Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Vulnerability Management

1/4/2019
03:35 PM

How Intel Has Responded to Spectre and Meltdown

In a newly published editorial and video, Intel details what specific actions it has taken in the wake of the discovery of the CPU vulnerabilities.
2 of 7

The Intel Product Assurance and Security (IPAS) Group
One of Intel's first public statements after the disclosure was its statement of a Security First Pledge. One of the ways in which it brought that pledge into the real world was through the creation of the Intel Product Assurance and Security Group.
In the statement announcing the creation of the group, its general manager, Leslie Culbertson, wrote, 'IPAS is designed to serve as a center of security excellence -- a sort of mission control -- that looks across all of Intel. Beyond addressing the security issues of today, we are looking longer-term at the evolving threat landscape and continuously improving product security in the years ahead.'
In its response to the speculative execution vulnerabilities, Intel has also increased its emphasis on security across all its product lines. It has created groups like STORM - the strategic offensive research and mitigation group, to conduct research on security across its chips and systems. In conducting its own offensive research, Intel is trying to move beyond points like those raised by Richard Ford, chief scientist at Forcepoint, who said that Intel (and other vendors) had found themselves creating ad hoc, point mitigations rather than long-term fixes. They were, he said, '...waiting until a researcher comes up with a new vulnerability of this type and responding to it, rather than trying to put an end to the entire line of vulnerabilities.'
(Image: Bru-n0 VIA Pixabay)

The Intel Product Assurance and Security (IPAS) Group

One of Intel's first public statements after the disclosure was its statement of a Security First Pledge. One of the ways in which it brought that pledge into the real world was through the creation of the Intel Product Assurance and Security Group.

In the statement announcing the creation of the group, its general manager, Leslie Culbertson, wrote, "IPAS is designed to serve as a center of security excellence - a sort of mission control - that looks across all of Intel. Beyond addressing the security issues of today, we are looking longer-term at the evolving threat landscape and continuously improving product security in the years ahead."

In its response to the speculative execution vulnerabilities, Intel has also increased its emphasis on security across all its product lines. It has created groups like STORM the strategic offensive research and mitigation group, to conduct research on security across its chips and systems. In conducting its own offensive research, Intel is trying to move beyond points like those raised by Richard Ford, chief scientist at Forcepoint, who said that Intel (and other vendors) had found themselves creating ad hoc, point mitigations rather than long-term fixes. They were, he said, "waiting until a researcher comes up with a new vulnerability of this type and responding to it, rather than trying to put an end to the entire line of vulnerabilities."

(Image: Bru-n0 VIA Pixabay)

2 of 7
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
How to Think Like a Hacker
Dr. Giovanni Vigna, Chief Technology Officer at Lastline,  10/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4031
PUBLISHED: 2019-10-16
IBM Workload Scheduler Distributed 9.2, 9.3, 9.4, and 9.5 contains a vulnerability that could allow a local user to write files as root in the file system, which could allow the attacker to gain root privileges. IBM X-Force ID: 155997.
CVE-2019-17626
PUBLISHED: 2019-10-16
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
CVE-2019-17627
PUBLISHED: 2019-10-16
The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This a...
CVE-2019-17625
PUBLISHED: 2019-10-16
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such...
CVE-2019-17624
PUBLISHED: 2019-10-16
In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 times, an attacker can cause a denial of service (application crash) or possibly have unspecified other impact.