Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Intel Says to Stop Applying Problematic Spectre, Meltdown Patch
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
1/24/2018 | 9:48:30 PM
Re: What's the score?
@Brian: Well, sure, technically, it is the awareness of an issue that presents a problem more directly than the problem itself. Scrodinger's Vulnerability, I suppose.

But, of course, for all anyone knows, the vulnerability has already been exploited in the wild (and, if so, very possibly even by nation-state actors, who would probably be the best poised to have known about the vulnerability and have done so -- especially without you finding out about it).

Sure, good coordination has to go into vulnerabilty announcements and patch processes, but because this particular vulnerability is so disastrous and severe, it would be hard for much of the population to not take a Chicken Little approach here. It's a pretty bad vulnerability.
BrianN060
50%
50%
BrianN060,
 User Rank: Ninja
1/24/2018 | 12:38:29 AM
Re: What's the score?
@Joe: "The chaos stems more from the fact of the existence of the vulnerability." From the existence, or the manner of itheir being made public?  The vulnerabilities (or the design decisions which would become vulnerabilities once cyber-technologies and use patterns would make them such), existed for decades.  Not being an insider, I only became aware of the issue with the media disclosure (and via sites like DR).  That's when the chaos began.

I wasn't talking about balancing likelihood against severity (akin to gambling, in my opinion), but the realized cost of the uncoordinated efforts at mitigation, against as yet unobserved exploitation.  It didn't have to play out like this. 

To your other points: agreed - the bungled and disjointed patches and updates are unfortunate, for the reasons you mentioned. 

Your comments @Ryan: also agreed - a holistic approach is required; especially as attacks become more sophisticated and use multiple vectors. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
1/23/2018 | 11:10:08 PM
Patches beget patches
This is grossly unfortunate because the very reason many people are wary of updates that are non-security or partial-security related is because of severe bugs that are usually hiding in a rushed rollout (q.v. iOS). To see this in the strictly security patch context where the severity is so high is particularly disheartening and may cause people to take the issue less seriously, I wonder.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
1/23/2018 | 11:08:16 PM
Re: What's the score?
@Ryan: Yeah, but the thing is that many attacks really are "insider attacks" because even so many "outsider" attacks require compromising "insider" credentials. So it's a matter of treating this holistically and in depth as opposed to an "M&M security" approach (hard on the outside, soft in the middle).
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
1/23/2018 | 11:06:31 PM
Re: What's the score?
@Brian: The chaos stems more from the fact of the existence of the vulnerability. I'm not really sure that the question is well-founded given that the flaw is desperately serious.

Sure, risk management is all about assessing likelihood just as well as severity, but in this case severity is so high that it overshadows any probability rating that any accepted threat model could slap on it.
RyanSepe
50%
50%
RyanSepe,
 User Rank: Ninja
1/23/2018 | 8:20:21 AM
Re: What's the score?
That's a good question that I would be interested in as well. Although this vulnerability affects a majority of devices the greatest risk, outside of affected DMZ devices, are users already inside of your network. Essentially it allows for persistent listeners to take advantage of an easy exploit when it may have taken them a while to figure out how to traverse the network.
BrianN060
50%
50%
BrianN060,
 User Rank: Ninja
1/23/2018 | 1:10:27 AM
What's the score?
The DR staff are better informed than I am; but has any of the cost and chaos of Meltdown/Spectre mitigation yet been shown to have thwarted a single attempted explotation?  Put another way, have those that haven't bothered to lift a finger to prevent M/S exploitation paid the price for their indifference?  One more question: how would you rate the handling of the M/S issue, from first discovery of the vulnerabilities, to the press leaks, public announcement, vendor reaction and community response - so far?


Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industry’s conventional wisdom. Here’s a look at what they’re thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18980
PUBLISHED: 2019-11-14
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The o...
CVE-2019-17391
PUBLISHED: 2019-11-14
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and sec...
CVE-2019-18651
PUBLISHED: 2019-11-14
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document to a user that the website trusts. The user needs to have ...
CVE-2019-18978
PUBLISHED: 2019-11-14
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
CVE-2019-14678
PUBLISHED: 2019-11-14
SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects t...