Computer researchers have recently found out that the main chip in most modern computers—the CPU—has a hardware bug. It's really a design flaw in the hardware that has been there for years. This is a big deal because it affects almost every computer on your network, including your workstation and all your servers. These exploits can reduce the performance in older machines by as much as 30%, with machines built prior to 2015 being hit the hardest.
They are being called Meltdown and Spectre and they exploit critical vulnerabilities in modern processors. These hardware vulnerabilities allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, if the thieves are able to get a malicious program on the computer they can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages, and even business-critical documents. Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider's infrastructure, it might be possible to steal data from other customers.
To date, no instances of attacks have been seen in the wild which is a good sign.
For more information on this vulnerability, visit this safe site: Meltdown/Spectre Attack
What is PCS doing to keep our customers safe?
PCS has long been communicating to our customers that a multi-tier approach to security is paramount to the protection of your business, and we have worked to include many different levels of protection for our customers. PCS will be working over the coming days to update and patch all machines on the network. This includes both the BIOS as well as patches from Microsoft. This is going to take some time as some of the patches are not even available yet and some are not compatible with every antivirus on the market. We want to make sure that any of those patches do not introduce other problems with performance.
PCS employs a SonicWALL Next generation firewall at all of our customers and SonicWALL utilizes custom high performance security processors (not x86 or other processors with known flaws). Further, SonicOS is a specialized security operating system that does not run arbitrary code and has no exploitable shell. SonicWALL firewalls protect against known and unknown malware, and network based exploits against Meltdown and Spectre have artifacts that can be identified and therefore prevented.
Because these exploits rely on traditional threat sources like viruses, malware, and compromised web pages, Security Awareness Training is key to making sure your users understand their role in keeping themselves and the business safe. PCS will be initiating a new round of security training over the coming weeks in order to reinforce the need for your users to be vigilant in their day to day work.
PCS is committed to keeping our customers safe and over the coming days and weeks, our IT consultants will communicate next steps as we all work to navigate this new threat.