Examining Spectre and Meltdown attacks
As you have no doubt heard, Spectre and Meltdown aren’t software bugs that can be fixed in a few days or weeks when a company pushes out a patch. They are part of the architecture of hardware – the chips that run your computer. And you don’t just roll out a patch for hardware. Chips can’t be “patched” until a new version comes out – a refresh cycle that is generally five years or much longer. In other words, these flaws aren’t just bad, they’re long-term bad.
But the news is not all bad
First, exploiting them is not easy. An attacker would need to install malware on your computer to take advantage of them.
Second, you and your organization are not totally defenseless. There are tools now available to defend both your operating system and your software. You just have to use them…
Detect Spectre exploits with static analysis
Taylor Armerding is an award-winning journalist who left the declining field of mainstream newspapers in 2011 to write in the explosively expanding field of information security. He has previously written for CSO Online and the Sophos blog Naked Security. When he’s not writing he hikes, bikes, golfs, and plays bluegrass music.
More from Security news and research
- Agile, CI/CD, and DevOps
- API security testing
- Application security best practices
- Application security orchestration and correlation
- Application security program strategy and planning
- Application security threat and risk assessment
- Automotive cyber security
- Cloud cyber security
- Container security
- Cybersecurity Research Center
- DevSecOps
- Dynamic application security testing
- Financial cyber security
- Fuzz testing
- Healthcare cyber security
- Interactive application security testing
- Internet of Things cyber security
- M&A and OSS license compliance
- Medical devices cyber security
- Mergers and acquisitions due diligence
- Mobile application security
- Open source license compliance
- Penetration testing
- Public sector cyber security
- Security and developer training
- Software compliance, quality, and standards
- Software composition analysis
- Software Integrity Group’s products and services
- Static application security testing
- Telecommunications and network cyber security
- Threat modeling
- Web application security