecting Intel CPUs, a slew of new Linux kernel stable releases have been issued.Greg Kroah-Hartman has issued Linux 5.1.2, 5.0.16, 4.19.43, 4.14.119, and 4.9.176 with these now public mitigation patches that pair with Intel's CPU microcode for mitigating this latest set of speculative execution side-channel vulnerabilities.Greg wrote Go fetch from Kernel.org Yes, I'll be running some benchmarks of this latest mitigation work... Supposedly up to 10% performance penalty for MDS. Benchmarks out later this week. </s> Security researchers have found a new class of vulnerabilities in Intel chips which, if exploited, can be used to steal sensitive information directly from the processor.,

The bugs are reminiscent of Meltdown and Spectre, which exploited a weakness in speculative execution, an important part of how modern processors work. Speculative execution helps processors predict to a certain degree what an application or operating system might need next and in the near-future, making the app run faster and more efficient. The processor will execute its predictions if they’re needed, or discard them if they’re not.

Both Meltdown and Spectre leaked sensitive data stored briefly in the processor, including secrets — such as passwords, secret keys and account tokens, and private messages.

Now some of the same researchers are back with an entirely new round of data-leaking bugs.

“ZombieLoad,” as it’s called, is a side-channel attack targeting Intel chips, allowing hackers to effectively exploit design flaws rather than injecting malicious code. Intel said ZombieLoad is made up of four bugs, which the researchers reported to the chip maker just a month ago.

Almost every computer with an Intel chips dating back to 2011 are affected by the vulnerabilities.

ZombieLoad takes its name from a “zombie load,” an amount of data that the processor can’t understand or properly process, forcing the processor to ask for help from the processor’s microcode to prevent a crash. Apps are usually only able to see their own data, but this bug allows that data to bleed across those boundary walls. ZombieLoad will leak any data currently loaded by the processor’s core, the researchers said. Intel said patches to the microcode will help clear the processor’s buffers, preventing data from being read.

Practically, the researchers showed in a proof-of-concept video that the flaws could be exploited to see which websites a person is visiting in real-time, but could be easily repurposed to grab passwords or access tokens used to log into a victim’s online accounts.

Like Meltdown and Spectre, it’s not just PCs and laptops affected by ZombieLoad — the cloud is also vulnerable. ZombieLoad can be triggered in virtual machines, which are meant to be isolated from other virtual systems and their host device.

Daniel Gruss, one of the researchers who discovered the latest round of chip flaws, said it works “just like” it does on PCs and can read data off the processor. That’s potentially a major problem in cloud environments where different customers’ virtual machines run on the same server hardware.

Although no attacks have been publicly reported, the researchers couldn’t rule them out nor would any attack necessarily leave a trace, they said.

What does this mean for the average user? There’s no need to panic, for one.

These are far from drive-by exploits where an attacker can take over your computer in an instant. Gruss said it was “easier than Spectre” but “more difficult than Meltdown” to exploit — and both required a specific set of skills and effort to use in an attack.

But if exploit code was compiled in an app or delivered as malware, “we can run an attack,” he said.

There are far easier ways to hack into a computer and steal data. But the focus of the research into speculative execution and side channel attacks remains in its infancy. As more findings come to light, the data-stealing attacks have the potential to become easier to exploit and more streamlined.

But as with any vulnerability where patches are available, install them.

Intel has released microcode to patch vulnerable processors, including Intel Xeon, Intel Broadwell, Sandy Bridge, Skylake and Haswell chips. Intel Kaby Lake, Coffee Lake, Whiskey Lake and Cascade Lake chips are also affected, as well as all Atom and Knights processors.

But other tech giants, like consumer PC and device manufacturers, are also issuing patches as a first line of defense against possible attacks.

Computer makers Apple and Microsoft and browser makers Google have released patches, with other companies expected to follow.

In a call with TechCrunch, Intel said the microcode updates, like previous patches, would have an impact on processor performance. An Intel spokesperson told TechCrunch that most patched consumer devices could take a 3 percent performance hit at worst, and as much as 9 percent in a datacenter environment. But, the spokesperson said, it was unlikely to be noticeable in most scenarios.

And neither Intel nor Gruss and his team have released exploit code, so there’s no direct and immediate threat to the average user.

But with patches rolling out today, there’s no reason to pass on a chance to prevent such an attack in any eventuality.

Read more: </s> FRANKFURT/SAN FRANCISCO (Reuters) - Security researchers on Wednesday disclosed a set of security flaws that they said could let hackers steal sensitive information from nearly every modern computing device containing chips from Intel Corp, Advanced Micro Devices Inc and ARM Holdings.

One of the bugs is specific to Intel but another affects laptops, desktop computers, smartphones, tablets and internet servers alike. Intel and ARM insisted that the issue was not a design flaw, but it will require users to download a patch and update their operating system to fix.

“Phones, PCs, everything are going to have some impact, but it’ll vary from product to product,” Intel CEO Brian Krzanich said in an interview with CNBC Wednesday afternoon.

Researchers with Alphabet Inc’s Google Project Zero, in conjunction with academic and industry researchers from several countries, discovered two flaws.

The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.

The researchers said Apple Inc and Microsoft Corp had patches ready for users for desktop computers affected by Meltdown. Microsoft declined to comment and Apple did not immediately return requests for comment.

Daniel Gruss, one of the researchers at Graz University of Technology who discovered Meltdown, called it “probably one of the worst CPU bugs ever found” in an interview with Reuters.

Gruss said Meltdown was the more serious problem in the short term but could be decisively stopped with software patches. Spectre, the broader bug that applies to nearly all computing devices, is harder for hackers to take advantage of but less easily patched and will be a bigger problem in the long term, he said.

Speaking on CNBC, Intel’s Krzanich said Google researchers told Intel of the flaws “a while ago” and that Intel had been testing fixes that device makers who use its chips will push out next week. Before the problems became public, Google on its blog said Intel and others planned to disclose the issues on Jan. 9. Google said it informed the affected companies about the “Spectre” flaw on June 1, 2017 and reported the “Meltdown” flaw after the first flaw but before July 28, 2017.

The flaws were first reported by tech publication The Register. It also reported that the updates to fix the problems could causes Intel chips to operate 5 percent to 30 percent more slowly. (bit.ly/2CsRxkj)

Related Coverage Factbox: What you need to do about newly discovered computer chip flaws

Intel denied that the patches would bog down computers based on Intel chips.

“Intel has begun providing software and firmware updates to mitigate these exploits,” Intel said in a statement. “Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

ARM spokesman Phil Hughes said that patches had already been shared with the companies’ partners, which include many smartphone manufacturers.

“This method only works if a certain type of malicious code is already running on a device and could at worst result in small pieces of data being accessed from privileged memory,” Hughes said in an email.

AMD chips are also affected by at least one variant of a set of security flaws but that it can be patched with a software update. The company said it believes there “is near zero risk to AMD products at this time.”

Google said in a blog post that Android phones running the latest security updates are protected, as are its own Nexus and Pixel phones with the latest security updates. Gmail users do not need to take any additional action to protect themselves, but users of its Chromebooks, Chrome web browser and many of its Google Cloud services will need to install updates.

Amazon Web Services, a cloud computing service used by businesses, said that most of its internet servers were already patched and the rest were in the process of being patched.

The defect affects the so-called kernel memory on Intel x86 processor chips manufactured over the past decade, The Register reported citing unnamed programmers, allowing users of normal applications to discern the layout or content of protected areas on the chips.

That could make it possible for hackers to exploit other security bugs or, worse, expose secure information such as passwords, thus compromising individual computers or even entire server networks.

Dan Guido, chief executive of cyber security consulting firm Trail of Bits, said that businesses should quickly move to update vulnerable systems, saying he expects hackers to quickly develop code they can use to launch attacks that exploit the vulnerabilities. “Exploits for these bugs will be added to hacker’s standard toolkits,” said Guido.

FILE PHOTO: Intel's logo is pictured during preparations at the CeBit computer fair, which will open its doors to the public on March 20, at the fairground in Hanover, Germany, March 19, 2017. REUTERS/Fabian Bimmer/File Photo

Shares in Intel were down by 3.4 percent following the report but nudged back up 1.2 percent to $44.70 in after-hours trading while shares in AMD were up 1 percent to $11.77, shedding many of the gains they had made earlier in the day when reports suggested its chips were not affected.

It was not immediately clear whether Intel would face any significant financial liability arising from the reported flaw.

“The current Intel problem, if true, would likely not require CPU replacement in our opinion. However the situation is fluid,” Hans Mosesmann of Rosenblatt Securities in New York said in a note, adding it could hurt the company’s reputation. </s> “Researchers with Alphabet Inc’s Google Project Zero, in conjunction with academic and industry researchers from several countries, discovered two flaws,” Busvine and Nellis report. “The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.”

“Speaking on CNBC, Intel’s Krzanich said Google researchers told Intel of the flaws ‘a while ago’ and that Intel had been testing fixes that device makers who use its chips will push out next week,” Busvine and Nellis report. “Before the problems became public, Google on its blog said Intel and others planned to disclose the issues on Jan. 9. Google said it informed the affected companies about the ‘Spectre’ flaw on June 1, 2017 and reported the ‘Meltdown’ flaw after the first flaw but before July 28, 2017.”

“Intel denied that the patches would bog down computers based on Intel chips,” Busvine and Nellis report. “ARM spokesman Phil Hughes said that patches had already been shared with the companies’ partners, which include many smartphone manufacturers. ‘This method only works if a certain type of malicious code is already running on a device and could at worst result in small pieces of data being accessed from privileged memory,’ Hughes said in an email. AMD chips are also affected by at least one variant of a set of security flaws but that it can be patched with a software update. The company said it believes there ‘is near zero risk to AMD products at this time.’””

Read more in the full article here.

Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed. Intel believes these exploits do not have the potential to corrupt, modify or delete data. Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits. Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time. Intel is committed to the industry best practice of responsible disclosure of potential security issues, which is why Intel and other vendors had planned to disclose this issue next week when more software and firmware updates will be available. However, Intel is making this statement today because of the current inaccurate media reports. Check with your operating system vendor or system manufacturer and apply any available updates as soon as they are available. Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied. Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers. 

 Intel’s massive chip flaw could hit Mac where it hurts – January 3, 2018 </s> Most of us use computers which house Intel and AMD processors, and then you have the Windows or Linux or macOS operating systems running on them. While the AMD processor running systems are supposedly fine, those running on Intel chips will need to gear themselves for some bad news: A security flaw discovered in the Intel chips that were made after 1995, requires an OS level update, which is expected to bring down the processor performance by 5 to 30 percent.

There is a lot of news floating about this security flaw, which was discovered by The Register, but in case you are still confused about what the fuss is all about, let us try and address the issue for you.

Here is everything you need to know about the Intel chipset security flaw.

So what is this Intel security flaw?

Intel chips that were made post-1995 have been discovered to have a security flaw or bug. According to this, there is a bug at the kernel level which has been found to be leaking memory. This could let hackers access or read your sensitive data such as passwords, login keys and more from the chip itself. In the extreme cases, hackers could also insert malware into your PCs via this opening. This vulnerability isn't just limited to individual PCs, but could also affect servers in data centres that run cloud computing services. Think Amazon Web Services!

Think of the kernel as the central nervous system of an operating system. It is like the god program that controls other programs running on your machine. Every multi-tasking operating system uses a kernel, so that includes Windows, Linux, Android, iOS, macOS and so on.

The diagram above shows how the kernel is the mediator between the software and the device hardware such as the processor, memory as well as other plugged devices. So in a sense, it manages the memory resources, CPU resources as well as the processes required to run the software. Any time you fire up an application, turn on Bluetooth or Wi-Fi, turn on that game — everything goes through the kernel. Your PC is switching between the user mode and the kernel mode to ensure that instructions being given to your system are giving the right results.

The flaw appears to be letting attackers bypass the protections surrounding the kernel access, which lets any regular app read the contents of the kernel memory.

Which systems are affected? How do I find out if my system is also affected?

Any system with an Intel chip is affected by the flaw. The speculation is that this bug is affecting all Intel x86 processors irrespective of the OS running on the system. There is no way to know it, as there are no traces left in traditional log files. Desktops, laptops and even cloud computers running on Intel chips have been affected. Since it is an x86 chip issue, systems running Linux, Windows, as well as macOS, have been affected. The Python Sweetness blog notes that the attack could impact common virtualisation environments such as Amazon's EC2 and Google Compute Engine.

Meltdown is the name given to the vulnerability which affects Intel chips whereas Spectre is the name been given to vulnerabilities in other chip vendors and affects all chips, including ARM, Intel and AMD.

Meltdown is an exploit that breaks the secure separation layer between user applications and the operating system. Memory spaces between applications are segregated and protected to prevent accidental interference with each other's data. Meltdown lets malicious software break this protection. This attack lets a program access the memory and the operating system. Systems with vulnerable processors and those running an unpatched OS, need to beware and not work with sensitive information. It was discovered by Jann Horn (Google Zero Project), Werner Haas and Thomas Prescher (Cyberus Technology) and Daniel Gruss, Moritz Lipp, Stefan Mangard, Michael Schwarz (Graz University of Technology). Here are the patches to fix the Meltdown exploit.

Spectre, on the other hand, breaks the isolation between different applications, which will let hackers into tricking programs to leak their secrets. This affects not just PCs, but also mobile phones, embedded devices and other devices housing a chip. Spectre was reported by Jann Horn (Google Project Zero) and Paul Kocher in collaboration with, in alphabetical order, Daniel Genkin (University of Pennsylvania and University of Maryland), Mike Hamburg (Rambus), Moritz Lipp (Graz University of Technology), and Yuval Yarom (University of Adelaide and Data61).

According to this FAQ, there is no known misuse by exploiting the Meltdown or Spectre vulnerabilities that have been recorded yet.

How will it affect me?

The bug lets hackers get access to the kernel memory. Now as we read above, everything passes through the kernel when it comes to the operating system. So the kernel memory could house some private data which is accessible to hackers.

How is the issue being resolved? What do I have to do?

In the ideal scenario, it is a chip issue and Intel should be fixing it. But experts say that the fix cannot be implemented as a microcode update, and has to be fixed at the OS level.

According to TechCrunch, Meltdown can be fixed by having a stronger wall around the kernel; the technical term is “kernel page table isolation.” This will make the kernel invisible to the running processes. Spectre will take some time to get fully fixed.

In the long term, Spectre could be more serious than Meltdown. While Meltdown can be fixed, albeit, with a performance hit, Spectre seems almost impossible to fix completely and will possibly require a complete rework of how a modern CPU functions. Fixes for Spectre affect only known vulnerabilities. An analogy would be a leaky ship. You know you're taking on water, just not where it's coming from, and you're patching holes as and when you find them.

Linux devs have released a kernel patch. Microsoft is expected to release its security patch soon as part of Patch Tuesday on 9 January. Microsoft has tested it on the Windows Insider preview build. Apple claims that its systems are protected against the exploit with the macOS 10.13.2 release, and additional safeguards will come out with macOS 10.13.3.

As a user, you will have to be on top of any security update that your OS releases and ensure that your system is updated with it. Also, ensure your security software is monitoring for any untoward activity. Intel has also advised running your security software at regular intervals.

Will everything be back to normal after the patch addresses the bug?

Well yes, but there's a catch. The OS level fix is expected to prevent kernel memory from leaking, so that's a good thing. But this will come at the cost of your system performance coming down in the range of 5 to 30 percent, according to The Register. User PCs having Intel 4th gen processors will not suffer as much as those sporting older processors. Virtualisation applications and data centre or cloud workloads are expected to be affected more. Intel says that the performance hit depends on the workload and won't be much for average home PC users. Amazon Web Services has warned customers in an email to expect a major security update to come on Friday.

AMD has released a statement saying that machines sporting AMD processors are not affected by this bug. "AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault," said AMD.

In such a scenario, AMD processor housing systems should not be affected. But if the OS vendor does not make exceptions for the change in OS level code from affecting AMD systems, then there could be some performance hit. As of now, this is in the realm of speculation. </s> After building speculation fueled by media reports (including our own) ahead of a planned coordinated release, researchers at Google, academic institutions, and other companies have revealed a pair of attack classes this afternoon that exploit fundamental operating principles of modern CPUs to allow attackers to arbitrarily read data from the memory of vulnerable systems.

The first, called "Meltdown," breaks down CPU-level protections that prevent unprivileged applications from reading arbitrary system memory, including privileged memory locations corresponding to the operating system's kernel, using what the researchers describe as side effects of out-of-order execution on modern processors.

According to the Meltdown paper, the researchers were able to successfully perform the Meltdown attack using unprivileged code on Intel microarchitectures because of a privilege escalation vulnerability specific to that company's CPUs, but could not successfully execute the full version of the attack on AMD and ARM CPUs.

The researchers warn that every Intel CPU employing out-of-order execution could be vulnerable to the Meltdown attack, which is to say all Intel chips dating back to the Pentium Pro are vulnerable outside of some in-order Atom cores. The principle of kernel page table isolation (KPTI) described in our earlier news post on this topic was not specifically designed to mitigate this attack, according to the researchers, but it does effectively stop an attacker from exploiting this vulnerability.

The researchers urge the adoption of KPTI-style mitigations for Meltdown as soon as possible—something that macOS, Windows, and Linux have done or are in the process of doing.

The second class of attack, called Spectre, apparently allows similar leaking of memory contents through misdirection of certain speculative execution features present in all modern CPUs. The researchers say they have verified the attack on processors from Intel, AMD, and ARM. The researchers further note that Spectre attacks are harder to carry out but also defy easy mitigation, as with Meltdown.

Intel has not provided information regarding its response to these attacks beyond its initial statement this afternoon, but AMD claims that at worst its CPUs have a "near zero risk of exploitation" in a dedicated page on its site. ARM has provided a detailed list of affected products and potential workarounds on its site.

At the software level, Google has detailed steps that it's taking to limit the scope of these vulnerabilities in its own products. Microsoft has also pushed an out-of-band security update for Windows and plans to aggressively begin rebooting affected Azure virtual machines this afternoon. As always when discussing this type of vulnerability, we suggest keeping all software as up-to-date as possible as soon as possible. </s> Security researchers have now disclosed two new exploits that can be executed against modern processors. Dubbed Meltdown and Spectre, the exploits use similar methods to impact processors from Intel, AMD, and ARM across PCs, mobile devices, and in the cloud. The researchers explain:

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Meltdown and Spectre are both distinct attacks, but they both allow attackers to break isolation between applications to access information. Perhaps the most distinct difference, however, is the specific processors affected by each attack. Meltdown, the researchers say, has only been assessed to impact Intel processors. However, the range of potentially affected processors is vast.

More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Spectre, on the other hand, appears to have a much wider reach. According to researchers, nearly every type of device is affected by Spectre; it has been verified to work across Intel, AMD, and ARM processors. Spectre is harder to exploit than Meltdown, but researchers caution that it is also harder to guard against.

The attacks also work against cloud servers, which could leave customer data vulnerable.

Fortunately, at least some fixes are on the way. There are patches against Meltdown for Linux, Windows, and macOS, and Microsoft is currently rolling out an emergency patch for the issue. Spectre is not an easy fix, it seems, and the researchers say that there is ongoing work to "harden software against future exploitation of Spectre, respectively to patch software after exploitation through Spectre."

You can read more on Spectre and Meltdown, including more technical details, in the researchers' full report. </s> Apple is used to fighting leaks about its upcoming products and OS releases, but it’s never had to deal with anything like this before. An anonymous user on the popular code-sharing server GitHub has posted a major component of the iOS source code for all to see, and some experts are fearing it could be “the biggest leak in history.”

As first reported by Motherboard, the leaked code has since been pulled off the site but not before countless people were surely able to get their hands on it. Apple was forced to use the Digital Millennium Copyright Act to get the code taken down, and as UW research scientist Karl Koscher mused on Twitter, the law essentially forces Apple to admit that the code was real or else face perjury charges. In the DMCA takedown letter, Apple's legal team writes that the content in question is a "reproduction of Apple's "iBoot" source code, which is responsible for ensuring trusted boot operation of Apple's iOS software. The 'iBoot' source code is proprietary and it includes Apple's copyright notice. It is not open-source."

The code in question is for a version of iOS 9.3, which was released in spring 2016 and brought features such as Night Shift and various other improvements. The portion of the code that leaked is called iBoot, and as its name suggests, it controls the trusted boot-up process that springs into action every time you start up your iPhone. According to Apple, the iOS bootloader "is the first step in the chain of trust where each step ensures that the next is signed by Apple." If it is compromised, it could allow infected software to run on the device.

In a statement, Apple said, "Old source code from three years ago appears to have been leaked, but by design the security of our products doesn't depend on the secrecy of our source code. There are many layers of hardware and software protections built into our products, and we always encourage customers to update to the newest software releases to benefit from the latest protections."

While the leak is certainly embarrassing, it could also be dangerous. Apple’s boot process is the most essential part of its iOS code, providing front-line protection against malware and other attacks. It’s so sensitive, in fact, that Apple shells out up to $200,000 to developers who find vulnerabilities, according to reports on the invitation-only program.

While the code is for a two-year-old OS and nearly 95 percent of users are on later versions of iOS, it’s likely that parts of it are still in use even in the most recent version of iOS 11. The most likely use for the iBoot code would be for creating jailbroken versions of iOS, but intimate knowledge of iOS’s source code could benefit hackers as well, as it provides an unprecedented look at how the iOS sausage is mode. By digging through the source code, malicious coders could spot vulnerabilities and inconsistencies in the code that could be used to attack all version of iOS, not just 9.3.

The impact on you at home: For the average user, there probably isn’t much to fear, at least not yet. To attack your phone using anything discovered in the iBoot leak, a hacker would likely need physical access to your phone and a bit of time to install a new OS on it. However, it does mean that hackers will be hard at work to find exploits in the code, as well as designers looking to emulate the iOS system. And it’s just one more unfortunate security story Apple has to deal with.
Linux kernel developers, Apple, Google and Microsoft release emergency patches for their products to mitigate ZombieLoad.