Spook.js attack bypasses Strict Site Isolation in Chrome to steal passwords
Security researchers from a collection of US and international universities have revealed details of Spook.js, a worrying transient execution side channel attack that can be used to bypass Chrome's Strict Site Isolation.
Rolled out by Google in response to the Spectre security flaw, Strict Site Isolation is supposed to prevent unauthorized data theft. But the researchers found that malicious JavaScript code can be used to grab data -- such as passwords -- from other tabs. The attack has been found to affect Intel processors and Apple devices with M1 chips; AMD chips are also thought to be at risk, but this is yet to be fully demonstrated.
Microsoft quietly fixes SWAPGS processor vulnerability to protect Windows users
It has been revealed that Microsoft silently pushed out a patch to Windows users to fix a vulnerability that affected Intel CPUs produced since 2012 -- which means everything post Ivy Bridge chips.
The SWAPGS vulnerability is similar to the now-famous Spectre and Meltdown chip flaws, and was discovered by security firm Bitdefender a year ago; the fact that it has now been patched was only revealed at the BlackHat security conference. Red Hat says that an update to the Linux kernel is needed to protect against the flaw which it says affects both Intel and AMD chips, although Bitdefender has not been able to find any issues with AMD's processors.
How to check if your Windows or Linux system is vulnerable to Microarchitectural Data Sampling (MDS) attacks
Intel yesterday disclosed a new group of Microarchitectural Data Sampling (MDS) hardware vulnerabilities that affect its CPUs.
Rogue In-Flight Data Load (RIDL), Fallout, and ZombieLoad speculative execution attacks are related to Spectre and Meltdown which were discovered last year, and allow attackers to leak in-flight data from CPU-internal buffers (Line Fill Buffers, Load Ports, Store Buffers), including data never stored in CPU caches.
Speed up Windows 10 with the Retpoline Spectre fix
It's been a while since we heard much about Spectre, the speculative execution exploit that sent the security world into a frenzy. Cast your mind back a little while and you'll probably remember that the various fixes that were produced to mitigate against the exploits all had one thing in common -- they resulted in a performance hit.
To help address the reduced performance experienced on older AMD and Intel systems, a new mitigation technique called Retpoline was developed. This new Spectre patch is currently included in Insider builds of Windows 10, but you can install it and enable it right now -- regardless of whether you are signed up for the Insider program -- and enjoy a speed boost for your computer.
Security researchers discover seven more speculative execution attacks like Spectre and Meltdown
One of the biggest security stories of 2018 has been the discovery of the Meltdown and Spectre chip flaws. Known as speculative execution exploits, the flaws make it possible to steal potentially sensitive information and there has been an on-going battle to issue patches wherever possible.
Just as things were starting to die down a little, security researchers have revealed details of no fewer than seven more speculative execution attacks. While some of these attack vectors have already been mitigated against, this is not the case for all of them.
Chrome's RAM usage is higher than ever as Google introduces Site Isolation to fight Spectre
Google's Chrome browser may be popular, but you'll find a lot of its users complain about high memory usage. With Chrome 67, things just got even worse.
If you've noticed that Chrome on the desktop is using more RAM, you're not imagining it. Google has enabled a Site Isolation feature in Windows, Mac, Linux and Chrome OS to help mitigate against the Spectre vulnerability -- and it's a bit memory-hungry.
New Spectre 1.1 and Spectre 1.2 CPU vulnerabilities exposed
It seems that the Spectre and Meltdown vulnerabilities saga is never-ending, and now there are two new related CPU flaws to add to the mix. Dubbed Spectre 1.1 and Spectre 1.2, the vulnerabilities (CVE-2018-3693) exploit speculative execution and can modify data and bypass sandboxes.
Two security researchers have disclosed details of the new vulnerabilities, both of which have the potential to leak sensitive data. By tinkering with the speculative execution processes of Intel and ARM CPUs, it would be possible to use malicious code to extract information such as passwords and crypto keys.
Researchers develop SafeSpec to overcome vulnerabilities like Spectre and Meltdown
Computer scientists from the University of California, the College of William and Mary, and Binghamton University have published a paper detailing a new "design principle" that avoids speculative execution vulnerabilities.
Researchers says that the SafeSpec model supports "speculation in a way that is immune to the sidechannel leakage necessary for attacks such as Meltdown and Spectre". Importantly, the design also avoids the problems associated with other Meltdown/Spectre fixes.
Red Hat responds to Speculative Store Bypass and helps explain Variant 4 chip vulnerability
As news of yet another chip vulnerability creeps out, computer users, businesses and organizations around the world are trying to assess how the latest bug affects them. To help its users and others to understand what the Speculative Store Bypass/Variant 4 vulnerability means, Red Hat has issued advisories and an explanatory video.
The company also reveals exactly which of its Linux builds are affected by the security flaw and what steps can be taken as mitigation. In addition to this, Red Hat has put together a number of resources that help to "provide more context around this vulnerability from an open source technology perspective".
Spectre and Meltdown variant 4: Microsoft, Google and Intel reveal new Speculative Store Bypass chip vulnerability
Just when you thought you could forget about the Spectre and Meltdown chip vulnerabilities, yet another variant has been discovered. Known as Speculative Store Bypass, the vulnerability affects chips from AMD and Intel, as well as Power 8, Power 9 and System z processors.
The vulnerability has been assigned CVE-2018-3639, and successful exploitation would mean that an attacker could gain access to data. The attack can be carried out through a "language-based runtime environment" such as JavaScript. Some patches exist while others are in development, and they include the same performance hit associated with patches for the previous vulnerabilities.
Intel: some processors will never receive Meltdown and Spectre patches
With little fanfare, Intel has revealed that some processors will simply never receive microcode updates that will patch against the Meltdown and Spectre vulnerabilities.
In a document entitled Microcode Revision Guidelines, the chip-maker says that a wide range of processor families -- equating to over 200 CPUs -- will not receive any more updates. While the majority of the affected chips were on sale between 2007 and 2011, it's safe to assume that a large proportion of them are still in use, meaning that a lot of systems will remain unprotected.
AMD admits to new batch of critical processor flaws and promises fixes
AMD has confirmed that some of its processors contain vulnerabilities after they were found by CTS Labs researchers. In all, 13 critical flaws were found, including RyzenFall, MasterKey, Fallout and Chimera. They affect a range of AMD products.
The flaws are not dissimilar to the previous Meltdown/Spectre vulnerabilities, and CTS Labs gave AMD just 24 hours' notice before going public. The chipmaker says that patches are on the way, and tries to suggest that the vulnerabilities are not a cause for major concern.
Microsoft launches bounty program for speculative execution side channel vulnerabilities
Microsoft has launched a bug bounty program that will reward anyone who finds the next Meltdown or Spectre vulnerability. Known as speculative execution side channel vulnerabilities, Microsoft is willing to reward anyone who reports bugs that could cause problems like earlier in the year.
The rewards on offer range from $5,000 up to $250,000 depending on the severity of the vulnerability, and the bounty program runs until the end of 2018. Microsoft says that it will operate under the principles of coordinated vulnerability disclosure.
Microsoft removes AV compatibility requirements for Windows 10 security updates
In the fallout from the revelations about the Spectre and Meltdown vulnerabilities -- and the ensuing chaos relating to patches for the security problems -- Microsoft blocked security updates for Windows 10 users with antivirus software whose compatibility with patches was not known.
Two months after making this decision, Microsoft has changed course and said that updates can roll out to everyone once again. The company says this is a result of working with antivirus partners and patches should no longer lead to problems in most cases.
Microsoft details steps being taken to address Spectre and Meltdown vulnerabilities
The Spectre and Meltdown vulnerabilities affected millions of processors around the world, and the "fixes" that followed compounded the problems with reports of the patches bricking AMD PCs, and Ubuntu systems, and causing major slowdowns. Intel even told customers to stop installing the patches due to 'unpredictable' reboot issues.
In a new blog post, Microsoft provides an update on the state of the situation, and has some good news for Windows 1o users.
Recent Headlines
BetaNews, your source for breaking tech news, reviews, and in-depth reporting since 1998.
© 1998-2025 BetaNews, Inc. All Rights Reserved. About Us - Privacy Policy - Cookie Policy - Sitemap.