Software Integrity Blog


Meltdown, Spectre security flaws “impact everything”

Meltdown, Spectre security flaws “impact everything”

Welcome to 2018, with two major security flaws revealed that makes any computer device that has chips from Intel, AMD and ARM at risk. One security flaw, dubbed Meltdown, impacts Intel semiconductors, enabling enabling bad guys to steal passwords. The other security flaw, Spectre, impacts chips from all three companies. During an interview with CNBC covered by Reuters, Intel’s chief executive noted that “Phones, PCs, everything are going to have some impact, but it’ll vary from product to product.”

In other cybersecurity news, we look at 10 open source technologies you need to know about, cybersecurity predictions for 2018, and an interesting white paper published by the University of Michigan on identifying cybersecurity threats in connected vehicles.

Today’s CPU vulnerability: What you need to know

via Google Security blog: Last year, Google’s Project Zero team discovered serious security flaws caused by “speculative execution,” a technique used by most modern processors (CPUs) to optimize performance. These vulnerabilities affect many CPUs, including those from AMD, ARM, and Intel, as well as the devices and operating systems running on them.

SpectreMeltdown: What we know about the major cyber security flaws and how to protect yourself

via Newsweek: The discovery of massive cyber security flaws affecting nearly every computer and device has sent developers across major platforms around the world racing to roll out fixes for the bugs.

Cyber security predictions 2018

via ITProPortal: 2017 was certainly a year to be noted for cyber-attacks and 2018 is going to be equally scorching. Expect more devastating cyber attacks aimed at businesses and even mobile phones next year.

Reshaping automotive design

via Semiconductor Engineering:  In markets such as mobile phones or computers, if any part of a system failed, it typically was patched with software and replaced in the next rev of a product, which usually was sometime in the next few years. But with safety critical markets, such as automotive, industrial or medical, these parts need to function reliably for 10 to 15 years. 

Threat identification tool for cybersecurity in self-driving cars

via Phys Org: Hypothetical scenarios—posited in a new white paper by University of Michigan researchers working with Mcity—illustrate the breadth of the cybersecurity challenges that must be overcome before autonomous and connected vehicles can be widely adopted. While every new generation of auto tech brings new security risks, the vulnerabilities that come along with advanced mobility are both unprecedented and under-studied, the paper states.

Assessing risk: Identifying and analyzing cybersecurity threats to automated vehicles

via University of Michigan: Driverless vehicles will be at least as vulnerable to all the existing security threats that regularly disrupt our computer networks. That could include data thieves who want to glean personal and finance information, spoofers who present incorrect information to a vehicle, and denial-of-service attacks that move from shutting down computers to shutting down cars.

Containers and the question of trust

via SC Magazine: Existing software development and security methodologies may need to be modified to better support a new way of developing, running, and supporting applications made possible by containerization says Synopsys technical evangelist, Tim Mackey.

10 open source technologies you’ll need to know in 2018

via Datamation: In Synopsys’ 2017 Open Source 360° Survey, 77 percent of enterprises surveyed said they use open source to build internal applications, 69 percent said that they use it to create customer applications and 69 percent said that open source powers their infrastructure. And 48 percent of those surveyed said that the number of people in their organizations contributing to open source is increasing.

Zealot loads cryptocurrency miner on Linux, Windows machines

via Linux Insider: The increased use of open source applications and the growing popularity of cryptocurrency have created more opportunities for bad actors, according to Mike Pittenger, security strategist.

Is breach of the GPL license breach of contract?

via Synopsys Software Integrity blog (Michael Riskin, Associate, Intellectual Property, Fenwick & West LLP): While courts have found that breach of an open source license can result in IP infringement, until now courts had not definitively ruled whether breach of an open source license is a breach of a contract.

Detecting Spectre vulnerability exploits with static analysis.


More by this author