Security experts reported that a new set of vulnerabilities affects Intel chips dating back to 2011, including the chips which have been used in Apple devices.
Yesterday, TechCrunch reported that the new vulnerability is called “ZombieLoad,” and it consists of four bugs which let hackers exploit the design flaws in the chips to steal sensitive data directly from the processor.
According to the researchers, the vulnerabilities have significant similarities with the Meltdown and Spectre vulnerabilities that were found last year.
Some experts who worked on Spectre and Meltdown, shared a white paper offering details on how the ZombieLoad vulnerability functions. [PDF]
“While programs normally only see their own data, a malicious program can exploit the fill buffers to get hold of secrets currently processed by other running programs. These secrets can be user-level secrets, such as browser history, website content, user keys, and passwords, or system-level secrets, such as disk encryption keys.
The attack does not only work on personal computers but can also be exploited in the cloud.”
ZombieLoad affects almost every Intel computer dating back to 2011, though, AMD and ARM chips are not affected.
A demonstration of ZombieLoad was shared on YouTube to show how the vulnerability functions while you’re working on your computer. Apart from spying on your browsing activities, ZombieLoad can also be used for other purposes, such as stealing passwords, IDs, etc.
Currently, there are no reports of hackers taking advantage of ZombieLoad, and Intel has already released a microcode for vulnerable processors.
Being aware of the issue, Apple included a patch in the macOS Mojave 10.14.5 update and in security patches for older versions of macOS that were released yesterday.
“Apple has released security updates in macOS Mojave 10.14.5 to protect against speculative execution vulnerabilities in Intel CPUs.
The issues addressed by these security updates do not affect Apple iOS devices or Apple Watch.
Apple previously released security updates to defend against Spectre—a series of speculative execution vulnerabilities affecting devices with ARM-based and Intel CPUs. Intel has disclosed additional Spectre vulnerabilities, called Microarchitectural Data Sampling (MDS), that apply to desktop and notebook computers with Intel CPUs, including all modern Mac computers.”
Additionally, Apple published a support document on ZombieLoad providing details for “full mitigation” protection which can be enabled for customers with computers at heightened risk or that run untrusted software on their Macs. Yet, users who enable Apple’s full mitigation option will see processor slowdowns because of the need to disable hyper-threading.
“An Intel spokesperson told TechCrunch that most patched consumer devices could take a 3 percent performance hit at worst, and as much as 9 percent in a datacenter environment. But, the spokesperson said, it was unlikely to be noticeable in most scenarios.”
Important: To protect their Macs from the ZombieLOAD vulnerability, users running Mojave should update to macOS 10.14.5, while users running older versions of macOS should install any available security updates.
may have the ability to replicate itself, if not completely cleaned. This may require tracking down hundreds of files and settings. You can choose to use Spyhunter Professional Anti-Malware Program to deal with any infection that might be lurking along with !
>>Download SpyHunter – a Professional Virus scanner and remover.
Please, have in mind that SpyHunter offers a free 15-day Trial version with full functionality. Credit card is required, no charge upfront.