01/24/2018
For those on Dell computers, don't install the BIOS microcode updates to "be safe" against the massive "spectre and meltdown" vulnerabilities that have come to light over the past couple weeks. They are basically a way that someone mailcious can use the seemingly impossible speed of todays processors, that update at over 4ghz (thats 4 billion operations per second...) And for todays processors to gain every last shred of preformance they possibly can, sometimes they can use what is called speculation, to basically guess which path to take, and until they know they chose the correct path, they "hold their breath" (for lack of a better term) until then can be sure the did choose the right path and can retire that information that was already processed but pending confirmation it was necessary to do so, and these kinds of highly educated guesses your processor is making millions of times per second, to gain every percentage of speed it possibly can, was recently found out to be exploitable.
Basically a bad peice of code can do a "call" to the memory file (memory, is data that is held, eaisly accessabel for programs and you to access, typically this is called RAM in a computer or phone think 2gb, 4gb, 8gb... but really the processor cant use RAM memory as it is wayyyyy to slow. They have memory built right onto the silicone of the chip itself they can access much much faster. There are 3 levels as well that all the different cores can access. L1 L2 L3, with each one getting slower and slower to access, but more and more space to store data. So L1 is not much data, but it is what the processing cores can tap into billions of times per second if needed, L2 less fast but there is more, L3 the same, and eventually the 8gb of RAM memory that is uasually most used by things like Windows and all your programs, who are plenty happy with not being super insanegogogogogo fast...
To bring it back around, a malicious program can make a call into the l1, l2, and l3 memory, and simply by just detecting how long it took for that memory to answer the knock-knock, they have found a way to actually get real data out of that memory cache... why is this bad? well. in that memory is every password you enter, every webiste you visit, every file, it is complete unaderated access to the entire castle.
Basically for everyone to be protected from this exploit, as it is such a fundamental thing, will require us to step back a few years as far as progress goes, and millions of computers and phones witll suffer huge preformance hits, as the vast majority of chips from 3-4-5 years ago and older, will never be properly updated, and will require them to be protected with a heavy hand in a crude way, that basically will wipe all the L1 L2 and L3 data everytime the "userspace" and "kernel" (system) cross paths, totally wiping clean that whiteboard of usefull data that the computer can use to quikly access the most commonly accessed information, wiping it every time a file is saved, opened, accessed, making those high speed memory modules near useless.
It can be patched with a download from your computer system manufacturer (think Lenovo, Dell, Hp) of a BIOS update you can activate when booting up your computer. Normally an average computer will never update their bios, ever. It works fine to start the computer, but this is such a big --Potential-- security risk, every company, operating system, program, even programming languages are taking action for any new software made with their code to be protected from it.
The important thing to remember is that nobody has been found or admitted to using it for any malevocnent reasons at all. Only a few proof of concepts from the dilligent security researchers who are out there figuring this stuff out to procect us all every day. So you are just fine not doing the update that could cause tons of issues. It will likely be months before criminals are able to use this in any meaning full way, and hopefully by then the kinks will be ironed out. If you have a dell, go ahead and send me a message to let know know when and how to update and protect yourself, and as i listen to all the security news podcasts every week, I will know as soon as there is any sign or reason to update, and can then message everyone instructions.
One of the best guys on earth, Steve Gibson, and a true geninus was kind enough last week to write a teeny tiny program called inSpectre. It will tell you if you are vulnerable at first, tell you if the patches are available for your system. and even give you the power to toggle them on and off. If you are having tons of computer issues out of nowhere, this is highly likely to be the cause. A windows update (the second tuesday of the month) earlier this month could very well have done it. Steves program also explains much more clearly than I could try to do so here, what the risk is, and the situation as a whole!
Check it out completely free here - https://buff.ly/2Fbchum
There cou…
