Google Says Spectre Flaws Cannot Be Defeated By Software Alone

Spectre and Meltdown attacks were initially discovered in early 2018. Following which, many security researchers have tried and tested different methods to put an end to the security flaws.

However, researchers at Google have concluded that Spectre-type vulnerabilities are most likely to sustain as a feature in processors. Therefore, software-based techniques alone are inadequate to overcome them and opting for software defenses will impose a high-performance cost.

To give you a background, Spectre and Meltdown attacks take advantage of the speculative execution of modern processors. In other words, processors assume that let’s say, a condition will be true or false. If the condition turns out true, the speculative results are kept; otherwise, the results are discarded if turned false.

Earlier, it was assumed that the speculative execution is entirely invisible to running programs, given it’s a feature of implementations. However, Spectre and Meltdown researchers discovered that some evidence of false speculation is left behind.

An attacker can hijack this data through a side-channel. On top of that, attackers can trick computers into loading sensitive data such as passwords, account information, etc.

Developers have opted for different software-based techniques such as preventing the processor to execute sensitive information or making the programs more secure by sandboxing the process.

While these software techniques are useful, Google’s research asserts that the fix is more of a trade-off. The researchers demonstrated this in Google Chrome browser where safeguarding against the Spectre-style attacks added a massive drop in the performance.

All in all, the Spectre flaws cannot be fixed merely with software and hardware mitigation doesn’t seem like a choice; considering speculative execution is an important part of every modern processor. As the Google researchers rightly put it in the published study — Spectre is here to stay.