New Spectre, Meltdown variants leave victims open to side-channel attacks <p>

TechRepublic ^ | February 15, 2018 | By Conner Forrest

[Swordmaker]

MeltdownPrime and SpectrePrime, found by Princeton and NVIDIA researchers, may require significant hardware changes to be mitigated.

• MeltdownPrime and SpectrePrime, new variants of the Meltdown and Spectre flaws, could put PCs at risk of another type of cyberattack.
• The MeltdownPrime and SpectrePrime exploits could be harder to protect against than the original Meltdown and Spectre flaws, because of how deep their flaws exist in the processor.

Security researchers from NVIDIA and Princeton have discovered new variants of the Meltdown and Spectre flaws that may be more difficult to tackle than the originals. Dubbed MeltdownPrime and SpectrePrime, these flaws were further detailed in a recent research paper.

The software changes already underway will likely take care of these two exploits, but the coming hardware fixes won't, the researchers noted in the paper. The researchers said they believe the "hardware protection against them will be distinct," which means that chip makers may need to further change their designs to mitigate the threats.

After creating their own tool to synthesize the Spectre and Meltdown flaws, the researchers were able to use their findings to conduct side-channel attacks, or attacks that take advantage of the physical hardware related to a system's security. The side-channel attacks in this exploit are cache-based and rely on the timing of cache activity to glean information, the report said.

[Swordmaker]

No troll intended here, Sword, but do you know why they would have used a Mac to test the POC? Says in the article the exploit was tested on a Mac. Just curious if Apple’s platform is “better” for this test vs. Windows or Linux.

I suspect it is because a lot of programmers use Macs for development because you can run every operating system simultaneously on a fast Mac. . . Windows, Mac, Linux, Android, iOS, essentially everything you are going to develop for.