• Competitor rules

    Please remember that any mention of competitors, hinting at competitors or offering to provide details of competitors will result in an account suspension. The full rules can be found under the 'Terms and Rules' link in the bottom right corner of your screen. Just don't mention competitors in any way, shape or form and you'll be OK.

Intel bug incoming? Meltdown and Spectre exploits

Steampunk said:
You need to check that. That is how it works, but a lot of those won't let you load settings in from a different version of the BIOS. ie it's fine for/loading saving different settings on the same BIOS, but won't help you if you update the BIOS and expect to load the old settings into the new BIOS.
Click to expand...

Ah, damn. That sucks. I'll see what I need to do. Failing that it might be time to take a photo of every BIOS screen and then just copy the settings by hand.
 
No comment from ASUS yet .. I usually avoid BIOS updates like the plague but it looks like I'm going to have to do it this time.
 
Homer-Simpson said:
For people that want to catch up on this quickly, I'd recommend looking at the slides below:

https://www.renditioninfosec.com/files/Rendition_Infosec_Meltdown_and_Spectre.pdf

and the recorded webinar can be found here:

Click to expand...

Thanks this was very detailed, however it didn't confirm whether the pending Windows patch would be enough if you haven't also updated your BIOS which I assume is to rebake in the Intel Management Engine firmware with the latest fixed version.
 
Cromulent said:
OK so apparently my motherboard has an Overclocking profile thing in the BIOS where you can save your BIOS settings to a file on a USB drive. Am I right in thinking that to update the BIOS all I need to do is save the settings to USB, update the BIOS and then load the settings back again? I really hope the update process is easy.
Click to expand...

If your BIOS allows you to take screenshots I would do that of each page of your BIOS settings as not all updated BIOS's allow you to use the settings from a previous BIOS version.
 
thenewoc said:
Thanks this was very detailed, however it didn't confirm whether the pending Windows patch would be enough if you haven't also updated your BIOS which I assume is to rebake in the Intel Management Engine firmware with the latest fixed version.
Click to expand...

The answer to that is no (and this doesn't relate to the ME vulnerabilities discovered last year), the MS patch isn't enough to fully mitigate the issues.

More information can be found here for servers - https://support.microsoft.com/en-us...-to-protect-against-the-speculative-execution

and here for the desktop OS - https://support.microsoft.com/en-us...ive-execution-side-channel-vulnerabilities-in

Warning

Customers who only install the Windows January 2018 security updates will not receive the benefit of all known protections against the vulnerabilities. In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer.


Note Surface customers will receive a microcode update via Windows update.
Click to expand...

Main things to note, you need an AV that is adding the reg-key for the patch to be installed. If you're on a Windows server OS then you will also need to add reg-keys AFTER the patch install to enable the fix.

There is also a powershell module that you can install to verify the status of the machine.
 
Rossi~ said:
Are you running the latest version?

Here are the KBs for different versions:

1709 - https://support.microsoft.com/kb/4056892

1703 - https://support.microsoft.com/kb/4056891

1607 - https://support.microsoft.com/kb/4056890

1511 - https://support.microsoft.com/kb/4056888


Are you running any of these AV applications:


Vendor

Product

Sets registry key

Supported


Sophos
Anti-Virus and Central

N
N

Symantec
Endpoint Protection

N
N

Trend Micro

N
N

Webroot

N
Y

Cyren
F-PROT

N
?

EMSI
Anti-Malware

N
N

Intel
McAfee

?
?

Carbon Black

N
N


edit: Sorry, formatting lost in paste.
Click to expand...

Yeah latest window 10 only recently fresh install from the creator update. Anti virus software I using is avast.
 
Can anyone confirm that disabling the windows update service stops the patches?

We have a bunch of vms including database servers in test environments where security is no issue but performance is.
 
Energize said:
Can anyone confirm that disabling the windows update service stops the patches?

We have a bunch of vms including database servers in test environments where security is no issue but performance is.
Click to expand...

Do not do this, if it's a Windows Server OS then the patch will apply BUT it will not be enabled. Please read the MS articles.

You have to manually enable the patch (you have to add 2 reg-keys), which will then potentially cause/give a performance impact.

EDIT: I would seriously recommend you also read this article - https://support.microsoft.com/en-us/help/4073225/guidance-for-sql-server
 
Last edited:
beany_bot said:
Sorry. Why are people updating BIOS now?
Click to expand...

Because you need a BIOS update / CPU microcode patch to fix the security issues. If your motherboard maker hasn't released an update in the last 24 hours then wait until they do and update as soon as possible. These security issues can't just be fixed by an operating system patch, you need a BIOS update / CPU microcode fix.
 
Bonjour said:
VMware 5.5 or 6? I'm not seeing any patch for 5.5 as of yet.
Click to expand...
Those and some 5.1 which doesn't look to be supported. It seems that firmware upgrades are not needed to cover off Meltdown but does the other exploits so it isn't quite as urgent to do those over the software updates.
 
Cromulent said:
Because you need a BIOS update / CPU microcode patch to fix the security issues. If your motherboard maker hasn't released an update in the last 24 hours then wait until they do and update as soon as possible. These security issues can't just be fixed by an operating system patch, you need a BIOS update / CPU microcode fix.
Click to expand...
TBH i cant see the majority of pcs getting a bios fix Unless your on a reasonably recent chipset
 
You must log in or register to reply here.
Back
Top Bottom