How to check if your PC is protected from Meltdown and Spectre

A lot of concern was voiced on the internet when Google's Project Zero disclosed two seemingly clandestine vulnerabilities that, while not seemingly taken advantage of, exposed inherent flaws in the way CPUs have been executing code for the past 20 years. From Intel's CEO selling off a major chunk of his shares to China getting to know of the exploits before the USA, there was hardly a day that passed by without these exploits being in the news. So what are these vulnerabilities really and why should you be concerned?

At a very fundamental level, Meltdown and Spectre are bugs that can allow a hacker to steal information from programs that the CPU is working upon. Note that they are not malware as such but the bugs can be used maliciously if exploited. While all attention was focused initially on Intel, it was found that even ARM and AMD chips were affected — albeit at different levels. When Google's Project Zero team discovered the bug last June, they set an embargo date for January 9, 2018. But the information leaked earlier and this made software and hardware vendors rush patches out. In technical parlance, Meltdown and Spectre are identified by the Common Vulnerabilities and Exposures (CVE) listings. They include the following: 

CVE-2017-5754 — Rogue Data Cache Load a.k.a Meltdown

This is a CPU vulnerability that allows a user-mode program to access kernel-mode memory. It exploits a flaw in something called as speculative execution — a fancy term for the manner in which CPUs try to predict upcoming instructions and execute them ahead of time to speed up processing. In essence, a malicious program can use this exploit to access sensitive information in memory and by extension, of other programs and the OS itself. This bug affects all Intel processors manufactured since 1995 with the exception of Itanium and older Atom CPUs. Some ARM chips are also affected while AMD CPUs are immune due to architectural differences. Meltdown can be mitigated by OS updates and is comparatively easier to fix than Spectre but the mitigation does pose a performance hit depending on the CPU.

CVE-2017-5753 — Bounds Check Bypass a.k.a Spectre Variant 1 and CVE-2017-5715 — Branch Target Injection a.k.a Spectre Variant 2

Spectre also exploits speculative execution. Spectre variants are potentially more dangerous than Meltdown as they can allow hackers to fish out information from running processes. If your PC is not patched for Spectre, a hacker who has local access to your computer can steal sensitive information that you enter in a browser form, for example. All CPUs from Intel, AMD, and ARM are affected by both Spectre variants. OS and browser updates only help to mitigate the vulnerabilities to a certain extent and the only true fix is to redesign CPU architecture from scratch.

While both Spectre and Meltdown are local attacks, researchers have shown that Spectre indeed be exploited using browser-based JavaScript. One more fact is that these are read-only attacks, implying that hackers can only read the information being executed but not force anything on their own. Still, the possible sensitivity of the information that can be leaked warrants that these vulnerabilities be addressed quickly. 

Due to the flaws being an inherent part of hardware design, there's not much that can be done other than mitigate the risks using a combination of microcode and OS level software updates. Microsoft, Intel, AMD, Google, and Apple have all released security patches over the past month to ensure that the risks are mitigated as much as possible. The rushed nature of these updates meant that some patches negatively impacted Intel processors, causing repeated reboots, and some AMD-based machines reportedly got bricked by a Windows patch. While the patches themselves are getting stable with time, it is a good idea to check what is the protection status of your computer and the steps you can take to mitigate the risks as much as possible.

Time to get some elbow-grease on.

For this tutorial, we will use Windows PowerShell (PS) to check the security status of your PC against Meltdown and Spectre. PowerShell is the evolution of the classic command prompt in Windows that allows for enhanced shell scripting and Windows administration. It has been a part of every version of Windows since Windows 8. 

The initial rushed release of some of these updates have caused more headaches than the vulnerabilities themselves. Do note that 32-bit Windows still does not have the mitigation in place. Things are getting better though and vendors are trying to deploy stable updates as much as possible. While some of you might choose not to install these updates given the expected performance drops, in this age of fast paced malware evolution, it helps to be prepared.

Ask yourself this — are you willing to sacrifice some performance for risk mitigation or is squeezing out the maximum performance till the last clock important? While customers expect they get the full performance advertised for their money, given the current situation, it is advisable to sacrifice a bit of speed to ensure data integrity. OEMs and OS vendors will continue to polish these updates in the coming days so do watch out for those. Most importantly, do not panic or spread FUD; instead understand, assess, and deploy the right updates at the right time to ensure security both at home and at the office.