Slashdot Mirror

← Back to Stories (view on slashdot.org)

Malware Exploiting Spectre, Meltdown CPU Flaws Emerges (securityweek.com)

Posted by EditorDavid on from the side-channel-hustles dept.

wiredmikey quotes SecurityWeek: Researchers have discovered more than 130 malware samples designed to exploit the recently disclosed Spectre and Meltdown CPU vulnerabilities. While a majority of the samples appear to be in the testing phase, we could soon start seeing attacks... On Wednesday, antivirus testing firm AV-TEST told SecurityWeek that it has obtained 139 samples from various sources, including researchers, testers and antivirus companies... Fortinet, which also analyzed many of the samples, confirmed that a majority of them were based on available proof of concept code. Andreas Marx, CEO of AV-TEST, believes different groups are working on the PoC exploits to determine if they can be used for some purpose. "Most likely, malicious purposes at some point," he said.

4 of 84 comments (clear)

  1. Fearmongering bullshit article seeding FUD by klingens · · Score: 3, Insightful

    If a researcher, tester, AV company sends some PoC code opening calc.exe, then this is not malware! To be malware, some code has to be actually malicious, doing evil things like encrypting harddisks for ransom, sending spam, mining coins, etc.. Simply trying out a bug in existing software to get a better understanding or to write AV detection routines is not malware!

    Except maybe code from AV companies. That is probably always malware, no matter the intent or what it actually does

    1. Re:Fearmongering bullshit article seeding FUD by Baron_Yam · · Score: 5, Insightful

      >If a researcher, tester, AV company sends some PoC code opening calc.exe, then this is not malware!

      If a researcher, tester, AV company sends some PoC code opening calc.exe, then you can reasonably assume that malicious code based on the same exploit already exists and is probably further along.

    2. Re: Fearmongering bullshit article seeding FUD by Anonymous Coward · · Score: 4, Insightful

      The time from proof of concept to full blown malicious code in the wild is measured in days. I'm happy for you that you have such a comforting false sense of security, but others of us know better.

  2. Well duh. by Anonymous Coward · · Score: 4, Insightful

    Did you really expect this massive, gaping security hole, that got a metric fuckton of media coverage, to go unexploited?