THE timing could hardly have been worse. Just as the tech industry was preparing for its big annual trade show, CES, held this week in Las Vegas, it was hit by one of the most worrying computer-security scares of recent times. On January 3rd it emerged that most microprocessors, the brains of electronic devices, are vulnerable to hacker attacks aimed at stealing sensitive data, such as passwords or encryption keys. Instead of enthusing over the new gadgets presented at the event (see article), many attending discussed only one question: how great would the damage be?

Once the weaknesses became public earlier this month (researchers had first discovered them in June), some cyber-security experts said the only full protection would be to replace all affected processors. The problem is baked into the chips and enables two separate, but similar, attacks. The first, called Meltdown, makes it possible to dissolve the virtual walls separating the digital memory used by different programs, letting hackers extract data. The second, Spectre, enables a rogue program to trick a legitimate one running on the same computer to divulge information.

The scale of the threat can be overplayed. Computer firms have been toiling for months on software “workarounds” to fix the weaknesses and these are being deployed. By around January 13th, says Intel, a chipmaker, such programs will be available for more than 90% of its products. The question now is whether any attacks will occur outside the confines of a research lab, says Linley Gwennap of the Linley Group, a consultancy (lab researchers already have code running that exploits the flaws). Some predict that Meltdown will soon be forgotten, but that Spectre will plague computers for years because it offers many avenues of attack.

Even if hackers never pounce, however, the fact that the flaws have to be addressed means they will have an economic impact. Almost any computer can theoretically be attacked, but providers of cloud-computing services, such as Amazon Web Services and Google, are most vulnerable. Individual machines in the firms’ data centres often process jobs from many clients at once; hackers could rent capacity on them to get information from their virtual neighbours. These companies had already started to roll out patches before the design flaws became widely known.

In the case of Meltdown the patches come at a cost: they lower a computer’s performance. Firms say they have not yet seen a big impact, but even a few percentage points of number-crunching power matter, says Stacy Rasgon of Bernstein Research. In the case of Google, whose data centres are said to house more than 1m servers, the performance impact could amount to the equivalent of tens of thousands of servers. Cloud providers are likely to demand compensation from Intel, which makes most of the processors used in data centres.

Intel has already been hit by at least three class-action lawsuits over these vulnerabilities. If they do get exploited at scale, the firm could face a public-relations disaster similar to one in 1994 when news emerged of a bug that caused its Pentium processors occasionally to divide numbers incorrectly. Although the flaw did not affect most users, Intel was forced to replace many processors, leading to a $475m charge against its earnings.

The chip giant maintains that this time is different, noting that back then the problem stemmed from a bona-fide bug in its chips; now it is the result of a weakness in the way that most processors are designed, which also affects products from other chip firms, including AMD and ARM. Yet even if the firm does not take a financial hit, the episode will have made its chief executive, Brian Krzanich, look bad. In late November, nearly six months after Intel was warned of the vulnerabilities, he sold Intel shares worth $39m. The firm says that the sale was unrelated and executed under an automated trading plan, but this scheme was set up in October.

Mr Krzanich could do without the distraction, since Intel has other, bigger problems. It still reigns over the markets for chips that power personal computers and standard servers in data centres. Yet the action in the semiconductor industry has shifted to processors that excel at processing reams of data for artificial-intelligence services, such as those sold by NVIDIA. Intel is not standing still. It has bought Nervana Systems, an AI tech firm. But it has yet to prove itself in this new world.

Meltdown and Spectre are also likely to lead to soul-searching in the computer industry as a whole. Paul Kocher, one of the researchers who found the vulnerabilities, has said that they are chiefly a result of putting performance ahead of security. They stem from efforts to accelerate computers that date back to the 1990s. In order to save valuable nanoseconds when running a program, processors tackle some snippets of code ahead of time, a trick called “speculative execution”. Hackers can use bits of information that are not needed and are discarded, to their advantage.

There is no easy fix to this. Speculative execution is as fundamental to the working of modern chips as assembly lines are to a modern factory. More broadly, the economic incentives in the computing business favour speed and sharing over security, which promotes brittleness and fragility. The computer industry will survive this one-two punch, but other blows are bound to keep landing.

Source: economist
Spectre and Meltdown prompt tech industry soul-searching