Probably you did not grasp the workings of the Spectre bug.
Explained in layman’s terms, sort of going like this to get info out of a box (browser cache in this case, where it should not leave your system, they question the CPU cache and this could cheat on confidential info you don’t wanna share, but your chip will anyways.
Above is a check how your browser is vulnerable about this pre-cache CPU info cheating bug thingie, without overhyping it.
So we have to see connections now are being more secure, encryption more solid etc. until a new range of new non-vulnerable chips come into production.
Your chip is cheating inside the browser, wherever. it should because it was a stupid way of enhancing the speed with pre-guessing to make it faster. If they check say for G and get a fractional glimpse of G and then later the cache protection says Y, they still could have a good guess inside the CPU a fraction earlier it was indeed G they were after. Capito?
It is just that the bold headline is somewhat misleading when it only talks of CPU vulnerability but the test is only browser related.
So it was surprising when it is only checking your browser in isolation. For instance if your CPU isn’t vulnerable why check the browser. On this win10 system with the latest firefox version 57.0.4 (64-bit), it reports the browser isn’t vulnerable.
Though if I ran this test on my XP system with the ESR version of Firefox it may be different, but the major thing on my XP system is by all accounts my ‘old not modern’ CPU isn’t vulnerable.
Firefox and Google browser already patched to this as with most patching this will be only in a software manner,
as the Intel hardware design flaw/hole can only be patched with a new secure upcoming production line,
and this will not be with us until 2020.
As we know the flaw can be again abused through javascript played out within very tiny tiny time frames.
As we both have known now for a long time, blocking javascript to run inside a browser,
is the best security measurement one could take under all circumstances and for all kind of threats.
Just as it was discussed in the virus and worms makes it the more relevant on Webzilla abuse,
a Dutch hosting AS. Spamhaus just asked cloudproviders to give a bigger effort to fight off spam botnets.
Probably has to do with not all vendors gave you the necessary firmware updates.
Reason probably is through your video-card that still is vulnerable to Spectre.
Spectre should be mitigated only via a firmware hardware update,
and these will be finally due in at the end of this month.
The real definite mitigation of the Intel debacle needs a new hardware chip and that may,
taking a bit of debugging and the necessary testing scheduled for another two years :
So this means a lot of new laptops, computers, smartphones and all sort of IoT devices to buy,
or in need maintanance and a new “total recall” to speak with Schwartzenegger.
This Spectre/Meltdown debacle gonna cost us all.
The only laughing third party is commerce, they gonna get extra revenue big time.
Those that tested with this tool be extra careful,
your settings may have been changed by the test tool. :o
Nota Bene!
The use of the Ashampoo Spectre Meltdown CPU Checker will result that in Windows PowerShell the ExecutionPolicy for CurrenttUser is being set as, and will remain set as “Bypass”.
This while the standard setting should be “Undefined” or “Restricted” and not “Bypass”.
To check your PowerShell ExecutionPolicies and correct the settings,
open Windows PowerShell, through clicking right, Ëxecute as Admininstrator".
Inside Windows PowerShell, give in the following command:
Get-ExecutionPolicy -list
When for CurrentUser weergegeven is listed that ExecutionPolicy has been set as “Bypass”,
restore the default settings by giving in the followingt command:
Set-ExecutionPolicy -ExecutionPolicy Default -Scope CurrentUser
Or just not set this for CurrentUser but for all Scopes at a time:
Set-ExecutionPolicy -ExecutionPolicy Default
Chrome Site Isolation -> https://support.google.com/chrome/answer/7623121
If you are using Google Chrome or Chromium, please follow the steps below:
Type chrome://flags in the address bar and press Enter.
Scroll down the page and find “Strict site isolation” and press the Enable button.
Restart the Chrome browser. https://www.chromium.org/Home/chromium-security/ssca
My post was a direct response to RejZoR, he may well find this useful.
I’m on an old Core2Duo and as far as I can tell that too isn’t vulnerable.
The only thing you are vulnerable to is MS screwing up your system with a windows update for AMD chips, but they have now pulled windows updates for AMD chips.
SSL certificate is not installed. Click here to get a certificate.
Many systems are configured with firewalls that block SSH access. To successfully scan with the SSH Observatory,
access must be granted to Mozilla’s scanning system.
From June 2018 henceon Google Chrome browser will start to label all http websites as insecure,
this in order to come to a https only Internet, which will also better protect connections for their core business
and all data that they will be sending to their chocolate factory (including your private data) via non-public CDN,
so who will check their tracking and profiling and to whom they stand responsible?
;D