Apple's Beats brand in April unveiled the Powerbeats Pro, a redesigned wire-free version of its popular fitness-oriented Powerbeats earbuds.
Intel CEO Pledges Commitment to Security Following Meltdown and Spectre Vulnerabilities
Intel CEO Brian Krzanich today wrote an open letter to Intel customers following the "Meltdown" and "Spectre" hardware-based vulnerabilities that impact its processors.
In the letter, Krzanich says that by January 15, updates will have been issued for at least 90 percent of Intel CPUs introduced in the past five years, with updates for the remainder coming at the end of January.
For Apple customers, macOS and iOS devices have been patched with protection against Spectre and Meltdown. Meltdown was addressed in macOS High Sierra 10.13.2 and iOS 11.2, while Spectre mitigations were introduced in a macOS 10.13.2 supplemental update and iOS 11.2.2, both of which were released this week. The vulnerabilities have also been addressed in older versions of macOS and OS X.
According to Krzanich, going forward, Intel promises to offer timely and transparent communications, with details on patch progress and performance data. Because Spectre and Meltdown are hardware-based vulnerabilities, they must be addressed through software workarounds. In some cases, these software patches cause machines to perform more slowly.
Apple users do not need to worry about performance impacts. According to Apple, Meltdown had no measurable reduction in performance on devices running macOS and iOS across several benchmarks. Spectre, fixed through a Safari mitigation, had no measurable impact on most tests, but did impact performance by less than 2.5% on the JetStream benchmark. Apple says it plans to continue to refine its mitigations going further.
In addition to remaining transparent about the performance impact of the software fixes, Krzanich says Intel will commit to disclosing security vulnerabilities and sharing hardware innovations that will, in the future, prevent such attacks.
Our customers' security is an ongoing priority, not a one-time event. To accelerate the security of the entire industry, we commit to publicly identify significant security vulnerabilities following rules of responsible disclosure and, further, we commit to working with the industry to share hardware innovations that will accelerate industry-level progress in dealing with side-channel attacks. We also commit to adding incremental funding for academic and independent research into potential security threats.For those who missed the news last week, Spectre and Meltdown are serious hardware-based vulnerabilities that take advantage of the speculative execution mechanism of a CPU, potentially allowing hackers to gain access to sensitive information.
Spectre and Meltdown impact all modern processors, including those used in Mac and iOS devices, and these two vulnerabilities will continue to be an issue for the foreseeable future as addressing them entirely requires new hardware design. Apple has prevented Spectre and Meltdown from affecting customers through software updates, but all hardware and software manufacturers will need to be wary of additional speculative execution attacks going forward.
Apple customers should make sure to keep their Macs and iOS devices up to date with the latest software to remain protected from malicious attacks that might take advantage of the exploits.
[ 126 comments ]
Top Rated Comments
(View all)
19 months ago
Won't hurt them in the long run. Their stock has been great and will continue to be.
It's not as if companies really have another option. Yes AMD exists but companies aren't going to switch everything over (and AMD was vulnerable too).
Few months from now people won't even be talking about this.
It's not as if companies really have another option. Yes AMD exists but companies aren't going to switch everything over (and AMD was vulnerable too).
Few months from now people won't even be talking about this.
19 months ago
Okay, what about future processors like Ice Lake which I believe is scheduled for release next year? Should people not purchase any new Macs or Windows PCs until it’s confirmed that they’re free of this vulnerability? Will there be any compensation for customers who purchased a Mac or Windows PC with the hardware vulnerability and are now experiencing more than just a small performance degradation in their daily workflow. Just telling us about software “workarounds” that won’t impact performance “too much” isn’t good enough.
19 months ago
As far as I understand it, AMD CPUs are only affected by Spectre V1, but Intel CPUs affected by Spectre V1, Spectre V2 and Meltdown....No Ryzen CPUs are affected by this...
That is not correct. AMD CPUs (including Ryzen) are affected by both Specter V1 and V2:
https://www.reuters.com/article/us-cyber-microchips-amd/amd-chips-exposed-to-both-variants-of-spectre-security-flaw-idUSKBN1F0314
Spectre and/or Meltdown also affects Oracle (formerly Sun) SPARC: https://sp.ts.fujitsu.com/dmsp/Publications/public/Intel-Side-Channel-Analysis-Method-Security-Review-CVE2017-5715-vulnerability-Fujitsu-products.pdf
Spectre also affects IBM System Z mainframes, POWER8 and POWER9: https://access.redhat.com/security/vulnerabilities/speculativeexecution
Meltdown and Spectre affect certain ARM CPUs, including those used in the Nintendo Switch console: http://www.nintendolife.com/news/2018/01/cpu_exploits_meltdown_and_spectre_could_potentially_affect_nintendo_switch
Since the main criteria for Spectre vulnerability are (a) speculative execution and (b) branch prediction, it probably affects older RISC CPUs like the DEC Alpha 21264 and MIPS R10000: https://en.wikipedia.org/wiki/Alpha_21264
All of the above use out-of-order execution, speculative execution and branch prediction. Some CPUs use in-order speculative execution and branch prediction, such as the ARM A8, but are still vulnerable. A long list of ARM CPUs are affected, including A75, A73, A72, A57, A17, A15, A9, A8, R8, and R7: https://developer.arm.com/support/security-update
So CPUs with speculative in-order execution can be affected, not just the more common out-of-order type. While Intel's Itanium is mentioned as immune to Spectre, I'm not certain of that. Despite the VLIW in-order design, it heavily uses speculation and hardware branch prediction: https://en.wikipedia.org/wiki/Itanium
Itanium is a factor from a planning standpoint because the architecture is totally different from most other CPUs, yet it may still be affected. If so, this indicates how broad Spectre is and how fundamentally the problem must be approached from the standpoint of CPU redesign.
19 months ago
Great PR speech. Trust us, we'll do better next time.
How about telling us how this slipped through for so long and what changes are being made to make sure there we have minimal risk of other security holes like this. Do this, and we might believe you.
How about telling us how this slipped through for so long and what changes are being made to make sure there we have minimal risk of other security holes like this. Do this, and we might believe you.
19 months ago
Unless he puts his personal life savings / net worth on the line with this pledge, his commitment is empty. We know it's empty because he sold shares and added to his net worth before the 'vulnerability' became public.
Here's how you pledge Brian "NSA" Krzanich: Put your net worth in a trust and tie your distributions to a pledge that intelligence communities haven't compromised Intel hardware. If it's ever revealed that they have, you forfeit the remainder of the trust and instantly get fired by the board.
Here's how you pledge Brian "NSA" Krzanich: Put your net worth in a trust and tie your distributions to a pledge that intelligence communities haven't compromised Intel hardware. If it's ever revealed that they have, you forfeit the remainder of the trust and instantly get fired by the board.
19 months ago
Total PR stunt. The severity of these vulnerabilities does not warrant this kind of apology.
19 months ago
Okay, what about future processors like Ice Lake which I believe is scheduled for release next year? Should people not purchase any new Macs or Windows PCs until it’s confirmed that they’re free of this vulnerability? Will there be any compensation for customers who purchased a Mac or Windows PC with the hardware vulnerability. Just telling us about software “workarounds” that won’t impact performance “too much” isn’t good enough.
1) What about future processors ... - Yes. Those processors will likely have the fix. Though I wouldn't be surprised if it was two generations from now due to how intel works on their processor development lifecycle.2) Should people not purchase any new Macs or Windows PCs ... - NO. This vulnerability is insignificant compared to the number of other fixes that impact your performance and get patched every month. Often optimizing code in one area will make the impact in a fixed area negligible. That is definitely going to be the case here.
3) Will there be compensation ... - Probably from a class action law suit somewhere. But I don't believe they should personally. This was not a case of negligence, this was a regular case of vulnerability discovery, research, and analysis.
19 months ago
Great PR speech. Trust us, we'll do better next time.
How about telling us how this slipped through for so long and what changes are being made to make sure there we have minimal risk of other security holes like this. Do this, and we might believe you.
[doublepost=1515715337][/doublepost]
Maybe I'm just tired, but I can't quite grasp the tense of this statement. The word "commit" shows up multiple times. When I read it, I can't tell if they are telling us that this is something they have been doing all this time, or if it's something new they are planning on doing. If the world's largest semiconductor company wasn't all-in on security policies before now, oh dear.
They are not committing to anything they weren't already doing.[ Read All Comments ]
Google today announced several new features coming to YouTube, all of which are designed to give users more control over the kind of content that appears on the Homepage and in Up Next video...
Apple wanted to make a wireless charger, the AirPower, that could charge the iPhone, Apple Watch, and AirPods all at once no matter where the devices were placed on the charger, but ultimately, the...
Google in May announced a new privacy-focused auto-delete option for automatically removing Location History and Web & App Activity after a set period of time, and the feature is now rolling out...
Apple today released a new update for Safari Technology Preview, the experimental browser Apple first introduced three years ago in March 2016. Apple designed the Safari Technology Preview to test...
Shopify today announced that Apple Business Chat is now available to all of its over 800,000 merchants around the world.
As noted by Engadget, some Shopify merchants are already using...
Anker is back this week with a new collection of sales and discount codes on many of its charging accessories, including the all-new Soundcore Wakey Alarm Clock. This device is a bedside alarm clock...
Apple released a public beta of iPadOS for compatible iPad models, enabling users who aren't signed up for the Apple Developer Program to test the software update ahead of its official release in...
Apple today updated its line of iWork apps for iOS and macOS, bringing new features to Pages, Keynote, and Numbers on both iOS devices and Macs.
All of the apps have a new feature designed to...
