Japan Times
10 Jan 2018
The new year began with reports of two critical design flaws in the chips found in virtually all computing and communications devices. Their names, Meltdown and Spectre, offer a good idea of the potential damage they can do. Experts insist that the harm can be mitigated by proper computer hygiene, however, although Spectre will be difficult to fix and underlying vulnerabilities will persist. This incident is another reminder of the critical importance of security consciousness by all device users and, sadly, of continuing susceptibility to hacks and attacks — a vulnerability that will only grow as technology embeds itself further into daily life.
Several researchers, working in different parts of the world, simultaneously uncovered the flaws last summer. (The intervening silence should not be alarming: affected companies have been working since then to fix the problems.) The first bug, Meltdown, exploits “speculative execution” in a microchip’s operation. As a chip processes instructions, it accesses various pieces of data; to speed that process up, some data is assumed to be used repeatedly (hence “speculative”) and thus made available for reading. Using Meltdown, the OS is told to allow access to information that it should not be able to read, such as passwords. By the time the OS has run the code — when execution is no longer “speculative” but real — it realizes that access should not be granted, but by then it is too late.
Meltdown was originally thought to be an Intel chip flaw, but subsequent research has indicated that it affects other chips too, including those produced by ARM Holdings, which is owned by Japan’s SoftBank. Chip manufacturers, computer and device makers such as Apple, and service providers like Google and Amazon, have all acknowledged the flaw and have released or will soon release fixes. Given the ubiquity of these chips — Apple warned that the issues “apply to all modern processors and affect nearly all computing devices and operating systems” — all device users should update their operating system, firmware (the software that instructs computer chips) and web browsers. All three are essential to ensure security and experts believe that will do the trick.
Spectre is a more serious problem. It too exploits “speculative execution,” but it can be used to get a process to reveal its own data; Meltdown only reveals protected data in other processes. It is thought to be more general, affects more devices and is thus harder to defend against. While Spectre is not a problem for most individual computer users, it is a real danger for cloud or other computing service providers.
Researchers noted that the flaw Spectre exploits is extremely difficult to use, but it is also almost impossible to fix. The hole in the software has existed since the 1990s and is integral to all chips created since then. (One of the most common reactions to discovery of the exploit has been amazement at the creativity of the researchers who found it: For 20 years, it was assumed that this problem did not exist.) When the flaw was first made public, the U.S. government released a statement that suggested that there was no fix and the only solution was to replace the flawed chips. The consensus now is that a redesign of chip architecture is required.
Intel has said that it will do just that — a new chip that is supposed to address this hole is supposed to be released later this year — and manufacturers are constantly designing and redesigning their products for speed, efficiency and new purposes. There are fears that current patches will have a substantial impact on processing speed: According to one estimate, some fixes may slow processors down by nearly one-third, but manufacturers insist that any slowdown will be temporary.
The immediate lesson from this incident is the reminder to be security conscious. Vulnerability is a constant in a digital world and the possibility of infection or worse will only increase as technologies burrow deeper into the fabric of daily lives and we become even more dependent on our devices.
Another lesson pertains to chip design. Meltdown and Spectre exploit the demand for ever greater speed in chip performance. The original architecture made critical — and ultimately hazardous — choices about shortcuts to deliver on that demand. The risks involved were not evident for over 20 years, which means that the designers were good — but not perfect — and that those choices were incorporated into generations of subsequent chips. While manufacturers are not sloppy on purpose, it appears that more aggressive and nonlinear thinking needs to go into “red teaming” — challenging and attacking — chip design. Yet we must also acknowledge that vulnerability cannot be eliminated. Even without a meltdown, the specter of hacking and intrusions is a constant.
(Accessible at: https://www.japantimes.co.jp/opinion/2018/01/10/editorials/reminders-digital-dangers/#.WlcgpUs
