Meltdown and Spectre — these two CPU security flaws are stirring up the whole tech industry because of the severe damage they can cause.
Virtually any device out there is vulnerable to the pair, including but not limited to Macs, iPhones, iPads, and Android tablets and phones. Now the dangerous part is they can steal sensitive data by way of a side-channel analysis attack. That essentially means hackers can access info stored in the kernel memory, which is a protected area of the CPU that's supposedly secure.
Researcher Michael Schwarz demonstrated how Meltdown could steal passwords on a Linux machine, giving a good idea of how the flaws can be exploited.
Using #Meltdown to steal passwords in real time #intelbug #kaiser #kpti /cc @mlqxyz @lavados @StefanMangard @yuvalyarom https://t.co/gX4CxfL1Ax pic.twitter.com/JbEvQSQraP
— Michael Schwarz (@misc0110) January 4, 2018
Luckily, there are a couple of measures you can take to stay safe from Meltdown and Spectre, but on the other side of the coin, you can't really be invulnerable to them. In other words, you'll only be safer more or less, but needless to say, that's better than nothing.
Update Your Operating System
First things first, update your OS as soon as you can. That's because Intel processors "since 1995" are vulnerable to Meltdown, according to Google researchers. Out of the two flaws, Meltdown is worse, though it affects only Intel machines.
Now if you're on Windows, all you have to do is head on over to Settings > Update & Security > Windows Update and hit "Check for updates." You should see the KB4056892 patch there, but if you can't for some reason, you can download it manually from Microsoft's Update Catalog.
Make sure you download the right version, whether it's 32-bit (x86) or 64-bit (x64). To check which version your PC needs, you can fire up File Explorer, right-click on This PC, and click on Properties. You should see the system type there. Alternatively, you can search for "system," open System Information, and look for your System Type there.
As for Mac users, your machine should have a first line of defense of sorts already since Apple rolled out countermeasures against Meltdown in macOS 10.13.2. You can make sure it's up-to-date via the App Store under Update. The Cupertino brand also launched iOS 11.2 and tvOS 11.2 alongside it and assured users that the Apple Watch isn't affected.
Meanwhile, Google launched Chrome OS 63 with protections in December, so Chromebooks should be safe as well.
Last but not least, Linux users can already download kernel fixes.
This comes at a cost, and the price to pay here is that updates will slow down computers. Still, it's arguably better to have a bogged-down PC rather than a compromised one.
Phones, tablets, and other mobile device users will have to check for an update through the settings if they haven't been prompted that a new patch is rarin' to go.
Update Your Browser
Another way to steer clear of the flaws is to update your browser.
The latest versions of Internet Explorer and Edge that came with the Windows 10 update should have mitigations against Spectre, and so does Firefox 57.
Google will launch a fix with Chrome 64 on Jan. 23, while Apple says it'll release a patch for Safari "in the coming days."
Update Your Firmware
Intel has been up and about in releasing firmware updates for its processors, rolling out a detection tool that can tell you whether you need an update or not.
"Intel has already issued updates for the majority of processor products introduced within the past five years. By the end of next week, Intel expects to have issued updates for more than 90 percent of processor products introduced within the past five years," the company said.
Take note that you'll likely need to get the firmware update from your machine's manufacturer, which could be Asus, Dell, or HP, to name three. Intel has a handy list of its partners to help you with that.
Make Sure Your Antivirus Is On
The last countermeasure you can take is to keep your antivirus software updated and on.
While Google researchers have said that it's unlikely to detect or block Meltdown and Spectre, "your antivirus may detect malware which uses the attacks by comparing binaries after they become known," so there's that.
