Chip Flaw, Trusted Data Exchange & Medical Device Security

TLP White

After a calm holiday, we have started the year in total Meltdown. We will look at the Spectre of the chip vulnerability and much more in this week’s Hacking Healthcare:

 

Hot Links –

1. Chip Flaw: The biggest security story[1] in the new year is the disclosure of twin vulnerabilities – Meltdown[2] and Spectre[3] – that have been identified in Intel, AMD, and ARM processors. Researchers have produced proof-of-concept attacks that enable non-privileged users to read the cached memory in the systems kernel. It appears this is made possible by a performance feature on the chips that anticipates and “speculatively” executes future commands. Typical security controls are not applied to commands in speculative execution.

Chip and OS manufactures, as well as independent security researchers, believe the impact of an attack that leverages Meltdown or Spectre is likely limited to data theft and not operational control of systems (since the security controls kick in before the machine runs those speculatively executed commands).

Intel[4], AMD[5], and ARM[6] all have press pages devoted to tracking the flaws and their fixes. Intel ARM has noted that it’s Cortex-M line of processors (which are used in some medical devices) have not been impacted.

[1] https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

[2] https://meltdownattack.com/meltdown.pdf

[3] https://spectreattack.com/spectre.pdf

[4] https://newsroom.intel.com/news/intel-responds-to-security-research-findings/

The folks at The Register who broke the story, are not that impressed with Intel: http://www.theregister.co.uk/2018/01/04/intel_meltdown_spectre_bugs_the_registers_annotations/

Ars Technica has a look at all responses: https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre-heres-what-intel-apple-microsoft-others-are-doing-about-it/

[5] https://www.amd.com/en/corporate/speculative-execution

[6] https://developer.arm.com/support/security-update

As a reminder, this is the public version of the Hacking Healthcare blog. For additional in-depth analysis and opinion, become a member of H-ISAC.

Read full blog below:

Download