Google Cloud offers updates on Spectre and Meltdown flaws
While the recently disclosed Spectre and Meltdown vulnerabilities found in x86 microprocessors has sent Intel and its fellow chip makers scrambling to address the issues, the big cloud providers, especially Google, have managed to weather the storm better, reports Enterprise Cloud News (FinTech Futures‘ sister publication).
When these CPU flaws were first discovered earlier this month, the big public cloud players – Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform – all launched software patches to try and protect custom data residing in their cloud.
In those initial patches, Google noted that its Project Zero team had begun looking at and addressing some of the issues related to the Spectre and Meltdown issues in 2017.
The Google Cloud team published a lengthier post detailing some of the additional steps the company has taken to address the issue since December. For customers, the good news is that almost no one noticed what Google did under-the-hood.
“By December, all Google Cloud Platform (GCP) services had protections in place for all known variants of the vulnerability,” according to the post. “During the entire update process, nobody noticed: we received no customer support tickets related to the updates.”
The flaws that became known as Spectre and Meltdown were first detailed in research paper published by Graz University of Technology in Austria. The research found that by manipulating pre-executed commands within the chip, which help make data available faster, hackers can gain access to the content of the kernel memory.
The security is that this flaw can allow a hacker to gain access to encryption keys and other authentication details of whatever system the CPU is running in.
As many have noted, this flaw has been known for about 20 years. The issue, however, is that chips cannot be patched and the correction as to be done through software and the operating system, which includes Windows, Linux and the macOS. In turn, this has caused shutdown and performance issues in different devices. The Google Cloud team was looking to avoid all that.
Especially with the Spectre flaw, the vulnerability meant that different applications utilising the CPU could “see” each other’s private memory. This could expose data in one app to the other and allows a hacker to see that information. There are about three variants to this particular flaw and Google’s engineers worried most about variant 2.
However, Paul Turner, a software engineer who is part of the technical infrastructure group came up with an approach called retpoline, a binary modification technique that prevents branch-target-injection. This allowed key performance issues to continue and ensured that an attacker could not take advantage of the flaw by manipulating the execution commands.
As Google explains: “With retpoline, we could protect our infrastructure at compile-time, with no source-code modifications. Furthermore, testing this feature, particularly when combined with optimisations such as software branch prediction hints, demonstrated that this protection came with almost no performance loss.”
With retpoline in place, Google rolled out the patches almost unnoticed through its cloud infrastructure in December before news spread of vulnerability in early January.
