By Sreeraj Gopinathan, Head of Threat Anticipation Services at PaladionConsider yourself warned: There is a new threat blowing up in the news, and it\u2019s capable of exploiting most computing devices in operation today.<\/p>\n
The threat is named NetSpectre, and it\u2019s critical that you take a few minutes to learn a little more about it\u2014and how you can prevent it from infiltrating your organization.<\/p>\n
What is NetSpectre?<\/p>\n
Recently discovered by a team of security researchers, NetSpectre is a variant on the new Spectre family of attacks.<\/p>\n
Spectre attacks take advantage of a chip feature called \u201cspeculative execution\u201d. Speculative execution was originally designed to improve CPU performance. But cyber criminals have developed a way to exploit this feature. Now, cyber criminals can develop Spectre attacks that exploit this feature, and trick computers into leaking sensitive information. <\/p>\n
First, nearly every modern computing device is vulnerable to them. The speculative execution feature that they exploit is found in Intel, AMD, and ARM chips. These chips are present in computers, mobile devices, cloud servers, and almost any other device you can think of that has been produced since 1995.<\/p>\n
Second, while Spectre attacks can potentially be patched, they may not be able to be solved via software improvements alone. To fully mitigate this exploit, it is likely you need to change a device\u2019s processor architecture, at the hardware level.<\/p>\n
Earlier versions of Spectre attacks were dangerous enough. But now NetSpectre has emerged, and it carries with it a new feature that suggests Spectre attacks are about to become even more dangerous than they originally appeared.<\/p>\n
What Makes NetSpectre So Dangerous?<\/p>\n
On the surface, NetSpectre operates like many other Spectre attacks. As The Hacker News explains, with NetSpectre, a cyber criminal can, \u201cwrite and execute malicious code\u2026 to extract data from a previously-secured CPU memory,\u201d giving that attacker access to \u201cpasswords, cryptographic keys, and other sensitive information\u201d.Now, previously-known variants of Spectre attacks had a limitation: the attacker needed to get the victim to first download and execute malware onto their computer, or to access an insecure website that was running malicious JavaScript, before they were able to launch their Spectre attack. But NetSpectre does not share this limitation.<\/p>\n
NetSpectre can be launched over a network, which includes LANs and between virtual machines in Google\u2019s Cloud. As Bleeping Computer explains, NetSpectre, \u201ccan simply bombard a computer\u2019s network ports and achieve the same results, \u201cas previous, more involved Spectre attacks.<\/p>\n
NetSpectre itself can only exfiltrate data at relatively low speeds, and thus requires a substantial amount of time to achieve its objectives. But it carries a frightening promise: this new threat demonstrates a potentially devastating, previously-unknown, exploit in the majority of the world\u2019s computing devices. And you can bet that cyber criminals are hard at work developing new, faster, and even more dangerous threats to exploit this same vulnerability.<\/p>\n
How to Beat Back NetSpectre, and It\u2019s Next Evolution<\/p>\n
The good news is: You\u2019re not alone in your fight against NetSpectre and its variants.<\/p>\n
Google remains hard at work, funding research to discover new Spectre exploits before they appear in the wild. And earlier this year, Intel released a series of patches that began to mitigate their speculative execution vulnerabilities. These patches appear to close the NetSpectre vulnerability. So if you have been aware of these emerging Spectre attacks\u2014and updated your systems accordingly\u2014than you should be protected against NetSpectre.<\/p>\n
But if you have not updated your systems accordingly, or if you are unsure if you have patched this vulnerability, then please take some time today to do so. While it is heartening to hear that the OEMs behind these vulnerabilities are attempting to correct them, cyber security is an \u201call hands on deck\u201d activity. Whether you are a business owner, a security professional, or simply an individual user, you share some responsibility for ensuring your network\u2019s safety. And that begins with continued awareness of what threats are emerging, and how to protect yourself against them.<\/p>\n
For further information on how to protect yourself from NetSpectre, and other emerging attacks, contact Paladion today for a free security review of you network.<\/p>\n","protected":false},"excerpt":{"rendered":"
By Sreeraj Gopinathan, Head of Threat Anticipation Services at PaladionConsider yourself warned: There is a new threat blowing up in the news, and it\u2019s capable of exploiting most computing devices in operation today. The threat is named NetSpectre, and it\u2019s critical that you take a few minutes to learn a little more about it\u2014and how […]<\/p>\n","protected":false},"author":2,"featured_media":5977,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":0,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-8457","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n