hake Posted January 12, 2018 ID:1199055 Share Posted January 12, 2018 I guess that the exploits necessary to install Meltdown/Spectre on a system are likely to be trapped by MBAE, especially via the web browser route. Is this a reasonable assumption? Link to post Share on other sites More sharing options...
Sizzy11 Posted January 14, 2018 ID:1199859 Share Posted January 14, 2018 Would it be safe to install the Windows Meltdown/Spectre patch while using MBAE? Link to post Share on other sites More sharing options...
hake Posted January 15, 2018 Author ID:1199968 Share Posted January 15, 2018 MBAE did not react while the patch was being installed. I hope that MBAE will block any exploit needed to install Meltdown/Spectre spyware. I guess that the web browser or email attachment would be the route for an exploit to take. Link to post Share on other sites More sharing options...
ky331 Posted January 15, 2018 ID:1199996 Share Posted January 15, 2018 I'm still waiting for an official answer to the original question. Given that part of the problem is hardware/firmware related (requiring a BIOS/UEFI update), and part of the problem (to the best of my understanding) is based on the precise exploitation of "timing loops", I would hazard a guess that such vulnerabilities are beyond the scope of what MBAE monitors. I'd be happy to learn I'm wrong about this. Link to post Share on other sites More sharing options...
Sizzy11 Posted January 15, 2018 ID:1200321 Share Posted January 15, 2018 11 hours ago, hake said: MBAE did not react while the patch was being installed. I hope that MBAE will block any exploit needed to install Meltdown/Spectre spyware. I guess that the web browser or email attachment would be the route for an exploit to take. Good to know that Windows won't freak out. If MBAE does not block the exploit, then CIS would stop any unknown programs Link to post Share on other sites More sharing options...
hake Posted January 16, 2018 Author ID:1200528 Share Posted January 16, 2018 (edited) I have read that an exploit can be performed by using JavaScript which works in a web browser to access memory. A JavaScript program can read data from the address space of the browser process running it. Browser providers are working on mitigation updates: -https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/https://www.chromium.org/Home/chromium-security/ssca Edited January 16, 2018 by hake Link to post Share on other sites More sharing options...
quietman7 Posted January 20, 2018 ID:1201872 Share Posted January 20, 2018 MBAE does prevent script-based drive-by downloads. If that's the method of distribution of the Meltdown/Spectre payloads, then MBAE should block it. pbust, Post #3 Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now