So, I don't know how much of this you know, but these two attacks, Meltdown and Spectre, are really serious. We have been working non-stop to secure each and every one of our customers against these breaches, as well as the thousands of other attacks that we fend off every day. We are patching our servers in real-time to ensure that your information is secure, but there may be occasional downtime for this. We are working to keep that as much off-peak as possible, but when we find an intrusion, we have to attack it quickly. Just know that we are doing everything in our power to give you the same service that High Level Studios has always provided. Thank you for your patience. Here's a bit more information on the attacks and how they can affect you.
Meltdown and Spectre attacks
A new class of side-channel attacks have been appeared, which exploit the following CPU vulnerabilities:
- CVE-2017-5715: branch target injection
- CVE-2017-5753: bounds check bypass
- CVE-2017-5754: rogue data cache load
Meltdown and Spectre rely on them and allow the hackers to read the memory content of other programs, it means they can access the stored sensitive data like passwords, photos, emails, secret documents, etc.
The original coordinated disclosure date of this issue was planned for January 9, but the issue became public 6 days earlier.
Both are side effect attacks, but there’s a bit difference between them
Memory isolation is the basis of the security on computers. It prevents that different user applications can access each other’s memories and read/write the kernel memory. meltdown zero day vulnerabilityThat’s why multiple users can use one single machine safely.
Meltdown breaks this isolation and gives a single way to read the kernel memory (from user space), including all the secrets in it. It doesn’t exploit any software vulnerabilities, so it doesn’t matter what kind of operating system are you using.
The biggest strength of Meltdown is the side effects caused by out-of-order execution*.
* It’s an optimization technique for maximizing the utilization of all execution units of a CPU core as exhaustive as possible.
CVE-2017-5715 and CVE-2017-5753
This attack induces the processor with branch prediction for achieving speculatively executing* instructions, which shouldn’t have occurred during a correct program execution. This way, the information of the victim’s memory can be leaked.
Spectre attack can work on non-Intel processors too, such as AMD and ARM processors.
For the hackers, this technique is more difficult but also harder to mitigate it. Unfortunately, KAISER patch cannot protect against them.
*It’s a technique to increase the performance of the high-speed processors.
No one is safe
To the server owners, we raise the attention to do everything you can in order to take care of your servers’ security, as there are no patches for Ubuntu and Debian yet, only for the following distros *:
SUSE also released patches for most recent SUSE Linux Enterprise (SLE) versions yesterday.