Meltdown and Spectre are two critical vulnerabilities recently identified in modern processors. These vulnerabilities can allow unprivileged users to access memory belonging to other processes, including the kernel. Much of the initial coverage of these vulnerabilities centered on desktop, server, and cloud systems, but they affect mobile devices as well. Apple, Google, Linux, and Microsoft are now releasing patches to mitigate these issues.

These vulnerabilities were made public on January 3, 2018 by Google Project Zero. You can access the original research report here.

MobileIron recommendations to mitigate your risk

Meltdown and Spectre, like WannaCry several months ago (blog here), reinforce the importance of patching and keeping software up-to-date. With WannaCry, proactive patching would have mitigated the risk for most companies. With Meltdown and Spectre, IT administrators should be ready to update their software asap when patches, some of which are now available, are released by the developer of the operating system.

Here are some best practices to follow:

1. Patch early and often. Right now this is your best defense. Most OS vendors have already pushed patches for Meltdown. In addition, Safari and Chrome have been updated to mitigate many of the effects of Spectre. On Apple devices, you can update to iOS 11.2.2 and macOS 10.13.2 or later - see Apple’s website here. On Android 6.0 and higher, you can apply Security Patch Level 2018-01-05. Unfortunately, older versions of Android do not receive monthly security updates. For Windows, since patches vary based on the OS version, check the Microsoft Security Response Center here for the patch appropriate for your devices.
2. Use MobileIron tiered compliance. Use MobileIron to identify the version of the operating system currently installed on the user’s device. Set tiered compliance policies in MobileIron to notify the user to update the operating system to the desired version. If the user does not do so, use MobileIron to either wipe the company data on the device or block further server access through MobileIron Access and Sentry. This mitigates the risk of company data being compromised before the device is patched. Windows management also allows the creation of Update profiles to force a device to update and restart at a given time each day.
3. Stop malicious apps from exploiting the vulnerabilities. Use MobileIron to disable untrusted sources for installing apps. This prevents side loading, which is the path many malicious apps take to the device. Use MobileIron Threat Defense to detect malicious apps and device exploitation attempts through machine learning-based threat detection. You can then blacklist the apps and take remediation actions such as quarantine or wipe.
4. Reduce password exposure. These vulnerabilities can be exploited to steal data, including passwords. Use MobileIron Access to ensure that unmanaged or unpatched devices can’t access back-end services. MobileIron Access reduces exposure from compromised credentials by validating that the devices and apps accessing your infrastructure are secured, managed, and authorized.

Background on Meltdown and Spectre

Meltdown and Spectre are hardware vulnerabilities that allow a malicious process to gain unauthorized access to memory.

Meltdown enables an adversary to read the sensitive data of other processes or virtual machines. Spectre allows an attacker to induce a process to reveal data stored in its own memory. Because both are hardware vulnerabilities, they can be exploited across operating systems, unless the operating system has taken specific steps to prevent them.

Modern processors operate much faster than system memory (RAM), so they use a clever technique called “speculative execution” to avoid waiting on RAM. With this technique, a processor will guess at the outcome of a calculation and proceed as though that is the correct answer until the actual outcome is available. This increases compute efficiency. When the actual calculation is finished, the processor checks if its guess was correct. If so, it proceeds. If not, it throws away the temporary work and tries again with the correct outcome.

During speculative execution, all work is kept in a temporary space that is not supposed to be visible to programs running on the system. However, both Meltdown and Spectre can enable an attacker to identify which data the processor examined during speculative execution. Then, through a series of careful manipulations, an attacker can access the contents of memory.

Learn more about MobileIron EMM platform from the official brochure MobileIron. Managing corporate mobility.

If you have questions about MobileIron EMM Platform write us at: mobileiron@bakotech.com.