Security flaws put smartphones, laptops and other gadgets at risk of hacking

Security patches had already been shared with the chipmakers’ partners, which include many smartphone manufacturers. (Reuters)
Updated 04 January 2018
0

Security flaws put smartphones, laptops and other gadgets at risk of hacking

FRANKFURT/SAN FRANCISCO: Security researchers on Wednesday disclosed a set of security flaws that they said could let hackers steal sensitive information from nearly every modern computing device containing chips from Intel Corp, Advanced Micro Devices and ARM Holdings.
One of the bugs is specific to Intel but another affects laptops, desktop computers, smartphones, tablets and Internet servers alike. Intel and ARM insisted that the issue was not a design flaw, but it will require users to download a patch and update their operating system to fix.
“Phones, PCs, everything are going to have some impact, but it’ll vary from product to product,” Intel CEO Brian Krzanich said in an interview with CNBC Wednesday afternoon.
Researchers with Alphabet Inc’s Google Project Zero, in conjunction with academic and industry researchers from several countries, discovered two flaws.
The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.
The researchers said Apple and Microsoft had patches ready for users for desktop computers affected by Meltdown. Microsoft declined to comment and Apple did not immediately return requests for comment.
Daniel Gruss, one of the researchers at Graz University of Technology who discovered Meltdown, called it “probably one of the worst CPU bugs ever found” in an interview with Reuters.
Gruss said Meltdown was the more serious problem in the short term but could be decisively stopped with software patches. Spectre, the broader bug that applies to nearly all computing devices, is harder for hackers to take advantage of but less easily patched and will be a bigger problem in the long term, he said.
Speaking on CNBC, Intel’s Krzanich said Google researchers told Intel of the flaws “a while ago” and that Intel had been testing fixes that device makers who use its chips will push out next week. Before the problems became public, Google on its blog said Intel and others planned to disclose the issues on Jan. 9. Google said it informed the affected companies about the “Spectre” flaw on June 1, 2017 and reported the “Meltdown” flaw after the first flaw but before July 28, 2017.
The flaws were first reported by tech publication The Register. It also reported that the updates to fix the problems could causes Intel chips to operate 5 percent to 30 percent more slowly.
Intel denied that the patches would bog down computers based on Intel chips.
“Intel has begun providing software and firmware updates to mitigate these exploits,” Intel said in a statement. “Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”
ARM spokesman Phil Hughes said that patches had already been shared with the companies’ partners, which include many smartphone manufacturers.
“This method only works if a certain type of malicious code is already running on a device and could at worst result in small pieces of data being accessed from privileged memory,” Hughes said in an email.
AMD chips are also affected by at least one variant of a set of security flaws but that it can be patched with a software update. The company said it believes there “is near zero risk to AMD products at this time.”
Google said in a blog post that Android phones running the latest security updates are protected, as are its own Nexus and Pixel phones with the latest security updates. Gmail users do not need to take any additional action to protect themselves, but users of its Chromebooks, Chrome web browser and many of its Google Cloud services will need to install updates.
Amazon Web Services, a cloud computing service used by businesses, said that most of its Internet servers were already patched and the rest were in the process of being patched.
The defect affects the so-called kernel memory on Intel x86 processor chips manufactured over the past decade, The Register reported citing unnamed programmers, allowing users of normal applications to discern the layout or content of protected areas on the chips.
That could make it possible for hackers to exploit other security bugs or, worse, expose secure information such as passwords, thus compromising individual computers or even entire server networks.
Dan Guido, chief executive of cybersecurity consulting firm Trail of Bits, said that businesses should quickly move to update vulnerable systems, saying he expects hackers to quickly develop code they can use to launch attacks that exploit the vulnerabilities. “Exploits for these bugs will be added to hacker’s standard toolkits,” said Guido.
Shares in Intel were down by 3.4 percent following the report but nudged back up 1.2 percent to $44.70 in after-hours trading while shares in AMD were up 1 percent to $11.77, shedding many of the gains they had made earlier in the day when reports suggested its chips were not affected.
It was not immediately clear whether Intel would face any significant financial liability arising from the reported flaw.
“The current Intel problem, if true, would likely not require CPU replacement in our opinion. However the situation is fluid,” Hans Mosesmann of Rosenblatt Securities in New York said in a note, adding it could hurt the company’s reputation.


Microsoft urges regulation of face-recognizing tech

Updated 15 July 2018
0

Microsoft urges regulation of face-recognizing tech

  • Microsoft and other tech companies have used facial recognition technology for years for tasks such as organizing digital photographs
  • While the technology can be used for good, perhaps finding missing children or known terrorists, it can also be abused

SAN FRANCISCO: Microsoft’s chief legal officer on Friday called for regulation of facial recognition technology due to the risk to privacy and human rights.
Brad Smith made a case for a government initiative to lay out rules for proper use of facial recognition technology, with input from a bipartisan and expert commission.
Facial recognition technology raises significant human rights and privacy concerns, Smith said in a blog post.
“Imagine a government tracking everywhere you walked over the past month without your permission or knowledge,” he said.
“Imagine a database of everyone who attended a political rally that constitutes the very essence of free speech.”
It could become possible for businesses to track visitors or customers, using what they see for decisions regarding credit scores, lending decisions, or employment opportunities without telling people.
He said scenarios portrayed in fictional films such as “Minority Report,” “Enemy of the State,” and even the George Orwell dystopian classic “1984” are “on the verge of becoming possible.”
“These issues heighten responsibility for tech companies that create these products,” Smith said.
“In our view, they also call for thoughtful government regulation and for the development of norms around acceptable uses.”
Microsoft and other tech companies have used facial recognition technology for years for tasks such as organizing digital photographs.
But the ability of computers to recognize people’s faces is improving rapidly, along with the ubiquity of cameras and the power of computing hosted in the Internet cloud to figure out identities in real time.
While the technology can be used for good, perhaps finding missing children or known terrorists, it can also be abused.
“It may seem unusual for a company to ask for government regulation of its products, but there are many markets where thoughtful regulation contributes to a healthier dynamic for consumers and producers alike,” Smith said.
“It seems especially important to pursue thoughtful government regulation of facial recognition technology, given its broad societal ramifications and potential for abuse.”
Concerns about misuse prompted Microsoft to “move deliberately” with facial recognition consulting or contracting, according to Smith.
“This has led us to turn down some customer requests for deployments of this service where we’ve concluded that there are greater human rights risks,” Smith said.