您现在的位置: 纽约时报中英文网 >> 纽约时报中英文版 >> 商业 >> 正文


更新时间:2018-1-6 5:30:39 来源:纽约时报中文网 作者:佚名

Researchers Discover Two Major Flaws in the World’s Computers

SAN FRANCISCO — Computer security experts have discovered two major security flaws in the microprocessors inside nearly all of the world’s computers.


The two problems, called Meltdown and Spectre, could allow hackers to steal the entire memory contents of computers, including mobile devices, personal computers, servers running in so-called cloud computer networks.


There is no easy fix for Spectre, which could require redesigning the processors, according to researchers. As for Meltdown, the software patch needed to fix the issue could slow down computers by as much as 30 percent — an ugly situation for people used to fast downloads from their favorite online services.


“What actually happens with these flaws is different and what you do about them is different,” said Paul Kocher, a researcher who was an integral member of a team of researchers at big tech companies like Google and Rambus and in academia that discovered the flaws.

“各个漏洞的具体情况不同,解决方法也会不一样,”保罗·科克(Paul Kocher)说。科克曾是一个研究团队的重要成员,漏洞就是由这个团队发现的,该团队的研究人员都来自于谷歌、Rambus这样的大型科技公司或学术界。

Meltdown is a particular problem for the cloud computing services run by the likes of Amazon, Google and Microsoft. By Wednesday evening, Google and Microsoft said they had updated their systems to deal with the flaw.


Amazon told customers of its Amazon Web Services cloud service that the vulnerability “has existed for more than 20 years in modern processor architectures.” It said that it had already protected nearly all instances of AWS and that customers must update their own software running atop the service as well.

亚马逊告知使用亚马逊网络服务(Amazon Web Services,简称AWS)云服务的用户,称该漏洞“在现代处理器架构中已经存在了20多年”,并表示他们已经对AWS进行了全面防护,用户也必须升级自己在这些云服务上运行的软件。

To take advantage of Meltdown, hackers could rent space on a cloud service, just like any other business customer. Once they were on the service, the flaw would allow them to grab information like passwords from other customers.


That is a major threat to the way cloud-computing systems operate. Cloud services often share machines among many customers — and it is uncommon for, say, a single server to be dedicated to a single customer. Though security tools and protocols are intended to separate customers’ data, the recently discovered chip flaws would allow bad actors to circumvent these protections.


The personal computers used by consumers are also vulnerable, but hackers would have to first find a way to run software on a personal computer before they could gain access to information elsewhere on the machine. There are various ways that could happen: Attackers could fool consumers into downloading software in an email, from an app store or visiting an infected website.


According to the researchers, the Meltdown flaw affects virtually every microprocessor made by Intel, which makes chips used in more than 90 percent of the computer servers that underpin the internet and private business operations.


Customers of Microsoft, the maker of the Windows operating system, will need to install an update from the company to fix the problem. The worldwide community of coders that oversees the open-source Linux operating system, which runs about 30 percent of computer servers worldwide, has already posted a patch for that operating system. Apple had a partial fix for the problem and is expected to have an additional update.


The software patches could slow the performance of affected machines by 20 to 30 percent, said Andres Freund, an independent software developer who has tested the new Linux code. The researchers who discovered the flaws voiced similar concerns.

已对新的Linux代码进行了测试的独立软件开发人员安德烈斯·弗洛因德(Andres Freund)说,软件补丁可能会使受影响的计算机性能降低20%到30%。发现这两个漏洞的研究人员表达了类似的担忧。

This could become a significant issue for any business running websites and other software through cloud systems.


There is no evidence that hackers have taken advantage of the vulnerability — at least not yet. But once a security problem becomes public, computer users take a big risk if they do not install a patch to fix the issue. A so-called ransomware attack that hit computers around the world last year took advantage of machines that had not received a patch for a flaw in Windows software.


The other flaw, Spectre, affects most processors now in use, though the researchers believe this flaw is more difficult to exploit. There is no known fix for it, and it is not clear what chip makers like Intel will do to address the problem.


It is not certain what the disclosure of the chip issues will do to Intel’s business, and on Wednesday, the Silicon Valley giant played down the problem.


“Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed,” the company said in a statement. “Intel believes these exploits do not have the potential to corrupt, modify or delete data.”


Spectre will be much more difficult to deal with than issuing a software patch.


The Meltdown flaw is specific to Intel, but Spectre is a flaw in design that has been used by many processor manufacturers for decades. It affects virtually all microprocessors on the market, including chips made by AMD that share Intel’s design and the many chips based on designs from ARM in Britain.


Spectre is a problem in the fundamental way processors are designed, and the threat from Spectre is “going to live with us for decades,” said Kocher, the president and chief scientist at Cryptography Research, a division of Rambus.


“Whereas Meltdown is an urgent crisis, Spectre affects virtually all fast microprocessors,” Kocher said. An emphasis on speed while designing new chips has left them vulnerable to security issues, he said.

“Meltdown是一场紧急危机,但Spectre 影响的是几乎所高速微处理器,”科克说。他表示,设计新芯片时对速度的强调导致它们容易出现安全问题。

“We’ve really screwed up,” Kocher said. “There’s been this desire from the industry to be as fast as possible and secure at the same time. Spectre shows that you cannot have both.”


A fix may not be available for Spectre until a new generation of chips hit the market.


“This will be a festering problem over hardware life cycles. It’s not going to change tomorrow or the day after,” Kocher said. “It’s going to take a while.”