Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

New Spectre Variants Add to Vulnerability Worries

Variants 3a and 4 build on the Spectre foundation, but how worried should enterprise security professionals really be?

The Spectre and Meltdown vulnerabilities hit the most basic level of computer hardware, striking the logical interface between instruction execution and cache. Intel and operating system publishers since have released patches to remediate these two issues but the problem with the CPU architecture remains, with the addition of new vulnerabilities disclosed this week.

The newly discovered Variants 3a and 4 are the latest speculative execution vulnerabilities in Intel (and presumably AMD, ARM, and other) CPUs. These side-channel attacks exploit vulnerabilities in the basic execution of the system rather than in any piece of software. That makes them both more involved to remediate, and perfect foundations for entire families of exploits and attacks.

These latest variations on the Spectre theme were disclosed by researchers from various organizations: Jann Horn of Google Project Zero (GPZ) and Ken Johnson of the Microsoft Security Response Center (MSRC) independently discovered Variant 4, while Zdenek Sojka, Rudolf Marek and Alex Zuepke from SYSGO AG, along with Innokentiy Sennovskiy from BiZone LLC, discovered and reported Variant 3a.

Variant 4 is interesting because it could be exploited in a language-based runtime environment. These environments are typically seen in languages that are interpreted or compiled at run-time — languages like JavaScript. In most cases, these environments are encountered in Web-based applications, which is both good and bad from a Spectre vulnerability perspective.

The downside of the equation is ubiquity: it would be difficult to find a computer without one or more Web browsers in a modern enterprise. The good news, however, is every major browser has already been updated to make Spectre and its family members unavailable to attackers.

Variant 4, if successfully exploited, could allow an attacker to see into memory and access information belonging to other programs, processes, and users. Variant 3a uses the same sort of technique to a different end; in this case, an attacker could get information on the system configuration and status rather than data from any particular user.

In the case of each new variant, the organizations with the most to worry about are the same: those in the cloud. "The original worries were, 'I get a $5 account on a virtual account and I can run my code but share memory with neighbors,'" says Tod Beardsley, research director of Rapid7. "It's a real problem for the Amazons or Digital Oceans of the world."

Large cloud or hosted service providers presumably have already applied the patches provided by Intel. The existing patches for existing exploits are not what concern experts, though.

"The fact that we are seeing a new derivative of the ... Spectre vulnerabilities is not surprising. Vulnerability exploits often come in series, as we've seen with WannaCry, and later on NotPetya, both used the same SMB vulnerability to rapidly propagate across organizations," says Oren Apir, CTO of Cyberbit.

And the derivatives of Spectre will continue to be a concern because they strike at a core factor in modern computer deployment.

"We as an industry have trained people to expect speed. In this case, the vulnerabilities take advantage of the very features that make them fast," says Renaud Deraison, co-founder and CTO of Tenable. "Intel optimized for performance and later learned they were facing a tradeoff between security and performance. The vast majority of people would choose speed over security, too."

Beardsley agrees that the market is driven by a need for speed, and prioritizing performance  concerns him when the conversation turns to remediating these vulnerabilities. 

"I did see an Intel write-up where they were working to ship a fix on this but it would be shipped default 'off,'" he says. "That's a really worrisome thing because it means that no one will apply the fix. In this class of bug, where you're trading performance for security."

Trading performance for security may work in this case because while the Spectre vulnerabilities are interesting and critical, they're not being widely used for system exploits: "I can get you to run my code just by asking nicely. I don't have to be this clever," Beardsley says, pointing out that phishing and other social engineering exploits are far more economical and effective than relatively sophisticated attacks like Spectre and its kin.

Both Aspir and Beardsley expect announcements of vulnerabilities based on the Spectre and Meltdown families to continue. They say Variants 5, 6, and beyond may already be in the hands of chip and operating system vendors, waiting for the expiration of the responsible disclosure period for widespread announcement.

Beardsley sees hope, though, in the rapid evolution of the exploits. "There are super-smart people looking at the issue," Beardsley says. "It's great that we have so much runway — good guys are finding these before bad guys are using them, at least that we know of. It gives me a good feeling that the good guys are ahead of things for a change."

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Navigating the Asia-Pacific Threat Landscape: Experts Dive In
Kelly Sheridan, Staff Editor, Dark Reading,  9/25/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26120
PUBLISHED: 2020-09-27
XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even witho...
CVE-2020-26121
PUBLISHED: 2020-09-27
An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an uploa...
CVE-2020-25812
PUBLISHED: 2020-09-27
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
CVE-2020-25813
PUBLISHED: 2020-09-27
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.
CVE-2020-25814
PUBLISHED: 2020-09-27
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> ...