Hi everyone welcome back to salted hash
My name is Steve Reagan senior staff writer at CSO online with me a staff writer Jay and pour up and we're going to talk
About specter a meltdown we'll be right back
So hi
Hi, you're new I'm the new guy. We've we've never seen you before on the show so welcome
I see you brought toys
Ah, yes toys, so so I thought I was cool to have my little laptop, and now you're out doing me already
That's your second week on the job and third third week third week
Yes, so about three weeks in you've acquired more gear than I have I'm a little jealous
So how are you? How you liking things so far good good in Framingham here at IDG
Global headquarters for the first time yeah, yeah, we're stuck on the fourth floor and a little studio, Chris is back there
Just laughing maniacally at its. Hello. Wave Chris there. You go see
I tell him the wave all the time and none of you can see him waving, but trust me
He does he really does he truly waves so Spectre in meltdown. We've got the the New Year kicked off with a a
frightening bit of melting
Hardware yeah, there we go melting harder. The puns really don't lend themselves to these vulnerabilities, but they do
What is it?
What is it about spectre and meltdown you think that that scared everybody when this first came out just because you know it
Impacts all of Intel, or was it something else. What do you think I think that?
The asymmetry between attack and defense and hardware is especially
extreme compared to software because
Software flaws can be patched and deployed especially if you have a patching program to do that
But tell me how you're going to patch your hardware
Yeah, I mean at best you can mitigate these things by by patching operating system
But you're not going to patch your hardware and the hardware refresh cycle on this this stuff is like five years
Oh if that yeah, there's there's systems out there now that are older as old as we are hmm
And I mean the thing is you have this
The this problem with the the legacy things which actually led into a lot of issues here recently
To give you a quick recap
Spectre and meltdown are actually the names given for three different variants a possible side Channel again
against processors and
What you need to understand is variance one into our
Spectre variant three is meltdown that's the bad one yeah meltdown is like the worst of the bunch, but meltdown was actually
easier to address the inspector was
Suspect there is something that based on the way the the processors are designed these days spectres going to be here for a while
except in some instances like I know Intel's been pushing out and talking about new architecture who was at
AMD CEO, Lisa sue said that those into chips are gonna be
Patched again Specter when they come out problem is we won't see those chips into like 2019
Which is going to be really bad?
And what other hardware flaws have we not discovered now that we have so many more eyeballs saying ooh
We got stuff to look for okay, maybe we've mitigated these, but how many more are there that we don't know about yeah
and I think the
The frightening aspect about that is is when you consider the way that
Technology has permeated the market and you know from IOT devices all the way down to our physical systems here in front of us
We'll never know. I mean hopefully as engineering improves
They get these things filtered out in the upstream so that when new systems come to market. They're already pre
I hate to say this but pre patched. You know against these these types of attacks, but the thing is
Maybe there's something out there. We haven't figured out yet in these tacks or a gateway to
You know these vulnerabilities would be a gateway to another type of attack against the hardware
And it's it's a continuing rat race at that point to try and stay that ahead of people who would use them for ill
patching was the big advice earlier this year when
this
These vulnerabilities dropped on the public
you know everybody was like Cisco's putting out patches Intel's putting out patches AMD's putting out patches arm has done this and
That's all well and dandy because you know that's what people needed, but the problem is
Just last weekend. I think it was yet. Just last weekend Microsoft had to rush out of ban patches to fix the flaws and Intel's
patching and
They're not like the the patches were broken, but what it's what?
It's doing is putting systems into in a perpetual reboot and that you know for enterprise customers. That's a very very bad thing
There was also a lot of problems with performance
Did you notice any after you got your patches has any of your systems had performance problems?
I've had a number of people you know pitch me stories with research suggesting that there are performance issues
Nothing's as dramatic as the initial scaremongering
30% that we were saying yeah that
But there is clearly a performance trade-off and people have even gone so far as to say you know
Maybe Moore's law really is dead now that you know you know
Intel and AMD and the others have been playing games to to get maximum processing speed at the expense of
deploying secure Hardware also the
Interesting thing about that is there's a lot of people blamed Intel and AMD for these flaws and so how could you architect him in?
And and the thing that stands out to me is Intel built these chips based on customer demand
They made the the they manufactured these chips to spec based on what customers wanted performance wise so
literally they gave us what we wanted what we wanted was a security flaw and that just
It stands out to me like you be careful what you wish for because you might get it and tons of other things along with
it well I mean you have Intel a me and and can we swear on this show because that is just
There we go
It happened
You know I mean we can talk about spectrum meltdown all day, but Intel Emmy is is a total show and and you know?
That's like a back door built right into your processor
You know and deliberately not even like I have no reason to believe spectra in meltdown for anything other than well-intentioned accidents
I mean nobody is suggesting that these were deliberately put into the chip
But until I me is is not a flaw. It is not a a bug. It is a feature yep
and just to state that the the whole thing of me being a
Show was your personal opinion? That was my personal bait and does not reflect that of my employee or anyone else there?
We go so thank you for that one um we have
I
Mean the thing is you're not wrong though. I mean intentionally including a backdoor into design. Just seems weird to me
I've never understood the mechanics or why it's valuable even as a support guy working in a NOC
I wouldn't want something like that
You know it's there are tools out there to make that that job so much easier for me, but sticking to Spectre and mount down
Did you did you see Linus put out a post yeah? He was pissed oh, man
He was not happy about that, but the good news is Linux the the kernel
4.15 is actually engineered against Specter
and
Hopefully as things progressed. It's it's going to stay that way he is more focused on 4.16 now
Not really wanting to get into the things
But this this latest kernel took a long time to get out there because they were engineering all the fixes need and apparently that
Dragged the process down anything that makes Linux care about security. I know shocker right onion
You know it's bad when lineage Torvalds decides to give about security. Yeah when he when he gets upset about it
It's something serious, and then of course the what are the other latest updates for
Inspector mountain is
Security companies are not talking about the fact that they're seeing
POC
using them in attacks and
it's really interesting because a lot of the pocs that you're seeing are centered on the web-based attack not the network based attack and
Your primary defense against there as what we were just talking about this
What do you think the the best defense against the web-based attacks are well? I mean ad blocking is clearly a major component of that
You know we've gotten rid of flash mostly. That's a good thing restricting JavaScript may may be something for
Enterprise environments or government agencies to be thinking about yeah at the expense of killing a great deal of web functionality
But especially in lockdown enterprise environments how much?
How much functionality do you need on random websites that want to play something? You know it just kills me, and I think it was
Yeah, there. It is on the 21st of January av-test said they discovered a hundred and nineteen samples related to
specter meltdown
And these samples are literally just POCs that
Security researchers are coming up with these are not in the wild attacks
Nobody's exploiting them or anything like that and he bets on how soon
We'll see them in the wild so the the funny thing with that is is
Even if we did see them in the wild I'm not concerned about that you know
Spectre meltdown our
vehicles they are the pathway to the final attack on your system be that ransomware or Turgeon or something like that and
The mitigations you would normally take to defend against such things are still going to apply here mmm
You know I mean yeah, it's Spectre amount that are important
But they're not the end of the world there are things you can do so I don't want
To spread fear and panic because we're seeing pocs. I mean that's what researchers do they develop these concepts so that people know what's available
What's not available and you can mitigate defenses when possible? I mean, I think we should be talking a little bit about
Cloud storage providers here because they were both the most affected
But also the most agile now in deploying patches because the real threat of
Spectrum meltdown was shared hosting where where there was a VM escape or you could steal sensitive data from
Other users or even yeah
Yeah, so so
And we and we see all the major cloud providers have patched immediately
But like digitalocean, which is popular developers has only just now like the last weekend deployed mitigations that weeks later
and and
Enterprise is doing you know hybrid cloud or anything with cloud on-premises where there is a shared storage with
different levels of secure
Information should be thinking about you know how is this going to affect the confidentiality of?
the data stored on those hybrid clouds
You know the the interesting thing to when it comes to protecting the data
It's in these clouds is now with all these new regulations coming out from like gdpr and everything else
You know vulnerabilities like this just really
throw a wrench in the entire operation because
What you thought you had going on and all the the best laid plans you had for achieving all
its huge step backwards when you have to change your infrastructure, and if you're undergoing compliance or
assessments you know related to your infrastructure in any way and you've suddenly got to rip out a
Significant portion of it re-engineer it that sets you back, and that's time, that's money
That's that's a lot of lost productivity
And I think there are some companies that are
Not fully aware of the impact these two vulnerabilities are gonna have on their environment long term. Especially the longer
they hold out and keep using legacy systems that are justified because
You need this for a compliance measure you need this you know for some sort of
regulatory
Thing and it's the only system that could run the specialty piece of software that you absolutely have to have
And that's where we're gonna see a lot of the the pain long-term. I think I'm not worried about our laptops
I'm not worried about the the new cell phones in everybody's pockets
I mean yeah, they're those could be at risk and there's an issue there but long term
We're talking companies that have systems that are
15-20 years old still in play and if they're not being patched like spectra and meltdown are the least of your worries
Yeah, I mean if you aren't all I mean if you have a fully deployed patching program
Then maybe you might be in a position
But but if you're you know if you have to have admin admin as your password on all of your your network infrastructure
Then you know you've got bigger problems than Spector and Mel's yeah
And that's not to say I'm coming down on people for not patching their stuff
You know there are some organizations out there that absolutely cannot patch
They are forced in a situation where they can't touch anything
But there is a huge gap where there is not patching and there ought to be bad
Yeah, where there is like no excuse really no excuse and that's that's that's where things get that get disheartening
you know where you just kind of want to shrug your shoulders and sob in a corner because
How do you not do that?
How do you not take the basics?
seriously enough to where you know you're you're not trying to protect your assets the best you can and
Unfortunately a lot of companies. You know that assumed risk is
Very much a way of life for them that is how they
You know how they operate they know that they're behind on patches
But that's not important to them well if the market and government regulators failed to punish
poor security then they see no consequences for their
Lack of due diligence and keep doing what they've always done. I mean a case in point Equifax like spectrin meltdown had they been already
Publicly known at that time would have made no difference in that breach
No, because they were so incompetent that that was like the least of their possible worries
Yes, that would have that would have had no impact on them whatsoever. I mean they were already like wide open
So so I guess the bottom line is we we wrap out this little episode
For you is the fact that Specter monthon are serious
You need to take them seriously
But there are a lot of things that you could be doing in the meantime
that will help you against anyone who's trying to leverage them and in an attack against you and
That you know going into those and enlisting the law for you actually sounds like a really good episode that we could follow up on
but in the meantime pay attention to your patching and
When possible do so because these are vulnerabilities you really don't want to ignore a long term in the meantime
We'll see you next week. I'm Steve Reagan and this has been salted. Hash. Good night. Everybody good night. Yep
Good night. Good day. Good day. Good morning. Good. Oh I