Vulnerabilities / Threats

1/25/2018
10:30 AM
Richard Ford
Richard Ford
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Meltdown & Spectre: Computing's 'Unsafe at Any Speed' Problem

Ralph Nader's book shook up the automotive world over 50 years ago. It's time to take a similar look at computer security.

Back in 1965, a young Ralph Nader wrote an evisceration of the US auto industry. This book, Unsafe at Any Speed, attacked the industry for lagging behind best practices with respect to safety — essentially, carmakers were putting the public at risk by their reluctance to invest in safety features. It's hard to believe that over 50 years have passed since then, but at the opening of 2018, and as we deal with serious security and safety issues in the computer world, I've been reflecting on the situation in which we found ourselves half a century ago.

What's triggered this reflection is the rotten start of this year, with the revelation of Spectre and Meltdown, two serious vulnerabilities that between them impact most modern computers. The newspapers and Web have been full of descriptions, and yes, these bugs are as unpleasant as they sound. Unlike most of the things we read about, these represent problems in the actual hardware, so there's no simple software patch that makes everything better. These are not problems that involve a programmer forgetting to check the size of an array; these are problems in the very "brain" of the computer, the CPU.

As chief scientist for a large security company, I'm pretty immune to hype and spin: I deal in realities. As such, I recently gave a company-wide tutorial on these two vulnerabilities (and, really, they involve a class of vulnerabilities rather than discrete things). There's nothing like having to teach how something works to test that you really understand it. In the case of these bugs, I understand them all too well: these are nasty little side-channel attacks that allow the slow leak of data to an attacker.

Let me be technical for a moment. These problems exist and are exploitable because of a few features of the chip: the translation lookaside buffer and memory caching in general (used to make memory access much quicker), speculative and out-of-order execution (used to make the CPU execute a set of instructions more quickly), and, in the case of one version of Spectre, JIT, or just-in-time compilation (used to make interpreted code run more quickly). When I put it like this, do you see a pattern? I do. These are all related to steps we've taken to speed up computing. I get it — people buy CPUs because this year's model is a shade faster than the one they have. Speed good. Lag bad. Features, especially speed, sell.

Computers have moved from an adjacent spot in our lives (I remember my first computer, on which I mostly played Elite, a space trading game) and have become machines that literally are responsible for helping to keep us alive. My cellphone is with me at all times, a computer applies the brakes in my car, my thermostat happily interacts with servers on the Internet to let me know what the weather outside is, and the lights literally stay on because of modern computation. And it's not just me — the entire modern world is based upon secure, safe, reliable computing. There is not one aspect of our lives, from birth to death, that doesn't rely on the magic of computation.

These new vulnerabilities should remind us that the foundation that technologically enables our society is cracked. We have focused on performance, on glitz… more pixels, a couple more gigahertz, animated emojis. The list is endless. But what we haven't done, outside of a woefully small group of people who make security their life's work, is put the safety of that complex, beautiful system ahead of its glitter. I'm picking my words with care — security sounds abstract and cold, but we all "get" what it means to make something safe and what the consequence of something being unsafe can be.

I am in awe at the advances we have made in computation. During my career, I've gone from hand-coding a machine that ran at 3.25MHz and had a whopping 1KB (!) of memory. By way of contrast 30-something years later, my home laptop works away almost 1,000 times faster per core (and it has several of them) and with seven orders of magnitude more memory available. I can deploy cloud services with a wave of my hand, commanding more computation than I ever dreamed. What we have done is amazing. We should look at those accomplishments with pride. We should also look at the lack of attention we have put into security, at the design stage, with dread: without this infrastructure being secure, it means nothing.

My wish, though made with little hope, is that Spectre and Meltdown will be a wake-up call for all of us. For too long, security has been placed second or worse to features and performance. This must change if we are to really realize the benefits that computation can bring to mankind. I don't blame the vendors here, but the entire ecosystem. Security and safety typically haven't been drivers for purchases in IT, and companies can't be blamed for making products that sell. Somehow, this must change.

Ralph Nader's Unsafe at any Speed shook up the automotive world over 50 years ago. Perhaps it's time to apply those same concepts to computation. I don't want to be unsafe at any speed. No matter how fast my computer, if I can't trust it, it's less than worthless — it's downright dangerous. 

Related Content:

Dr. Richard Ford is the chief scientist for Forcepoint, overseeing technical direction and innovation throughout the business. He brings over 25 years' experience in computer security, with knowledge in both offensive and defensive technology solutions. During his career, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
moralesaugusto
100%
0%
moralesaugusto,
User Rank: Apprentice
1/26/2018 | 10:34:37 AM
Excellent post!
You have highlighted a problem barely spoken in IT community: security and design
RFordOnSecurity
50%
50%
RFordOnSecurity,
User Rank: Author
1/26/2018 | 11:14:41 AM
Re: Excellent post!
Thank you. Yes, we tend to treat security as an afterthought or place it *after* performance needs. We have to make security a part of every MVP discussion we have at design time. 
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
1/26/2018 | 4:59:58 PM
Re: Excellent post!
Agreed. This is one of the many reasons I pine for the days of MS-DOS and logging in to local BBS's with Windows Terminal or some such program.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
1/26/2018 | 5:04:51 PM
Re: Excellent post!
@RFord: One of the fundamental problems underlying this is that we don't treat security as a feature -- the way the automakers have evolved to the point that they now treat safety as a feature (or, at least, attempt to).
RFordOnSecurity
50%
50%
RFordOnSecurity,
User Rank: Author
1/26/2018 | 5:34:07 PM
Re: Excellent post!
Yes, I agree. Part of the problem though is the *buyer* doesn't treat security as a feature - if I offered a more secure machine with a 10% performance penalty, I think I'd get hurt when compared to that less secure machine that's full speed! One of the challenges in the ecosystem is that vendors will continue to make the most competitive product they can, and until that's pushed toward more security by dollars spent, it'll (arguably rightly (!!!)) sit on the back burner.
RFordOnSecurity
50%
50%
RFordOnSecurity,
User Rank: Author
1/26/2018 | 5:37:25 PM
Re: Excellent post!
I read a very interesting article (the link of which I will look up when on a different machine) that compared the latency of these older machines and found, quite surprisingly, that CPU speed is no predictor of UI lag. And with that, I'll now start up my old DOS machine and try and play NIBBLES, which is *unplayably* fast now. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/27/2018 | 11:17:07 PM
Re: Excellent post!
@RFord: It's about branding. You get a Nader-like campaign for cybersecurity, and a product vendor can become the "Volvo" or "luxury SUV" of software or hardware.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
1/27/2018 | 11:19:12 PM
Re: Excellent post!
@RFord: Don't even get me started on lag when it comes to online services these days. With ads, widgets, and all other manner of frills and nonsense, there are websites that load like a frame-heavy Geocities site 20 years ago. (And even with good blocking and filtering, the blocking and filtering takes time -- sometimes, depending upon what it is, more time than if you just let the greyware tracking widget load properly.)
zcobb
100%
0%
zcobb,
User Rank: Apprentice
1/30/2018 | 6:23:24 PM
Fine article, possibly over-optimistic?
Trust Dr. Ford to find a cool historical analogy for the current crisis in computing. While I agree wholeheartedly with the sentiments of the article, I think the current state of digital technology may be even more dire than the state of the US automobile industry in the last century.

While Nader very admirably sought to reduce death and injury from poor automobile design choices, the bigger danger, over time, has been our increased reliance upon those automobiles and the fossil fuels they burn. The unchecked ascendency of the automobile turned out to be really bad for the health of humans and the planet on which they live.

Right now, the processes by which we are creating and deploying hardware and software are simply not a sound basis for a headlong rush into a world of AIs and self-driving cars, blockchained-everything and algorithmic data feeds. IMHO, digital technology needs to take a time out and get its act together, before the unforeseen consequences of its flimsy foundations give way and plunge us into disaster.
RFordOnSecurity
50%
50%
RFordOnSecurity,
User Rank: Author
2/5/2018 | 11:37:43 AM
Re: Fine article, possibly over-optimistic?
Well, yes. I think we MIGHT be at an inflection point. It's up to us to take it. I do agree that there is significant risk that this is not enough of a jolt for us to really change though. We'll shrug it off until the next time. That's why it's so important for professioanls (like you!) to step up and really try and make our voices heard. I'm there with you - need to change the game!
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.