openpolitics.com

Meltdown is a particular problem for the cloud computing services run by the likes of Amazon, Google and Microsoft.

.. Amazon told customers of its Amazon Web Services cloud service that the vulnerability “has existed for more than 20 years in modern processor architectures.” It said that it had already protected nearly all instances of A.W.S. and that customers must update their own software running atop the service as well.

.. To take advantage of Meltdown, hackers could rent space on a cloud service, just like any other business customer. Once they were on the service, the flaw would allow them to grab information like passwords from other customers.

.. That is a major threat to the way cloud-computing systems operate. Cloud services often share machines among many customers

.. The personal computers used by consumers are also vulnerable, but hackers would have to first find a way to run software on a personal computer before they could gain access to information elsewhere on the machine.

.. The worldwide community of coders that oversees the open-source Linux operating system, which runs about 30 percent of computer servers worldwide, has already posted a patch for that operating system.

.. The software patches could slow the performance of affected machines by 20 to 30 percent, said Andres Freund, an independent software developer who has tested the new Linux code.

.. The other flaw, Spectre, affects most processors now in use, though the researchers believe this flaw is more difficult to exploit. There is no known fix for it, and it is not clear what chip makers like Intel will do to address the problem.

.. Spectre will be much more difficult to deal with than issuing a software patch.

The Meltdown flaw is specific to Intel, but Spectre is a flaw in design that has been used by many processor manufacturers for decades. It affects virtually all microprocessors on the market,

.. Spectre is a problem in the fundamental way processors are designed, and the threat from Spectre is “going to live with us for decades,”

.. An emphasis on speed while designing new chips has left them vulnerable to security issues

.. “There’s been this desire from the industry to be as fast as possible and secure at the same time. Spectre shows that you cannot have both.”