The tech industry has uncovered a new way the Spectre vulnerability can secretly steal data from PCs and servers. On Monday, Microsoft and Google revealed they had discovered a fourth variant of the Spectre chip flaw that can let a hacker pull sensitive data like passwords and credit card information from protected system processes.
The good news is that both Microsoft and Intel say its earlier fixes for the Spectre vulnerability can help lessen the threat. In fact, Microsoft claims the risk of exploitation is low.
"We have not seen any reports of this method being used in real-world exploits," Intel added in its post.
The fourth variant of the Spectre vulnerability also abuses a feature found in most modern computing chips called "speculative execution," which is designed to significantly boost a PC's performance. This is done by getting the machine to speculate on what computing instructions and data it should pre-fetch, thus cutting down on the load times.
Unfortunately, speculative execution has a serious flaw. It can theoretically let a hacker trick a machine into pre-fetching sensitive data, like passwords or emails from protected processes, and leaking it out. Back in January, the tech industry made public three variants of the Spectre flaw, and rushed out several patches that were designed to temporarily "mitigate" the threat.
The newly-disclosed fourth variant specifically targets the way data is handled and temporarily stored in a computer's DRAM through a process called "buffering," the Linux vendor Red Hat said in a post.
To speed up the buffering process, the computer will also use speculative execution to pre-load data instructions; any incorrect values will later be discarded. "The problem is this speculation occurs in a shared, unsecured area (of the computer), so it's possible for unauthorized users to see it," Red Hat said in a separate video.
To exploit the flaw, a hacker could develop a piece of malware that's been designed to trick the microprocessor into leaking the sensitive data. Intel said the researchers who discovered the flaw demonstrated that it could be exploited over an internet browser using JavaScript.
However, earlier fixes made by the leading browser makers to address variant one of the Spectre flaw also work against variant four, Intel said. For customers seeking more protection, the chip maker has come up with an additional fix that is arriving in beta form to PC and software vendors.
"We expect it will be released into production BIOS and software updates over the coming weeks," Intel said. However, the fix will be turned off by default. That's because when activated, it can drag a machine's performance down from 2 to 8 percent.
AMD said that Microsoft is finishing final testing for AMD-specific patches that'll roll out through the Windows update process. Meanwhile, mobile chip designer ARM said that the new variant of the Spectre flaw only impacts a "small number" of processors built with ARM-Cortex A and is addressed in a firmware update.
How worried should you be over Spectre? Experts say the vulnerability will haunt the industry for years to come because it represents a fundamental flaw with the way chips are built. Over the long-term, Intel is planning a silicon-based processor redesign to address the threat. But for now, the fixes available today are mere "band-aids" that can stop some of the theoretical attacks, but not all.
That all said, the chances of a hacker using the Spectre flaw to target your PC are low. Cybercriminals already possess an arsenal of malware that can also steal your sensitive data from a computer, without tampering with the microprocessor. The real danger is to cloud server providers who lease out their systems to multiple clients. A hacker could potentially exploit Spectre on one server to steal the sensitive data from all the protected systems running onboard.