autonomic-cooperative/autonomic.zone
Archived
5
0
Fork 0
Code Issues 15 Pull Requests 2 Releases Activity

Fix article

Browse Source
This commit is contained in:
georgeowell 2018-01-12 15:24:09 +00:00
parent dc8a43ac3a
commit 3e21c6c50c
1 changed files with 29 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
src/_posts/2018-01-11-spectre-and-meltdown.md
View File

@ -13,7 +13,8 @@ vulnerabilities. Our upstream providers have also confirmed that they have
patched their infrastructure. We will monitor the situation as it develops. patched their infrastructure. We will monitor the situation as it develops.
We are currently super busy with clients so we decided to repost the We are currently super busy with clients so we decided to repost the
excellent security bulletin from out friends over at Rise Up. All credit excellent security bulletin from out friends over at [Rise Up](https://riseup.net/)
which goes into detail oh how to update various operating systems. All credit
to them for the rest of this blog post. to them for the rest of this blog post.
## The Facts ## The Facts
@ -36,10 +37,10 @@ much less likely.
You should take *both* these steps now, for all your devices: You should take *both* these steps now, for all your devices:
1. Upgrade your web browser (see below). These fixes make the new * Upgrade your web browser (see below). These fixes make the new
attacks against CPUs more much difficult. attacks against CPUs more much difficult.
2. Upgrade your operating system. There are updates available for * Upgrade your operating system. There are updates available for
Windows, macOS, and GNU/Linux that fix the Meltdown vulnerability for Windows, macOS, and GNU/Linux that fix the Meltdown vulnerability for
Intel CPUs and provide some mitigations for Spectre. Additionally, new Intel CPUs and provide some mitigations for Spectre. Additionally, new
releases of iOS and Android have mitigations for Spectre. releases of iOS and Android have mitigations for Spectre.
@ -52,8 +53,8 @@ By updating your browser, you can make it significantly harder for an
attacker to steal secrets off your computer using Javascript loaded from attacker to steal secrets off your computer using Javascript loaded from
a web site you visit. a web site you visit.
Firefox version 57.0.4 and later includes mitigation measures [against Firefox version 57.0.4 and later [includes mitigation measures](https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/)
Spectre attack] [1]. against Spectre attack.
Edge has been updated to include Spectre migitations. When you apply the Edge has been updated to include Spectre migitations. When you apply the
latest Windows update, you will get the new version of Edge. latest Windows update, you will get the new version of Edge.
@ -63,37 +64,46 @@ Store updates.
Chrome will include Spectre mitigations starting with version 64, to be Chrome will include Spectre mitigations starting with version 64, to be
released Jan 23. In the mean time, you can change your configuration to released Jan 23. In the mean time, you can change your configuration to
greatly mitigate against the Spectre vulnerability by enabling "site greatly mitigate [against the Spectre vulnerability by enabling](https://support.google.com/chrome/answer/7623121?hl=en)
isolation" [https://support.google.com/chrome/answer/7623121?hl=en] "site isolation."
Additionally, please see [https://riseup.net/en/better-web-browsing] for Additionally, please see [Rise Up's better browsing guide](https://riseup.net/en/better-web-browsing) for
instructions on best practices for securing your web experience (which instructions on best practices for securing your web experience (which
will also help mitigate against these new attacks). will also help mitigate against these new attacks).
## Windows ## Windows
For Windows 10, you must first upgrade any anti-virus software before For Windows 10, you must first upgrade any anti-virus software before
upgrading Windows. Failure to do so may make your computer stop working. upgrading Windows. [Failure to do so may make your computer stop working](http://www.theregister.co.uk/2018/01/04/microsoft_windows_patch_meltdown/).
[2]
To upgrade Windows 10: To upgrade Windows 10:
> Select the Start button, and then go to Settings > Update & security > Windows Update, and select Check for updates. ```
Select the Start button, and then go to Settings > Update & security > Windows Update, and select Check for updates.
```
Now is a good time to enable automatic updates: Now is a good time to enable automatic updates:
> Select the "Start" button, then select "Settings" > "Update & security" > "Windows Update" > "Advanced options" and then under "Choose how updates are installed", select "Automatic (recommended)". ```
Select the "Start" button, then select "Settings" > "Update & security" > "Windows Update" > "Advanced options"
and then under "Choose how updates are installed", select "Automatic (recommended)".
```
If you are running Windows 7 or 8, an update is also available. If you are running Windows 7 or 8, an update is also available.
## macOS ## macOS
If you already have macOS version 10.13.2 then you are [protected against If you already have macOS version 10.13.2 then you are [protected against Meltdown](https://support.apple.com/en-us/HT208394).
Meltdown] [3]. Otherwise, to upgrade macOS: Otherwise, to upgrade macOS:
> Open the App Store app on your Mac. Click "Updates" in the App Store toolbar, then use the "Update" buttons to download and install any updates listed. ```
Open the App Store app on your Mac. Click "Updates" in the App Store toolbar, then use the "Update" buttons
to download and install any updates listed.
```
Now is a good time to check enable automatic updates: Now is a good time to check enable automatic updates:
> Select the Apple menu, then select "System Preferences" > "App Store" > "Automatically check for updates". ```
Select the Apple menu, then select "System Preferences" > "App Store" > "Automatically check for updates".
```
Apple plans to soon release an update to Safari browser to provide some Apple plans to soon release an update to Safari browser to provide some
mitigation against Spectre. mitigation against Spectre.
@ -101,9 +111,9 @@ mitigation against Spectre.
## iOS ## iOS
Apple has said that iOS is affected by Spectre, and an update to Apple has said that iOS is affected by Spectre, and an update to
mitigate against most of the new attacks has been released. If you have mitigate against most of the new attacks has been released. If you have
iOS version 11.2 or later, [then you are good] [3]. iOS version 11.2 or later, [then you are good](https://support.apple.com/en-us/HT208394).
To check for new updates, go to Settings > General > Software Update. To check for new updates, go to `Settings > General > Software Update.`
## Android ## Android
The bad news is that Android is vulnerable to Spectre and unless you The bad news is that Android is vulnerable to Spectre and unless you
@ -116,8 +126,7 @@ Yeah?
There is one thing you can do now to make your Android device more safe There is one thing you can do now to make your Android device more safe
against these new CPU attacks: against these new CPU attacks:
* Turn on "site isolation" in Chrome: * Turn on ["site isolation" in Chrome](https://support.google.com/chrome/answer/7623121?hl=en)
https://support.google.com/chrome/answer/7623121?hl=en
* Upgrade Chrome Browser after Jan 23. * Upgrade Chrome Browser after Jan 23.
* Alternately, use Firefox for Android. * Alternately, use Firefox for Android.
@ -139,7 +148,3 @@ Open a terminal and type:
sudo dnf --refresh update kernel sudo dnf --refresh update kernel
sudo reboot sudo reboot
``` ```
[1] [https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/]
[2] [http://www.theregister.co.uk/2018/01/04/microsoft_windows_patch_meltdown/]
[3] [https://support.apple.com/en-us/HT208394]