New Attack Causes Scramble at AMD and Intel

An all new attack targeting CPUs has caused quite the stir, and raises questions about the security and stability of the largest, most popular commercial hardware companies.

Luckily the attack was created by a group of whitehat researchers from an organization called ETH Zurich - it isn’t out in the wild waiting to find and compromise your machine. That being said, the methods used could have been discovered by somebody with less pure intentions.

Retpoline and Spectre

The researchers exploited a weakness in the defense protocol called “Retpoline,” originally implemented to prevent something known as “Spectre,” exactly the kind of attack the researchers used.

They created their workaround with the intention of proving that Retpoline is not a sufficient defense, and seem to have proven their point.

How it works

Spectre, consisting of an entire class of attacks, functions by tricking a program into retrieving arbitrary locations in that program's memory. This is done through a complex exploitation of key vulnerabilities in optimizations done to make microprocessors run a little more smoothly.

To avoid getting too technical, special logic the processors use can be bent and pointed at unintended targets, grabbing and retrieving information anywhere on that machine.

Following the paper that introduced Spectre to the industry, Retpoline was created to mitigate and prevent such attacks from taking place. While people had pointed out that it wasn’t fully effective, such concerns were sidelined.

What the researchers proved was that the issue can no longer be ignored. Without going through too much effort, they were able to entirely circumvent the defenses, and access any information on a computer at will.

The Response

Both Intel and AMD have acknowledged that this weakness exists on all their most modern products, and is to be taken seriously.

Intel has already released tools to mitigate the issue, with AMD following suit.

Whether or not this will fully solve the problem remains to be seen. The attack is highly sophisticated and clever, and it’s possible that its different forms will continue to linger and pose a threat to machines the world over for years to come.