Skip to main content

Is your PC safe? Foreshadow is the security flaw Intel should have predicted

If you thought Spectre and Meltdown were going to be the only industry-shaking security flaws to affect nearly every computer, think again. Intel recently revealed three new issues related to its Core and Xeon processors, dubbed collectively as “Foreshadow” by the researchers who discovered the exploits.

Unfortunately for Intel and all of us, Foreshadow doesn’t exactly inspire confidence in the computers we rely on every day. Here’s everything you need to know about the new security flaw.

Meet Foreshadow

Like with Spectre and Meltdown, Foreshadow was first discovered by multiple independent teams outside Intel, in this case as a collaboration between researchers from a few universities.

insecure
(in)Secure, a weekly column, follows the trends, and screw-ups, you need to know about. We’ll touch on topics ranging from the laws behind cyber security, to the latest major breaches, to new methods that can help keep your data safe or, at least, minimize the damage.

But the origin story is not where the similarities to the previous security flaws stop. The vulnerabilities revealed in Foreshadow are similar to Meltdown and Spectre in that they take advantage of flaws in the way processors temporarily store data in memory.

In an interview with the BBC, one of the researchers behind the discovery described the attack as targeting a “lock box within Intel’s processors,” which could then leak out any kind of data you wanted.

The “lock box” Wenisch is referring to is known as the Software Guard Extensions (Intel SGX), and this attack method only works on Intel processors with the special feature. Intel SGX is essentially a set of instructions built into Intel’s chips that enable developers to create private caches, aka enclaves, in memory, for applications such as secure web browsing and digital rights management for streaming video.

Foreshadow Attack

This alone was already a dangerous vulnerability waiting to be exploited — but unfortunately, it was only the first of three methods of attack. Upon further investigation, Intel discovered two other related problems, which researchers have named “Foreshadow-NG” (aka next generation).

Foreshadow, the Next Generation

These two vulnerabilities are still based on a processor core’s L1 cache, which is where an individual core of the processor stores the information it will need next. But these newly-discovered issues affect memory uses other than just Intel’s SGX technology.

The first vulnerability in the Foreshadow-NG group can grab data from memory used by the core of an operating system, aka the kernel. This core has access to all data stored in memory, including every app and program installed on the machine. The good news here is that a hacker must have access to your PC and use a malicious program to actually steal that data.

This vulnerability also enables access to data used by the System Management Mode (SMM) installed in all modern processors. This mode is used by the PC’s firmware to control the hardware, manage power, and so on. Again, to steal this data, a hacker must have access to your PC with guest privileges to run malicious software.

Foreshadow Attack - Technical Demo

The second Foreshadow-NG vulnerability can be used to attack virtual machines. These aren’t real PCs, but rather software-emulated PCs running in memory on a datacenter server. Virtual machines are typically managed by a hypervisor so that data doesn’t leak between these virtual PC instances.

But according to the researchers, a malicious virtual machine could break through those boundaries. “A malicious virtual machine running inside the cloud can potentially read data belonging to other virtual machines as well as data belonging to the cloud’s hypervisor,” the researchers claim.

Who’s affected by Foreshadow?

The original Foreshadow vulnerability, specifically pertains only to SGX-enabled Intel processors. These include all sixth- and seventh-generation Core processors but exclude Atom processors that support SGX. Processors manufactured by AMD are not affected, nor are chips based on ARM’s processor core design (Tegra, Snapdragon, Enyos, etc.).

Foreshadow modern computer affected
The Foreshadow security flaw affects nearly every modern computer with an Intel processor. Image used with permission by copyright holder

Foreshadow-NG is a different story. As of now, chips based on ARM’s architecture and x86-based CPUs from AMD are still under investigation. Processors produced by Intel that fall prey to Foreshadow-NG can be found here in a very long list. It essentially covers second- to eighth-generation Intel Core processors, X-Series chips for the X99 and X299 platforms, Xeon processors spanning from the 32400 Series to the Xeon Processor Scalable Family, and so on.

“We are not aware of reports that any of these methods have been used in real-world exploits …”

Intel was quick to report that microcode updates were already issued earlier this year to protect customers against possible attacks. These updates built a foundation for the current mitigations introduced on Tuesday by operating system providers, hypervisor software developers and the open source community.

Changes will also be made on a hardware level in Intel’s next-generation “Cascade Lake” Xeon Scalable processors and “client processors” launching by the end of 2018.

“We are not aware of reports that any of these methods have been used in real-world exploits, but this further underscores the need for everyone to adhere to security best practices,” Intel says. “This includes keeping systems up-to-date and taking steps to prevent malware.”

Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
Watch Tesla’s humanoid robot pull some snappy dance moves
Tesla's humanoid robot dancing.

Tesla has shared a new video showing its Optimus humanoid robot pulling some rather impressive dance moves.

While the nifty footwork might not be much use for the industrial settings that the robot is destined for, the 60-second clip effectively showcases its increasing agility and lifelike range of motion.

Read more
No, a lifetime VPN subscription doesn’t mean ‘your’ lifetime
iPhone with VPN service enabled in hand over a blurred background

Folks who signed up for al lifetime subscription with VPN provider VPNSecure have been discovering the true definition of “lifetime” when it comes to such deals. And it’s not the one they'd hoped to hear.

After new owners took over the company, these particular customers recently had their lifetime subscriptions canceled. The new operator of VPNSecure told them that it didn’t know about the lifetime deals when they acquired the business, adding that it was unable to honor them.

Read more
SanDisk’s latest drive sets new benchmark for consumer NVMe SSDs
The SanDisk WD Black SN8100 PCIe Gen 5 SSD with and without heatsink variants

SanDisk has officially introduced the WD Black SN8100, its latest high-end PCIe Gen 5 NVMe SSD targeting PC enthusiasts, gamers, and professional users. With sequential read speeds of up to 14,900 MB/s and write speeds of 14,000 MB/s, the drive sets a new bar for consumer SSD performance, surpassing some of the best NVMe SSDs currently on the market, including the Crucial T705. 

The SN8100 uses a standard M.2 2280 form factor and is available in capacities of 1TB, 2TB, 4TB, and 8TB. It’s worth noting that the 1TB model offers lower write speeds, up to 11,000 MB/s, compared to the higher-capacity versions, which reach up to 14,000 MB/s. 

Read more