Two major computer processor security bugs, dubbed Meltdown and Spectre, affect nearly every device made in the last 20 years. The ramifications of how much these bugs will impact computing is still playing out, but it could lead to compromised servers for cloud platforms and other farther-reaching effects.
The Meltdown and Spectre bugs affect a variety of CPUs, including Intel chips and ARM chips on mobile devices. The resulting attacks impact every major operating system in some way. Companies have rushed to patch the vulnerabilities, and it’s still unclear whether the patches will result in significant performance slowdowns. More broadly, security teams are likely to struggle with variants and other consequences of the bug for years to come.
Here’s what you need to know.
Apple confirmed on Thursday that all Mac and iOS devices are affected by the Meltdown and Spectre CPU flaws that have roiled the computing industry for the past 24 hours, resulting in a race to patch operating systems and cloud computing infrastructure at the highest levels. The company says it plans to issue patches for Safari on macOS and iOS to better help devices defend against Spectre, which is more easily exploitable and affects devices using chips from Intel, AMD, and ARM. Apple Watch devices are not affected by Meltdown in any way, the company confirms.
Microsoft just released several updates aimed at helping protect Surface devices from the two security vulnerabilities exposed by CPU bugs. Installing the newest patch is one of the main ways users can protect themselves from Meltdown and Spectre.
The following Surface devices running Windows 10 can be updated with the new patch:
- Surface Pro 3
- Surface Pro 4
- Surface Book
- Surface Studio
- Surface Pro Model 1796
- Surface Laptop
- Surface Pro with LTE Advanced
- Surface Book 2
A Microsoft spokesperson confirmed that the updates are currently rolling out now, and they can be downloaded by either checking with the device’s internal update system or by visiting the Microsoft Download Center. The company stresses, however, to wait for the appropriate firmware updates specifically related to Meltdown and Spectre, so as not to download older versions.
Protecting a Windows PC is complicated right now, and there’s still a lot of unknowns. Microsoft, Google, and Mozilla are all issuing patches for their browsers as a first line of defense. Firefox 57 (the latest) includes a fix, as do the latest versions of Internet Explorer and Edge for Windows 10. Google says it will roll out a fix with Chrome 64, which is due to be released on January 23rd. The best thing to do right now is ensure you have the latest Windows 10 updates and BIOS updates from Dell, HP, Lenovo, or one of the many other PC makers.