An all new attack targeting CPUs has caused quite the stir, and raises questions about the security and stability of the largest, most popular commercial hardware companies.
Luckily the attack was created by a group of whitehat researchers from an organization called ETH Zurich - it isn’t out in the wild waiting to find and compromise your machine. That being said, the methods used could have been discovered by somebody with less pure intentions.
The researchers exploited a weakness in the defense protocol called “Retpoline,” originally implemented to prevent something known as “Spectre,” exactly the kind of attack the researchers used.
They created their workaround with the intention of proving that Retpoline is not a sufficient defense, and seem to have proven their point.
Spectre, consisting of an entire class of attacks, functions by tricking a program into retrieving arbitrary locations in that program's memory. This is done through a complex exploitation of key vulnerabilities in optimizations done to make microprocessors run a little more smoothly.
To avoid getting too technical, special logic the processors use can be bent and pointed at unintended targets, grabbing and retrieving information anywhere on that machine.
Following the paper that introduced Spectre to the industry, Retpoline was created to mitigate and prevent such attacks from taking place. While people had pointed out that it wasn’t fully effective, such concerns were sidelined.
What the researchers proved was that the issue can no longer be ignored. Without going through too much effort, they were able to entirely circumvent the defenses, and access any information on a computer at will.
Both Intel and AMD have acknowledged that this weakness exists on all their most modern products, and is to be taken seriously.
Whether or not this will fully solve the problem remains to be seen. The attack is highly sophisticated and clever, and it’s possible that its different forms will continue to linger and pose a threat to machines the world over for years to come.