Meltdown and Spectre, disclosed January 3, 2018, as CVE-2017-5754 (Meltdown) and CVE-2017-5715/CVE-2017-5753 (Spectre), proved that even the CPU itself, the hardware everything else runs on, can leak data through a speculative-execution flaw. The lesson isn't that these two specific bugs were catastrophic. It's that the next unnamed, undiscovered flaw could be, unless the data it might expose is designed to be worthless on its own.

When Vulnerabilities Become History, and When They Don't

News about vulnerabilities hits the headlines almost daily. Most get discovered, patched, and fade into history without posing a long-term threat. But a true zero-day, one that appears from nowhere, can cause devastating damage to anyone unprepared for it. Think Pearl Harbor: surprise alone can do real damage.

Meltdown and Spectre were promptly discovered and mitigated, first through software patches, later through hardware architecture changes, so they aren't expected to cause lasting damage to companies that patched quickly. But looking at what these vulnerabilities have in common with past ones like Heartbleed (CVE-2014-0160) and Venom (CVE-2015-3456), one important pattern stands out: one way or another, external malicious programs can gain access to your program's data. You never know in advance what kind of data a new vulnerability will expose, so the only reasonable assumption is that any data in your program, database, or file is potentially vulnerable.

You Can't Protect Data You Have to Decrypt to Use

It's obviously impossible to make all the data you work with perfectly safe, because at the moment it's actually in use, it has to be decrypted and accessible. What is possible is minimizing the footprint of a possible attack, designing systems so that even a successful exploit yields as little usable data as possible.

Why Credentials Are the Real Prize

The most prized target for most hackers is user credentials. Since most computer systems today still rely on human-manageable credentials, stealing usernames and passwords remains the easiest way to reach everything else behind them. From Target to OPM, from the Clinton email server to the DNC, stolen credentials were the keys to the kingdom in each case. Vulnerabilities like Meltdown and Spectre, Heartbleed and Venom, and the many others, known and still unknown, are simply paths hackers use to reach those prized targets.

The pattern across all four: different mechanisms, same outcome. Whatever sensitive data sits in memory at the time of the attack is exposed.

Two Simple Ways to Reduce the Risk

There are a few genuinely simple ways to protect your systems, your data, and your customers from threats like these, existing and still to come:

1. Stop using human-readable credentials for access control. Eliminate usernames and passwords for good. As long as a sign-in dialog starts with "username," the system stays open to this entire category of attack.

2. Don't rely on simple salted hashing or "whole disk" or "whole database table" encryption alone. Salts and encryption keys in systems like these are constantly needed to access data, which means they're most likely sitting in RAM or cache much of the time, making them an easy target in Meltdown-style attacks.

Technology That Already Solves This

Technologies that eliminate both of these attack vectors already exist, though they're unfortunately not yet widely adopted. System architects and business owners who want to stay ahead of the competition, rather than become the next Equifax, need to adopt them sooner rather than later.

One technology that addresses both problems directly is WWPass Distributed Data Storage, which fragments and distributes encrypted data so that no single point of compromise, CPU-level or otherwise, yields anything useful on its own. To learn more, contact us.

FAQ

What were the Meltdown and Spectre vulnerabilities?
CPU-level flaws disclosed January 3, 2018, that let malicious programs read memory they shouldn't have access to, by exploiting the speculative execution features built into nearly all modern processors. Meltdown was tracked as CVE-2017-5754; Spectre as CVE-2017-5715 and CVE-2017-5753.

Why are usernames and passwords the most common target in attacks like these?
Because once stolen, credentials unlock everything else behind them, with no further exploit required. Vulnerabilities like Meltdown and Spectre are simply one more path to reach those credentials in the first place.

If data has to be decrypted to be used, how can it ever be fully protected?
It can't be made perfectly safe at the moment of use, but the footprint of what's exposed during that moment can be minimized through architecture, for example, by making sure no single compromised point exposes a complete, usable set of data or keys.

Why is "whole disk" or "whole database" encryption not enough on its own?
Because the keys needed to decrypt that data have to be accessible for the system to function, which usually means they sit in RAM or cache much of the time, exactly where attacks like Meltdown are designed to read from.

The Bottom Line

Meltdown and Spectre were patched quickly and likely won't cause lasting damage to companies that moved fast. The next unnamed vulnerability might not be so forgiving. The systems that hold up aren't the ones betting on no new flaw ever being found, they're the ones designed so that even a successful exploit doesn't hand an attacker anything worth having.