Apple says Meltdown and Spectre flaws affect all Mac and iOS devices

The Guardian ^ | Jan 05, 2018 | Samuel Gibbs

[Oshkalaboomboom]

Apple’s iPhones, iPads and Mac computers are all vulnerable to the major processor flaws revealed on Wednesday, the company has warned, but it says updates are already available.

The flaws known as Meltdown and Spectre affect almost every modern computing device from all manufacturers using chip designs from Intel, AMD and ARM. Apple uses Intel processors in its Mac computers and ARM-based designs for its A-series processors used in the iPhone, iPad, Apple TV and Apple Watch lines.

Apple said: “All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time.”

The company advised customers to download software only from trusted sources such as its iOS and Mac App Stores to help prevent hackers from being able to use the processor vulnerabilities.

In a support document, Apple said that iOS 11.2 released on 13 December, macOS 10.13.2 released on 6 December and tvOS 11.2 released on 4 December all protect against Meltdown for supported devices and that WatchOS did not need updating.

Apple said it was developing protections against the Spectre flaw for its Safari browser for iOS and macOS, and would release them in the coming days to help stop potential exploitation via JavaScript running in the browser from a website.

Apple said: “Our current testing indicates that the upcoming Safari mitigations will have no measurable impact on the Speedometer and ARES-6 tests and an impact of less than 2.5% on the JetStream benchmark.”

[Oshkalaboomboom]

Apple users tech alert.

[WayneS]

Two days ago, news articles were reporting that AMD processors were not affected these “flaws”. Has new information been discovered in the last day or so?

[TADSLOS]

No worries. The batteries in my Apple devices are all dead and I’m not logged on.

[Mark17]

The batteries in my Apple devices are all dead and I’m not logged on.

I AM logged in on my IPhone 6 here, cuz I changed batteries in both my IPhones. 👍😄

[6ppc]

Apparently Meltdown doesn’t affect AMD but Specter affects all of them.

[WayneS]

Thank you for the clarification.

[ConservativeMind]

AMD is hit by Spectre, but not Meltdown.

[relictele]

All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time

There's a contradictory weasel corporate statement if ever there was one.

[rlmorel]

I didn’t see it that way.

It is much like saying the earth can be hit by an asteroid, but we don’t see one right now that is a threat to hit it, or to say that achieving a controlled nuclear fusion reaction is possible, but there isn’t one working yet.

Or, your home is vulnerable to being broken into, but nobody has done so yet, and our street sources don’t indicate a working plan yet.

There is a lot of nefarious stuff, this one seemed pretty standard to me.

[usconservative]

Two days ago, news articles were reporting that AMD processors were not affected these “flaws”. Has new information been discovered in the last day or so?

There's been a wealth of information specific to AMD's posted here on FR in the last few days, I've read most of it and can summarize it as follows:

1. Meltdown does NOT affect AMD Processors.

2. AMD is affected by one of the Spectre vulnerabilities however it requires physical access to the machine.

That's as of yesterday afternoon, information specific to Meltdown and Spectre has been coming out pretty fast so if the above has changed I'm certain someone here on FR with knowledge will post corrections to the above.

[usconservative]

Only ONE of the Spectre variants affects AMD per Toms Hardware Guide.

As already stated on this thread, AMD is not impacted by Meltdown.

[exDemMom]

So, how am I supposed to find out what kind of processor is in my iPad?

It’s fairly straightforward on any of my PC devices to open up the control panel and see exactly what hardware is installed, as well as the version of drivers, etc. But I’ve no idea how to do that on Mac devices. (Which is why, other than the iPad, I never use Mac: they are not user friendly for people who like to look in the “guts” of the machine.)

On a related note, I downloaded the latest OS update a couple of days ago. Now I find that the iPad wants to set up functions that I do not want, and it is giving me no option to tell those functions to go away and stop bothering me. So whenever I go to use it, I have to tell it to cancel the set-up. Arggh.

[dayglored]

*ping*

[relictele]

Well, then, those being paid handsomely for corporate communications for the richest tech companies in the world could have been more precise by using the world ‘vulnerable’ to indicate the potential for attack. Of course, since their first instinct is to protect their reputations, they are loose with the facts.

‘Affected’ means, well, affected. As in it’s happened already. If it hasn’t then they should say so.

[markomalley]

There's a contradictory weasel corporate statement if ever there was one.

NOT a Mac fanboi at all, but this is actually a very accurate and appropriate statement.

Knowing that a vulnerability (a hole) exists is something very different than developing something to take advantage of that hole (exploiting that hole/vulnerability).

A car-related analogy:

• The vulnerability: car doors can be unlocked without the use of a key
  This is potentially a bad thing but isn't dangerous unless somebody can figure out HOW to unlock the car door without the key.
• An exploit: a slim jim can exploit the vulnerability in a car door locking mechanism (especially in older cars)

Two other pertinent terms that weren't really discussed in this article:

• mitigation -- reduces the ability of a specific exploit to take advantage of a vulnerability. Using our car example, if memory serves, car manufacturers used to weld in a little "shelf" into the car doors above the control arm to make it far more difficult to use a slim jim.
• remediation -- removing or reducing the vulnerability by redesigning the system. Again, in our car example, many cars built these days have a different mechanism than the traditional lock button -- the door lock is horizontally actuated versus vertically oriented.

To mitigate systems with this Meltdown and Spectre vulnerabilities, OS publishers will re-write the OS to make it far more difficult for malicious code to be able to access the vulnerability. That will make computers (phones, tablets, etc) slow down some.

However, to actually remediate this, the CPU chips themselves will need to be redesigned so that these vulnerabilities no longer exist. That is going to be a quite lengthy and costly process. Costly both for Intel, ARM, and AMD, and also for enterprises who will feel it necessary to replace all of their processors.

[rlmorel]

I tend to see it as poor writing skills in this case.

Heck, the people being paid handsomely at The Washington Post or New York Times still put out content that makes you roll your eyes with respect to sentence construction and clarity.

I know what you mean, but I see this as simple incompetence in public affairs, not weaselness, though I don’t rule that out either.

[rlmorel]

LOL, we know Earth is vulnerable to being destroyed by aliens, but we don’t know if any have found their way to us yet, or even if any plans have been formed by them to do so!

[markomalley]

LOL, we know Earth is vulnerable to being destroyed by aliens, but we don’t know if any have found their way to us yet, or even if any plans have been formed by them to do so!

Literally.

[TexasGunLover]

So, how am I supposed to find out what kind of processor is in my iPad?

All ARM processors are affected, thus all iOS devices.

[CurlyDave]

...It’s fairly straightforward on any of my PC devices to open up the control panel and see exactly what hardware is installed, as well as the version of drivers, etc. But I’ve no idea how to do that on Mac devices...

I don't think you tried very hard.

On a Mac computer put your cursor on the Apple (upper left corner) in the menu bar, and select "about this Mac" (first item) in the drop down menu. All of the information you want is available right there, and enough more to make my eyes glaze over.