Protect your Windows devices against Spectre and Meltdown

To get the white papers on Meltdown & Spectre(and tons more technical information on the subject): Meltdown and Spectre

Meltdown
Meltdown breaks the most fundamental isolation between user applications and the operating system. This attack allows a program to access the memory, and thus also the secrets, of other programs and the operating system.

If your computer has a vulnerable processor and runs an unpatched operating system, it is not safe to work with sensitive information without the chance of leaking the information. This applies both to personal computers as well as cloud infrastructure. Luckily, there are software patches against Meltdown.

Spectre
Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre

Spectre is harder to exploit than Meltdown, but it is also harder to mitigate. However, it is possible to prevent specific known exploits based on Spectre through software patches.

gadgetbuilder said:

the timing of the whole meltdown/spectre thing is peculiar. The major players were alerted to the vulnerability in june 2017 and after discussion decided that they would announce the problem on january 9, 2018. Probably with the notion that it would get lost in the noise from ces. So here's a conspiracy theory... ;-)

intel and amd had considerable time to study the 3 vulnerabilities and figure out how their processors would be affected. Amd thought the impact on their processors would be minimal, withess their inital pronouncement when the news broke early. Intel realized meltdown mitigation would have more of an impact on their processors than on amd's so they decided to suggest a meltdown fix to be applied to both intel and amd processors. Tom lendacky, the linux guy at amd, figured this out and wrote a memo on december 26, 2017 stating that amd processors were not vulnerable to meltdown and should not have this fix applied: lkml: Tom lendacky: [patch] x86/cpu, x86/pti: Do not enable pti on amd processors

that tom lendacky memo caught the attention of others too and a few days later an article appeared in "the register" that exposed meltdown/spectre about a week earlier than planned.

When linus torvalds saw this memo he realized that intel was willing to compromise linux performance on amd machines so intel machines would not be the only ones to suffer a performance hit. This apparently triggered his well publicised intel rant.

I expect intel did the same thing with microsoft. Thus, both linux and ms had to scramble to re-code the changes they had been making to handle meltdown, likely leading to the win 10 releases that failed to boot on older amd processors - still, it's hard to excuse ms for failing to test on at least one older amd computer.

I've got two older amd machines with win 10 (so spectre 1 is patched). Neither is likely to ever see a bios update so there's little choice but to hope that amd's opinion is correct: Spectre 2 is very difficult to weaponize on amd. Even the toy versions of spectre 2 don't work reliably on amd according to the original reports.

aaaaaaaaaah!! Nooooooo!!!!! It's a conspiracy!!!

https://www.bleepingcomputer.com/new...e-mitigations/

I guess I was deleting my post as you were replying. I just went back to Intel and got the Intel ME FW Update Tool. It is dated 28Jan18 same as that InSpectre tool. Same result.

I got this HP Convertible at the end of December and it has an AMD A9 processor, even though I'm up to date with all necessary Windows updates and since upgraded the BIOS and UEFI firmware from HP for this machine that tool from Steve's site still showed Spectre Protected: NO!
I did read somewhere that even with the necessary patches and upgrades some machines could still be vulnerable though.