Intel Corp. said on Jan. 3 that most of the processors running the world’s computers and smartphones have a feature that makes them susceptible to hacker attacks. The chipmaker, working with partners and rivals, says it has already issued updates to protect most processor products introduced in the past five years, but the news sparked concern about this fundamental building block of the internet, PCs and corporate networks.
1. What’s the problem?
Modern processors guess what they’ll have to do next and fetch the data they think they’ll need. That makes everything from supercomputers to smartphones operate very fast. Unfortunately, as Google researchers discovered, it also provides a way for bad actors to read data stored in memory that had been thought to be secure. In a worst-case scenario, that would let someone access your passwords.
2. How bad is it?
The vulnerability won’t stop your computer working and doesn’t provide an avenue for hackers to put malicious software on your machine. Though it could put important data at risk, there’s been no report so far of anyone’s computer being attacked in this manner. More broadly, though, the new fears could undermine longtime assurances that hardware and chip-level security is more tamper-proof than software.
3. How was it discovered?
The weakness was discovered last year by folks Google employs to find such issues before the bad guys do. Usually, solutions are developed in private and announced in a coordinated way. This time the news leaked before the companies involved had a chance to get a fix in place.
4. What’s being done to fix it?
Chipmakers and operating system providers, such as Alphabet Inc.’s Google and Microsoft Corp., are rushing to create software patches that will close the potential window of attack. Intel said on Jan. 4 that by the end of next week, it expects to have issued updates for more than 90 percent of recently introduced processor products. Amazon.com Inc. said "all but a small single-digit percentage" of its servers have already been protected. In a blog post, Google said its security teams immediately "mobilized to defend" its systems and user data. Some customers of Android devices, Google Chromebook laptops and its cloud services still need to take steps to patch security holes, the company said. Patches for Windows devices are out now and the company is securing its cloud services, Microsoft said in a statement.
5. Is this just an Intel problem?
No, though that seems to be what panicky investors initially thought. Intel says it’s an issue for all modern processors. But rival Advanced Micro Devices Inc. stated that its products are at "near-zero risk." ARM Holdings, which has chip designs that support all smartphones, said that, at worst, the vulnerability could "result in small pieces of data being accessed" and advised users of its technology to keep their software up to date. Google fingered all three companies.
6. What will the fallout be?
Some computers, mostly older ones, could be slowed down by the software patches that will make them more secure. Intel said that in common situations software might be slowed down by as much as 3 percent or not at all. But in other rare situations, performance might be reduced as much as 30 percent. The company doesn’t expect any financial impact and said it thinks customers will keep buying. As the fixes haven’t been widely deployed yet, it’s unclear whether anyone will even notice or whether computer slowdowns will be widespread. Intel has only done lab tests.
The Reference Shelf
- A website detailing the processor flaws created by the teams that discovered them.
- A Bloomberg News report on how governments and health institutions are most at risk, since they rely on old computers and components.
- A Bloomberg QuickTake on cybersecurity.