Cybersecurity specialists have discovered a new vulnerability in Intel chips that can be exploited to steal confidential information directly from the processor. Researchers have named it “ZombieLoad.” ZombieLoad is a side-channel attack targeting Intel chips, allowing hackers to leverage a flaw in their architecture to obtain arbitrary data; however, it does not enable the injection and execution of arbitrary malicious code, making it impossible to use it as a sole tool for intruding on and hacking remote computers.
According to Intel, ZombieLoad consists of four flaws in the microcode of their chips, which researchers reported to the company just a month ago. Almost all computers with Intel chips released since 2011 are affected by these vulnerabilities. ARM and AMD chips are not vulnerable to this issue.
ZombieLoad is reminiscent of the infamous Meltdown and Spectre vulnerabilities, which exploited flaws in the speculative execution of instructions. Speculative execution enables processors to predict what an application or operating system might require in the near future, which allows applications to run faster and more efficiently. The processor will return the results of its predictions if they are correct or discard the results if the prediction turns out to be false. Both Meltdown and Spectre exploit the ability to misuse this feature to gain direct access to information being operated on by the processor.
ZombieLoad translates to "zombie load," which partly explains the vulnerability's mechanism. During an attack, an overwhelming amount of data is sent to the processor, which it cannot handle properly, forcing the processor to request assistance from the microcode to prevent a crash. Typically, applications can only see their own data, but the error caused by the processor overload allows this restriction to be bypassed. Researchers have stated that ZombieLoad can access any data used by processor cores. Intel reports that a microcode fix will help clear the processor buffers during overloads, preventing applications from reading unintended data.
In a video demonstration of the vulnerability, researchers showed that it can be used to determine which websites a person is visiting in real time, but it can also be easily applied to obtain, for example, passwords or access tokens used by users for payment systems.
Like Meltdown and Spectre, ZombieLoad affects not only PCs and laptops but also cloud services. serversThe vulnerability can be exploited on virtual machines that should be isolated from other virtual systems and their host devices, potentially bypassing this isolation. Daniel Gruss, one of the researchers who uncovered the vulnerability, claims that it can read data from server processors just as it can on personal computers. This presents a potentially serious issue in cloud environments where virtual machines from different clients operate on the same server hardware. Although there have been no public reports of attacks using ZombieLoad, researchers cannot rule out that they might have occurred, as data theft does not always leave detectable traces.
What does this mean for the average user? There's no need to panic. This is far from an exploit or a zero-day vulnerability, where an attacker could take control of your computer in an instant. Gruß explains that applying ZombieLoad is 'easier than Spectre' but 'harder than Meltdown'—both require a certain set of skills and efforts to be utilized in an attack. In fact, to execute an attack using ZombieLoad, you must somehow load a compromised application and run it yourself, as the vulnerability will then allow the attacker to download all your data. Nevertheless, there are much simpler ways to hack a computer and steal that data.
Intel has already released microcode to fix vulnerable processors, including Intel Xeon chips, Intel Broadwell, Sandy Bridge, Skylake, Haswell, Intel Kaby Lake, Coffee Lake, Whiskey Lake, and Cascade Lake, as well as all Atom and Knights processors. Other major companies have also released patches for the vulnerability on their end. Apple, Microsoft, and Google have already released corresponding patches for their browsers.
In an interview with TechCrunch, Intel stated that updates for the chip microcode, like previous patches, will impact processor performance. An Intel representative reported that most fixed consumer devices might lose up to 3% of their performance at worst, and data centers could experience losses of up to 9%. However, according to Intel, this is unlikely to be noticeable in most scenarios.
However, Intel is in complete disagreement with Apple engineers, who argue on a about a complete protection method against 'Microarchitectural Data Sampling' (the official name for ZombieLoad), claiming that to fully close the vulnerability, Intel Hyper-Threading technology needs to be completely disabled in processors, which, according to tests by specialists at Apple, could reduce user device performance in certain tasks by up to 40%.
Neither Intel nor Daniel and his team have published code that implements the vulnerability, so there is no direct and immediate threat to the average user. The patches released promptly completely mitigate it, but considering that each such fix comes at a certain cost in performance for users, Intel faces some questions.
Source: 3dnews.ru
