{"id":33686,"date":"2019-10-31T21:54:10","date_gmt":"2019-10-31T18:54:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novaya-uyazvimost-zatragivaet-prakticheski-kazhdyj-chip-intel-proizvedyonnyj-s-2011-goda\/"},"modified":"2019-10-31T21:54:10","modified_gmt":"2019-10-31T18:54:10","slug":"novaya-uyazvimost-zatragivaet-prakticheski-kazhdyj-chip-intel-proizvedyonnyj-s-2011-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/novaya-uyazvimost-zatragivaet-prakticheski-kazhdyj-chip-intel-proizvedyonnyj-s-2011-goda","title":{"rendered":"A new vulnerability affects almost every Intel chip manufactured since 2011","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information security specialists have discovered a new vulnerability in Intel chips that can be exploited to steal confidential information directly from the processor. Researchers have named it 'ZombieLoad.' ZombieLoad is a side-channel attack targeting Intel chips, allowing hackers to effectively exploit a flaw in their architecture to gain arbitrary data, but it does not allow the injection and execution of arbitrary malicious code, making its use as the sole tool for intruding and hacking remote computers impossible.<\/p>\n
<\/p>\n
According to Intel, ZombieLoad consists of four flaws in the microcode of their chips, which researchers reported to the company just a month ago. Almost all computers with Intel chips released since 2011 are affected by these vulnerabilities. ARM and AMD chips are not vulnerable to this issue.<\/p>\n
ZombieLoad is reminiscent of the infamous Meltdown and Spectre vulnerabilities, which exploited flaws in the speculative execution of instructions. Speculative execution enables processors to predict what an application or operating system might require in the near future, which allows applications to run faster and more efficiently. The processor will return the results of its predictions if they are correct or discard the results if the prediction turns out to be false. Both Meltdown and Spectre exploit the ability to misuse this feature to gain direct access to information being operated on by the processor.<\/p>\n
<\/center><\/p>\n
'ZombieLoad' translates to 'zombie load,' which partly explains the mechanism of the vulnerability. During the attack, an amount of data is fed into the processor that it cannot properly process, causing the processor to request help from microcode to prevent a crash. Normally, applications can only see their own data, but the error caused by the CPU overload allows bypassing this restriction. Researchers stated that ZombieLoad can access any data being used by the processor cores. Intel reports that a microcode fix will help clear the processor buffers during overloads, preventing applications from reading data not intended for them.<\/p>\n
In a video demonstration of the vulnerability, researchers showed that it can be used to determine which websites a person is visiting in real time, but it can also be easily applied to obtain, for example, passwords or access tokens used by users for payment systems.<\/p>\n<\/p>\n
![\"A](\"\/wp-content\/uploads\/2019\/05\/1da259be37db8107eeac1fde735cd09d.jpg\")
<\/p>\n