2

I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm wrong.

I want to know the following:

  1. Why is application sandboxing ineffective against Meltdown and Spectre? In other words, (based on my understanding above) why is the application layer bypassed?

  2. Let's say the Meltdown and Spectre vulnerabilities are used by some malware and the malware sends keylogged information to a remote host. If I have a firewall, such as Iptables, and I restrict outgoing traffic, will that be enough to prevent the malware author from stealing information?

    In other words, will a firewall be able to prevent the 2 vulnerabilities from passing information to a remote destination?

Improve this question
2
  • 3
    Plot twist: The firewall has an Intel CPU
    – David
    Commented Apr 2, 2018 at 8:17
  • After reading that post, I understand now that no applications can really save you from this vulnerability; however, if a malware author wanted to send stolen data (via these vulnerabilities) remotely, they would have to go through the firewall because stealing the information is something and sending it remotely is something else, correct?
    – izb3st
    Commented Apr 2, 2018 at 8:20

1 Answer 1

Reset to default
0

Meltdown and Spectre are hardware vulnerabilities. They actually reside in your processor and are interested in sensitive information.

Meltdown is specific for Intel Processors.

Spectre is for processors other than Intel (not Intel).

  1. Meltdown bypasses the 'protection mode' that is present when you want to access sensitive data that is stored in your processor. The attack imitates the role of a normal user that is accessing the data. The reason sandbox is useless is because the operating system thinks it is a normal user not an attacker.
  2. It could be possible that firewall will detect the malware. This will require software patches (updating your Operating System version).

In conclusion

Most computer providers have released software patches to overcome these issues. Since these are hardware related, it means that the hardware is what needs to be improved. Software can help, but not fully.

UPDATE

Built-in Firewalls are updated along with the Operating System (OS), since Firewalls are human programmed, they need to know how malware activity behaves. So, if the most recent version of OS is running on you device, the likely hood that your Firewall will know that this malware is carrying out Meltdown or Spectre 'activity' is high. This is because they are now aware of how these vulnerabilities will act.

As for outgoing traffic, and in terms of Iptables, it is unlikely that you know which IP address is trying to access your data.

I would also like to emphasise, again: Software can help, but not fully.

Hope it is clear now.

End of UPDATE

References:

Kocher, Paul, et al. "Spectre Attacks: Exploiting Speculative Execution." arXiv preprint arXiv:1801.01203 (2018).

Meltdown and Spectre. (2018). Meltdownattack.com. Retrieved 1 April 2018, from https://meltdownattack.com/#faq-fix

Improve this answer
11
  • Can you explain "It could be possible that firewall will detect the malware. This will require software patches (updating your Operating System version)."
    – multithr3at3d
    Commented Apr 2, 2018 at 2:13
  • 1. By 'application sandboxing', I mean, for example, Firejail for Linux. So your answer that the "reason sandbox is useless is because the operating system thinks it is a normal user not an attacker" didn't really answer my question. 2. I have the same request as multithr3at3d above.
    – izb3st
    Commented Apr 2, 2018 at 7:59
  • Please check the answer for the update.
    – Kosovic
    Commented Apr 2, 2018 at 10:34
  • @izb3st Please be aware that Firejail is a cure worse than the disease. It makes privesc rather trivial.
    – forest
    Commented Apr 2, 2018 at 10:58
  • I think you are confusing firewalls with other antimalware solutions. Also your claim that Spectre does not affect Intel is horribly wrong.
    – Ben Voigt
    Commented Apr 2, 2018 at 14:44

Not the answer you're looking for? Browse other questions tagged .