News for Admins

Tech News

Article from ADMIN 48/2018
One Spectre/Meltdown Flaw for Every Day of the Week, Bleedingbit: Two New Bluetooth Vulnerabilities, Intel Chips Smashed by PortSmash, Oracle Goes Cloud Native

One Spectre/Meltdown Flaw for Every Day of the Week

A team of researchers has found seven new Spectre/Meltdown flaws. In a paper, the researchers wrote: "… we present a sound and extensible systematization of transient execution attacks. Our systematization uncovers 7 (new) transient execution attacks that have been overlooked and not been investigated so far."

These flaws include two new Meltdown variants: Meltdown-PK on Intel, and Meltdown-BR on Intel and AMD. The rest of the five flaws were related to Spectre.

"We evaluate all 7 attacks in proof-of-concept implementations on 3 major processor vendors (Intel, AMD, ARM)," the authors said in the paper. "Through this systematic evaluation, we discover that we can still mount transient execution attacks that are supposed to be mitigated by rolled out patches."

The team also suggested mitigation possibilities. "Transient execution attacks use a covert channel to transfer the microarchitectural state change induced by the transient instruction sequence such that it can be observed on an architectural level. One approach in mitigating Spectre-type attacks is to reduce the accuracy."

Bleedingbit: Two New Bluetooth Vulnerabilities

Armis, a firm focused on Internet of Things (IoT) security, has discovered two new vulnerabilities dubbed Bleedingbit in BLE (Bluetooth Low Energy) chips made by Texas Instruments (TI).

The first vulnerability (cc2640, cc2650) affects the BLE chips used in Cisco and Meraki WiFi access points. If exploited, the proximity-based vulnerability triggers a memory corruption in the BLE stack, which could allow attackers to compromise the main system of the access point – thereby gaining full control

Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy ADMIN Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

comments powered by Disqus