Chances are you own a smartphone or computer that contains a chip hackers could potentially exploit to get access to sensitive information.
That’s because billions of devices are affected by two major security flaws revealed by cybersecurity researchers on Wednesday.
The flaws — dubbed Meltdown and Spectre — affect processing chips made by Intel, AMD and ARM Holdings. That means if you use a desktop, laptop, smartphone or cloud service from Apple, Google, Amazon or Microsoft you might be vulnerable.
Don’t panic. Here’s what you should do.
1. Update your software!
Spectre is the main threat because it is present in billions of devices. Meltdown appears to affect only Intel chips.
The U.S. government-funded Software Engineering Institute initially said vulnerable chips may eventually have to be replaced altogether. It subsequently updated its guidance to say that software updates can provide a partial fix for now.
“Because chip replacements are not going to happen tomorrow, realistically, software is being updated,” Sitaram Chamarty, a security researcher at Tata Consultancy Services, told CNNMoney.
Chamarty says that while Spectre may be tougher to combat, the threat from Meltdown can be mitigated through the software updates.
“It has to kind of trickle down, hopefully in another few days it will all be done,” he added.
Intel says it is working with AMD and ARM to fix the problem, and many tech firms have already released — or are about to release — software updates to secure their devices.
Microsoft has already released security updates for Windows users, and is taking steps to protect users of its cloud computing services. Google and Amazon are also updating their cloud services.
Apple said Thursday that it had already issued fixes for Meltdown for its various operating systems, and added that it plans to release similar fixes in its Safari browser “to help defend against Spectre” in the coming days.
“We continue to develop and test further mitigations for these issues and will release them in upcoming updates of iOS, macOS, tvOS, and watchOS,” Apple said.
Dell said it was “working with Intel and others in the industry to investigate and address the issue.” It directed customers to Intel’s statement, and said it would post “a list of affected platforms and remediation” soon.
2. Brace yourself for slower devices
An unfortunate downside of the software updates is that they might slow your computers and smartphones.
Patches deployed to combat the flaws could slow computers by as much as 30% depending on what you’re trying to do, according to estimates posted on Linux message boards.
Intel said it does not expect users to experience any performance issues. Experts disagree.
“Processor slowdowns trickle down from data centers to everyone using the internet,” said Bryce Boland, chief technology officer for Asia at cybersecurity firm FireEye. “People will feel many of their mobile devices taking a performance hit.”
Chamarty says removing the vulnerability requires a fundamental change in the way modern processors operate — a function called “speculative execution” — a change that could drastically reduce speeds.
“If you’re going to disable this, then you’re back to … many, many years ago, we’re talking 10 years,” he added. “Imagine running at those speeds now.”
3. Wait, watch and hope
The good news: The vulnerabilities provide new avenues for hackers to mount attacks, but analysts say doing so is not straightforward.
“The effort to mount this attack is quite significant,” Chamarty said.
The heavy lifting could dissuade hackers from targeting anyone but “big fish” such as heads of government agencies, he added.
But the downside is that there isn’t really a permanent solution at the moment, meaning hackers could have plenty of time to figure out a way in.
“Resolving this issue will take time and incur costs,” Boland said. “Vulnerable systems will likely remain in operation for decades.”
Chamarty warned that even the mass replacement of computer chips may not necessarily help.
“It seems to be a cost of the way processors are currently designed, there’s no true solution currently in sight,” he said.
“If somebody finds an ingenious method by which [attacks] can be made more generic, less cumbersome to mount… then we have real problems.”
— Selena Larson, Yazhou Sun and Vinayak Dewan contributed to this report