Another day, another major security flaw revealed in processors Intel – and very similar to vulnerabilities «Specter» and «Meltdown», discovered last year.
How did you bring TechCrunch, the new fault, called «ZombieLoad», allows attackers to use processor vulnerabilities to spy on and capture machine information, such as websites accessed, passwords, secret codes, messages and personal data. All Intel processors from 2011 onwards are affected by the breach, but ARM chips don’t suffer from the same flaw – so the A-series processors, which equip iPhones and iPads, are safe.
Regarding the vulnerability itself, it takes advantage of flaws previously exploited by the Specter and at Meltdown – whose operation we have already explained in this article. It is, roughly speaking, a technique that uses malicious programs which take advantage of the process of speculative execution of processors (used to improve performance and data processing time) to capture processes not related to the program itself, but the entire system.
The video below shows the vulnerability being exploited in a proof of concept – note how all user activity on the browser is readily recorded in the side window:
Fixes on the way
Several operating systems have already issued updates that address the vulnerability. THE macOS Mojave 10.14.5, released yesterday, is already immune to the problem; security updates have been released in parallel for users who are still on macOS Sierra and High Sierra. Google and Microsoft have also released updates.
This Apple support page further explains the actions taken to address the vulnerability. According to the company, the update corrects several of the loopholes that made the ZombieLoad possible, but not all of them; there is, however, a “total mitigation” option that can be activated through the Terminal which, as a side effect, can compromise machine performance by up to 40%.
Apple points out that its standard patches, included in the latest updates, completely protect “ordinary” macOS users. The company only recommends that high-risk users or those using unauthorized software make the option for “total mitigation” – for those who want to do so, a tutorial has been made available on this other support page.
Therefore, the tip remains the same as always: keep your systems up to date and adopt sensible navigation practices – with that, you will hardly ever deal with problems at any time.
via AppleInsider
