Meltdown, Spectre and the Server Under Your Site

What was disclosed

Security researchers have disclosed two related flaws in the processors inside almost every modern computer, phone and server. They have been named Meltdown and Spectre.

Both come from a technique processors use to save time. Rather than wait to learn which instruction comes next, a processor guesses and starts the work early. When the guess is wrong, the work is thrown away.

The flaw is that the throwing away is not quite complete. Traces remain in the processor's fast short-term memory, and a carefully written program can read them, exposing passwords, keys or other data belonging to other programs.

The details were due out next week, alongside the fixes. They came out early, which is why updates are arriving in a rush.

The two flaws in plain terms

Meltdown lets an ordinary program read memory that belongs to the operating system, which is supposed to be off limits. Operating system updates largely close it.

Spectre tricks other programs into revealing their own data. It is harder to use, affects a wider range of processors, including those in phones, and is harder to fix completely.

Updates reduce the risk from Spectre. Closing it entirely will take a long time, and further fixes will keep arriving.

Neither flaw lets anyone into a computer from outside on its own. Both need code already running on the machine. That is why browsers matter: most web pages run code.

Where a small business is exposed

• Office computers, through the operating system and the browser.
• Phones and tablets, including those used for business email.
• The server under your website, which your host runs.
• Any server in the office, such as the file server in the cupboard.
• Virtual servers you rent and manage yourselves.

The third is the one you cannot fix yourself, and the one to ask about this week. The fifth is the one most easily forgotten, because nobody is quite sure whose job it is.

The server under your site

Most small business websites live on servers shared with other customers, either directly or as virtual servers on the same physical machine.

That sharing is where these flaws matter most. In principle, code belonging to one customer could read memory belonging to another, or to the system that keeps them apart.

Fixing that is the host's job: updating the operating systems on its servers and the software that runs the virtual machines, often with restarts.

A good host will already have said something. If yours has not, ask.

What to ask your host

Ask whether the servers your site runs on have been patched, and if not, when. Ask whether restarts are planned, and at what time of day. Ask whether they expect any change in performance.

If you rent a virtual server that you or a developer manage, ask which part is theirs to patch and which is yours.

The host can update the physical machine, but the operating system on your virtual server usually has to be updated by whoever manages it. That is often the part nobody does.

A vague answer, or none at all, tells you something about the host that is worth knowing before the next problem.

Restarts and slowdown

Expect brief outages this month as hosts restart servers. Most will schedule them overnight and announce them in advance, though some have had to move quickly this week.

The updates change how the operating system protects its memory, which adds work to some tasks. How much slowdown results varies widely with what a machine does.

Ordinary office computers are less likely to notice it than a busy server doing a lot of database and disk work.

If your site seems slower over the coming weeks, mention it to the host.

The computers and phones in the office

Operating system updates are being released now. Install them on every computer, then restart, since many updates only take effect after a restart.

On some computers the update waits until the antivirus program confirms it is compatible. An out-of-date antivirus program can quietly hold the update back, so check that it actually installed.

Update every browser too. Browsers are reducing the precision of the timers web pages can use, which makes these attacks much harder to carry out from a web page.

Phones need their updates as well. A phone that no longer receives updates is worth retiring from business email.

A worked example

A bookkeeping office with six staff saw the headlines on Wednesday and wanted to know two things: whether client files were safe, and whether every computer needed replacing.

Its website, which lets clients upload documents through a secure form, sits on a shared hosting account. The host had already posted a notice: patches over two nights, with restarts after midnight.

In the office, five computers installed their updates that afternoon. The sixth did not, because its antivirus subscription had lapsed months earlier and the update was waiting for it. Renewing it let the update through.

The file server in the back room needs its own update and a restart, booked for Friday evening after closing.

No computer was replaced. The work took an afternoon, and most of it was confirming that updates had actually installed.

What not to do

Do not replace hardware this month because of the headlines. Equipment bought today has the same flaws and will need the same updates.

Do not move hosts in a hurry either. Every host faces the same problem, and what matters is how well yours handles it, which you can find out by asking.

And do not skip the updates because the flaws sound theoretical. Now that the details are public, attempts to use them are likely to follow, and the updates are the protection.

The counter-case

For a small business, this is less dramatic than the coverage suggests.

So far nothing suggests these flaws have been used in attacks. Using them takes skill and code running on the target machine, and criminals have easier ways into most small offices: reused passwords, phishing emails and software nobody has updated.

Which means the right response is ordinary maintenance done promptly, not an emergency. The same habits protect against the easier attacks too.

Install the updates, ask the host, and keep doing both.

This week

1. Update every computer's operating system and restart.
2. Check that each update actually installed.
3. Update every browser on every machine.
4. Email your host about patches and restarts.
5. Update phones used for business email.
6. Patch any office server after hours.
7. Replace nothing because of the headlines.

Step two is the one most offices skip. An update held back by an old antivirus program, or waiting for a restart, protects nothing, and the computer looks exactly the same either way.

Deciding which parts of the site to raise with the host first follows from what your website was supposed to do.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.