The IT Nerd

There’s nothing worse for a guy in my line of work to find out that a fix that remedies a critical bug is itself buggy. Case in point is the fixes that Intel put out for Spectre and Meltdown. Apparently they have bugs that cause system reboots:

Intel said today it is investigating an issue with Broadwell and Haswell CPUs after customers reported higher system reboot rates when they installed firmware updates for fixing the Spectre flaw.

The hardware vendor said these systems are both home computers and data center servers.

“We are working quickly with these customers to understand, diagnose and address this reboot issue, “said Navin Shenoy, executive vice president and general manager of the Data Center Group at Intel Corporation.

“If this requires a revised firmware update from Intel, we will distribute that update through the normal channels. We are also working directly with data center customers to discuss the issue,” Shenoy added.

The Intel exec said users shouldn’t feel discouraged by these snags and continue to install updates from OS makers and OEMs.

Sure, right. this really inspires confidence. I say that because it suggests that Intel rushed these fixes out the door to mitigate not only the threat, but the PR disaster that is in progress. Of course if that’s true it is not good. My advice to Intel is to get to the bottom of this quickly and do whatever is required to get working patches on the street that have been fully QA’ed. Because if you don’t, you’ll look like Apple and their ability to QA their products.

Here’s a new security issue for Intel to deal with that is really, really bad. F-Secure has discovered a security flaw in Intel’s Active Management Technology (AMT) can be used by attackers with physical access to get around authentication processes in seconds, effectively pwning the device. Here’s an overview of the security flaw:

The issue allows a local intruder to backdoor almost any corporate laptop in a matter of seconds, even if the BIOS password, TPM Pin, Bitlocker and login credentials are in place. No, we’re not making this stuff up.

According to F-Secure, this issue affects most corporate laptops and PCs running Intel AMT. And for the record AMT has had other security issues in the past. Now the F-Secure post has recommendations to mitigate this. But the’re not exactly quick and easy for companies to implement. Thus this is a problem that is should rightfully get a lot of attention until a solution is found for it.

Clearly 2018 hasn’t been a good year for Intel, and we’re only 12 days into 2018.

Intel CEO Brian Krzanich has posted an open letterto Intel customers following the Meltdown and Spectre vulnerabilities that impact its processors. In it he says among other things, these three points:

1. Customer-First Urgency: By Jan. 15, we will have issued updates for at least 90 percent of Intel CPUs introduced in the past five years, with updates for the remainder of these CPUs available by the end of January. We will then focus on issuing updates for older products as prioritized by our customers.

2. Transparent and Timely Communications: As we roll out software and firmware patches, we are learning a great deal. We know that impact on performance varies widely, based on the specific workload, platform configuration and mitigation technique. We commit to provide frequent progress reports of patch progress, performance data and other information. These can be found at the Intel.com website.

3. Ongoing Security Assurance: Our customers’ security is an ongoing priority, not a one-time event. To accelerate the security of the entire industry, we commit to publicly identify significant security vulnerabilities following rules of responsible disclosure and, further, we commit to working with the industry to share hardware innovations that will accelerate industry-level progress in dealing with side-channel attacks. We also commit to adding incremental funding for academic and independent research into potential security threats.

The cynic in me is saying that this is an attempt to mitigate the public relations nightmare that is in progress. But basically saying “Trust us, we’ll do better next time” doesn’t cut it. Here’s what Intel customers really want to hear:

1. How did this slip through the cracks and went undetected for so long?
2. What is Intel doing to make sure that this scenario never happens again.

If they did that, then this statement would have meant something. They didn’t thus it’s PR fluff that means nothing.