Story image

Apple confirms that macOS and iOS are vulnerable to Meltdown bugs

Security researchers have recently uncovered security issues known by two names, Meltdown and Spectre. 

These issues apply to all modern processors and affect nearly all computing devices and operating systems. 

All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time. 

Since exploiting many of these issues requires a malicious app to be loaded on your Mac or iOS device, they recommend downloading software only from trusted sources such as the App Store. 

Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2 to help defend against Meltdown. 

Apple Watch is not affected by either Meltdown or Spectre. 

Meltdown is a name given to an exploitation technique known as CVE-2017-5754 or rogue data cache load.

The Meltdown technique can enable a user process to read kernel memory. 

Apple analysis suggests that it has the most potential to be exploited. 

Apple released mitigations for Meltdown in iOS 11.2, macOS 10.13.2, and tvOS 11.2. 

Their testing with public benchmarks has shown that the changes in the December 2017 updates resulted in no measurable reduction in the performance of macOS and iOS as measured by the GeekBench 4 benchmark, or in common Web browsing benchmarks such as Speedometer.

Spectre is a name covering two different exploitation techniques known as CVE-2017-5753 or bounds check bypass, and CVE-2017-5715 or branch target injection.

These techniques potentially make items in kernel memory available to user processes by taking advantage of a delay in the time it may take the CPU to check the validity of a memory access call.

Analysis of these techniques revealed that while they are extremely difficult to exploit, even by an app running locally on a Mac or iOS device, they can be potentially exploited in JavaScript running in a web browser. 

Apple has promised to release an update for Safari on macOS and iOS in the coming days to mitigate these exploit techniques. 

Their current testing indicates that the upcoming Safari mitigations will have no measurable impact on the Speedometer and ARES-6 tests and an impact of less than 2.5% on the JetStream benchmark. 

They say they will continue to develop and test further mitigations within the operating system for the Spectre techniques and will release them in upcoming updates of iOS, macOS, and tvOS.

IDC: Standalone VR headset shipments grow 428.6% in 3Q18
The VR headset market returned to growth in 3Q18 after four consecutive quarters of decline and now makes up 97% of the combined market.
Meet Rentbot, the chatbot that can help with tenancy law
If you find yourself in a tricky situation  - or if you just want to understand your rights as a landlord or tenant, you can now turn to a chatbot for help.
PlayerUnknown’s Battlegrounds (PUBG) finally releases on PS4
PUBG on PS4 feels like it’s still in Early Access as the graphics look horribly outdated and the game runs poorly too. 
How AI can fundamentally change the business landscape
“This is an extremely interesting if not pivotal time to discuss how AI is being deployed and leveraged, both in business and at home.”
CERT NZ highlights rise of unauthorised access incidents
“In one case, the attacker gained access and tracked the business’s emails for at least six months. They gathered extensive knowledge of the business’s billing cycles."
Report finds GCSB in compliance with NZ rights
The Inspector-General has given the GCSB its compliance tick of approval for the fourth year in a row.
Game review: Just Cause 4 on PC
Rico Rodriguez returns to wreak over-the-top havoc for a fourth time. This time the island nation of Solís is our hero’s sandbox, ripe for destruction.
Hands-on review: Logitech G502 HERO gaming mouse
My favourite feature of the G502s is the ‘Sniper’ button, which is found on the left hand side of the device. When held, this lowers the DPI and allows you to achieve maximum accuracy whilst honing in on a kill on your favourite FPS title.