Google, Apple, Amazon battle to resolve major security flaw

Amazon, Google and now Apple … as the list of digital giants hit by the “Spectre” and “Meltdown” computer security flaws grows longer, the race is on to limit the damage.

“All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time,” Apple — whose devices are usually regarded as secure — said in a post on an online support page on Thursday.
Almost all microprocessors produced over the past 10 years by Intel, AMD and ARM are affected. No PC or mobile device can function without the miniature components that are effectively nerve centres for executing computer programmes and apps.

And that is what distinguishes them from previous security alerts that have tended to involve software rather than hardware.

In theory, Spectre and Meltdown could enable a user to “access kernel level memory access, exposing critical information that would be stored there, like system passwords,” said Chris Morales, head of security analytics at Vectra.

Luke Wagner, a software engineer at Mozilla, wrote on a security blog that it was “possible to use similar techniques from web content to read private information”.

Effectively, all electronic devices manufactured all around the world in recent years contain potentially vulnerable chips.
The biggest names in the sector, including Amazon, Google , Microsoft and Mozilla, are now rushing out updates and patches to eliminate the flaw.
US giant Intel, as well as its rivals AMD and ARM, have started installing updates.

In a statement on Thurday, Intel said it and its partners “have made significant progress in deploying updates” to mitigate any threats.

“Intel expects to have issued updates for more than 90% of processor products introduced within the past five years,” an Intel statement said.

“In addition, many operating system vendors, public cloud service providers, device manufacturers and others have indicated that they have already updated their products and services.”

Apple, for its part, advised only getting apps from its online App Store which vets programmes for safety, and said it has already released some “mitigations” to protect against the exploit and planned to release a defensive update for Safari on macOS and iOS in the coming days.