Tech giants reveal new variant of Meltdown and Spectre vulns

The new vulnerability, dubbed “Variant 4,” can be exploited through JavaScript in a web browser to steal data.

Intel and Microsoft have revealed a new variant of the Meltdown and Spectre chip vulnerabilities that have plagued their products in recent months. The new vulnerability, dubbed “Variant 4,” can be exploited through JavaScript in a web browser to steal data.

Like the Meltdown and Spectre vulnerabilities, “Variant 4 uses speculative execution, a feature common to most modern processor architectures, to potentially expose certain kinds of data through a side channel,” Leslie Culbertson, an executive vice president at Intel, wrote in a blog post.

Intel isn’t aware of any exploits of Variant 4 in the wild, Culbertson said, crediting the company’s expanded bug bounty program for boosting security. In a security advisory published Monday, Microsoft said that it wasn’t “aware of any exploitable code patterns of this vulnerability class in our software or cloud service infrastructure, but we are continuing to investigate.”

The Spectre (Variants 1 and 2) and Meltdown (Variant 3) vulnerabilities, discovered by Google’s Project Zero and made public in January, affected virtually all modern computer chips. Meltdown could let hackers get around a barrier between applications and computer memory to steal sensitive data, while Spectre spoofs applications into spilling key information.

Some mitigating measures for Spectre also are applicable to Variant 4, according to Intel. But to prevent the vulnerability from being exploited in other ways, Intel and others are providing microcode and software updates, the chip giant said. Intel plans to release those software updates in “the coming weeks,” according to Culbertson.

The Department of Homeland Security on Monday also issued an alert on Variant 4, advising affected computer users to carefully test patches before applying them and to then monitor the performance of critical services and applications.

The recovery process for Spectre and Meltdown has been rocky, with one round of firmware updates causing computers to reboot and another patch introducing a new vulnerability altogether. Intel said the effect of Variant 4 mitigation on computing performance will depend on workload, how a platform is configured, and the type of mitigation measure employed.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure