Skip to main content

Is your PC safe? Foreshadow is the security flaw Intel should have predicted

If you thought Spectre and Meltdown were going to be the only industry-shaking security flaws to affect nearly every computer, think again. Intel recently revealed three new issues related to its Core and Xeon processors, dubbed collectively as “Foreshadow” by the researchers who discovered the exploits.

Unfortunately for Intel and all of us, Foreshadow doesn’t exactly inspire confidence in the computers we rely on every day. Here’s everything you need to know about the new security flaw.

Meet Foreshadow

Like with Spectre and Meltdown, Foreshadow was first discovered by multiple independent teams outside Intel, in this case as a collaboration between researchers from a few universities.

insecure
(in)Secure, a weekly column, follows the trends, and screw-ups, you need to know about. We’ll touch on topics ranging from the laws behind cyber security, to the latest major breaches, to new methods that can help keep your data safe or, at least, minimize the damage.

But the origin story is not where the similarities to the previous security flaws stop. The vulnerabilities revealed in Foreshadow are similar to Meltdown and Spectre in that they take advantage of flaws in the way processors temporarily store data in memory.

In an interview with the BBC, one of the researchers behind the discovery described the attack as targeting a “lock box within Intel’s processors,” which could then leak out any kind of data you wanted.

The “lock box” Wenisch is referring to is known as the Software Guard Extensions (Intel SGX), and this attack method only works on Intel processors with the special feature. Intel SGX is essentially a set of instructions built into Intel’s chips that enable developers to create private caches, aka enclaves, in memory, for applications such as secure web browsing and digital rights management for streaming video.

Foreshadow Attack

This alone was already a dangerous vulnerability waiting to be exploited — but unfortunately, it was only the first of three methods of attack. Upon further investigation, Intel discovered two other related problems, which researchers have named “Foreshadow-NG” (aka next generation).

Foreshadow, the Next Generation

These two vulnerabilities are still based on a processor core’s L1 cache, which is where an individual core of the processor stores the information it will need next. But these newly-discovered issues affect memory uses other than just Intel’s SGX technology.

The first vulnerability in the Foreshadow-NG group can grab data from memory used by the core of an operating system, aka the kernel. This core has access to all data stored in memory, including every app and program installed on the machine. The good news here is that a hacker must have access to your PC and use a malicious program to actually steal that data.

This vulnerability also enables access to data used by the System Management Mode (SMM) installed in all modern processors. This mode is used by the PC’s firmware to control the hardware, manage power, and so on. Again, to steal this data, a hacker must have access to your PC with guest privileges to run malicious software.

Foreshadow Attack - Technical Demo

The second Foreshadow-NG vulnerability can be used to attack virtual machines. These aren’t real PCs, but rather software-emulated PCs running in memory on a datacenter server. Virtual machines are typically managed by a hypervisor so that data doesn’t leak between these virtual PC instances.

But according to the researchers, a malicious virtual machine could break through those boundaries. “A malicious virtual machine running inside the cloud can potentially read data belonging to other virtual machines as well as data belonging to the cloud’s hypervisor,” the researchers claim.

Who’s affected by Foreshadow?

The original Foreshadow vulnerability, specifically pertains only to SGX-enabled Intel processors. These include all sixth- and seventh-generation Core processors but exclude Atom processors that support SGX. Processors manufactured by AMD are not affected, nor are chips based on ARM’s processor core design (Tegra, Snapdragon, Enyos, etc.).

Foreshadow modern computer affected
The Foreshadow security flaw affects nearly every modern computer with an Intel processor. Image used with permission by copyright holder

Foreshadow-NG is a different story. As of now, chips based on ARM’s architecture and x86-based CPUs from AMD are still under investigation. Processors produced by Intel that fall prey to Foreshadow-NG can be found here in a very long list. It essentially covers second- to eighth-generation Intel Core processors, X-Series chips for the X99 and X299 platforms, Xeon processors spanning from the 32400 Series to the Xeon Processor Scalable Family, and so on.

“We are not aware of reports that any of these methods have been used in real-world exploits …”

Intel was quick to report that microcode updates were already issued earlier this year to protect customers against possible attacks. These updates built a foundation for the current mitigations introduced on Tuesday by operating system providers, hypervisor software developers and the open source community.

Changes will also be made on a hardware level in Intel’s next-generation “Cascade Lake” Xeon Scalable processors and “client processors” launching by the end of 2018.

“We are not aware of reports that any of these methods have been used in real-world exploits, but this further underscores the need for everyone to adhere to security best practices,” Intel says. “This includes keeping systems up-to-date and taking steps to prevent malware.”

Editors' Recommendations

Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
ZombieLoad is Meltdown resurrected. Here’s how to secure your PC right now
Stock photo of Intel 9th gen core processor.

Less than a year and a half since Intel had its first public meltdown after finding the highly publicized Meltdown and Spectre security flaws, researchers have discovered a new security vulnerability called Microarchitectural Data Sampling (MDS) -- which leaves computers dating back to 2008 vulnerable to eavesdropping attacks.

Fortunately, Intel learned its lesson from the first Meltdown discovery, and it finds itself better prepared to address the recently published security flaw that, if unpatched, could leave computers -- ranging from laptops to cloud-based servers -- exposed to eavesdropping by an attacker.
Back from the grave
A series of updates were recently deployed to address the newly uncovered security flaw. Whether you're on a Windows PC or a Mac, you should stay up to date with your security patches to mitigate the risk of attack. Business customers operating their infrastructure from the cloud should check with their service providers to ensure that that latest available security patches will be applied as soon as possible.

Read more
Intel and AMD may never make a CPU we can fully trust, but others might
Spectre Meltdown

Remember the Spectre and Meltdown security exploits from last year? Intel and AMD really hopes you don’t. Despite what they want you to believe, these speculative execution exploits aren't going away, at least not with the solutions proposed so far.

Instead of trying to fix each variant that comes along, a permanent fix will require a fundamental change to how CPUs are designed. The proposition? A “secure core” that makes sure your data stays safe from attackers, no matter what bugs they might try to exploit.

Read more
Best color laser printers for 2024: tested and reviewed
A Brother printer on a counter in front of a brick wall.

The best color laser printers can be a great investment, saving you quite a bit of time and money. For shoppers worried about the long-term ink costs, you'll find color laser printers surprisingly affordable. Laser printers use toner, which lasts a very long time, delivering a low cost per page for monochrome documents and fast color prints. The best color laser printers offer quick performance and reliability to help keep your home office or small business productive.

If you need to scan documents for record-keeping and photo capture or want the convenience of a color copier, an all-in-one color laser printer is an essential tool for your small business or personal use. For a small added cost, you get expanded capabilities. That's why every model on this list is an all-in-one from the best printer brands.

Read more