Straight Talk on Meltdown and Spectre Vulnerabilities

meltdown and spectreIf you pay any attention to technology news, you’ve certainly heard of Meltdown and Spectre. These exploits, both attacking the same core vulnerability, have even received a fair amount of mainstream news coverage. The reason these exploits are receiving so much media coverage is that unlike almost every other computer security issue, the root vulnerability is not located in software but rather in the core hardware of any computing device – the CPU (or more commonly, the “processor”). Practically speaking, because the vulnerability is a flaw in hardware, it is not possible to completely prevent these exploits without replacing the processor. Additionally, almost every processor in every commonly used technology device (computers, smartphones, tablets, etc.) is affected. As bad as this problem sounds, and yes this is a really bad flaw, the practical implications are probably much less frightening for the vast majority of technology users than originally reported.

The first thing to keep in mind is that while the exploits have been given scary sounding names, they are NOT viruses. In other words, there is not an actual attack currently in the wild. So for all the alarms being raised in the media, there is currently no immediate danger. All that was disclosed was the description of the root vulnerability (a security flaw in the design of a CPU’s “speculative execution” feature) and the exploits possible (named Meltdown and Spectre). What the exploits are able to do is read data out of computer memory that is supposed to be protected. Things like passwords and security information that should not be possible to be accessed by ordinary software can be extracted with these exploits.

While the root vulnerability is very serious, actually implementing an attack will require a way to deliver malicious code. In other words, a malware/virus will need to be created to carry out the Meltdown or Spectre exploits. Because any malware attempting to perform a Meltdown or Spectre attack would be able to be mitigated just as any other malware can, standard security precautions should in practice protect most technology users and their data. Additionally, operating system developers have been releasing patches that significantly mitigate the risks from Meltdown and Spectre, making it much harder to actually gather sensitive data with a successful attack. So for systems that have been updated to protect against these new exploits, the risk is greatly reduced. All that being said, however, the disclosure this vulnerability in a key architectural function of the processors we use in all our technology devices should serve as a wake-up call for everyone to review their key security practices.

The key thing to keep in mind is that the more secure your base technology platform is, the more secure you will be from exploits such as Meltdown and Spectre, as well as any malware in general. For example, while the processors used in the iPhone and iPad are technically vulnerable to these exploits, since delivering malware to an iOS device is practically impossible there is almost no risk to these devices. On platforms that are more susceptible to malware (i.e. Windows, Android) continued vigilance to security best practices continues to be an important priority, even more so now.

The bottom line is that for as scary as the Meltdown and Spectre exploits appear to be, they are simply just another vulnerability for criminal malware to take advantage of. True, this particular vulnerability may not be completely fixable until sometime in the future when we are able to purchase new technology devices with redesigned processors, but patches from operating system developers and adequate security precautions should mitigate the risk for most technology users.
Sourced from: http://pcrevive.org/areas-we-serve/computer-repair-lake-worth-fl/

If you have any questions about protecting your technology and data, please don’t hesitate to ask me a question!

Holiday Tech Toys 2017

holiday tech toysTen years ago I wrote my first Holiday Tech Toys article. Looking back, it is fun to look at the evolution of technology during those 10 years. This year, I decided to focus my tech toys on the rapidly emerging field of home automation. I predict that home automation technology will be one of the hottest tech markets in the coming years and it is poised to make a splash this holiday season. So to help you all out, here are some great home automation products.

Voice Assistant Devices: Amazon Echo Dot, Google Home Mini

I’m sure you’ve seen the ever increasing number of commercials on TV showcasing the Amazon Alexa and Google Assistant services. You just ask your voice assistant device a question and it gives you the answer! Or you tell it to turn on some lights and it magically obeys your command! Yes, when properly set up a voice assistant can seem like magic. The great news is that Amazon and Google have created small versions of their voice assistants with similarly small prices (especially now during the holiday shopping season). The Amazon Echo Dot and the Google Home Mini each tie into their respective services and with holiday sale pricing both cost just under $30. Apple was set to join the game with their HomePod speaker/voice assistant device but the ship date for that product has slipped to early 2018 and it was also set to cost $399. However, if you have an iPhone, you can use Siri to control your home automation devices just the same. More on that later.

Ring Wi-Fi Smart Video Doorbell

One of the more practical “smart” product lines getting some attention recently has been the video doorbell. It is basically a doorbell with a video camera that can be accessed remotely through your smartphone, whether you are at home or away. It is basically a high-tech peephole that lets you see who is at your door or who may be hanging around your porch area. But you can also communicate with them, which can be very useful if you are not at home and are waiting for a package or if you want to talk to whomever is at your door. You may have heard stories, especially around the holiday season, of people scaring off potential package thieves by interacting with them through their video doorbell systems. The Ring is one of the more popular models and it is currently on sale from most vendors.

ecobee4 Wi-Fi Thermostat with Room Sensor

Smart thermostats were one of the earliest examples of the new generation of home automation devices that included Wi-Fi connectivity and smartphone integration. The Nest was the device that kicked it off and is probably the most well-known example of the smart thermostat, but there are others that are worth strong consideration, especially if you are an Apple device owner. I like the ecobee4 because it integrates with Apple’s HomeKit platform (along with Alexa and Google Assistant) unlike the Nest which currently excludes HomeKit integration. But also the ecobee4 also has built-in functionality to set up room sensors around the house which help the main thermostat more accurately control temperatures, saving money in theory as compared to a device that can only measure temperatures in one location.

iHome iSP6 SmartPlug

One of the simplest ways to begin automating a home is through the use of smart outlets, such as the iHome iSP6. These devices simply plug into the wall and then any supported device can be automated. Common types of devices include lamps or fans. The iSP6 can control small home appliances up to 1800 watts. I like the iHome iSP6 SmartPlug because it is relatively inexpensive (under $30 per unit, especially with holiday sales), yet it supports the three major home automation platforms (Apple HomeKit, Amazon Alexa, Google Assistant). Other companies are deploying smart outlets are coming into the market that offer similar functionality at similar price points.

Insignia Wi-Fi Smart In-Wall Light Switch

As I just mentioned, more companies are starting to jump into the home automation market with low cost yet full functioning modules. Best Buy with their Insignia brand are one of those companies. As an example, their Wi-Fi Smart In-Wall Light Switch allows one to replace a regular switch with a smart switch that can be controlled by the three major home automation platforms at a price point under 30 dollars (with holiday sales currently). Smart switches like these can be a great way to automate things like lights without needing to replace every light bulb in fixture, saving money in the long run.

Chamberlain B970 Smart Garage Door Opener

Garage door openers are a very convenient and safety oriented device to have automated. I can tell you from personal experience that it is nice to be able to open or close my garage door from anywhere in the world and also receive alerts if it is left open for a certain amount of time. The Chamberlain Model #B970 is a great example of a fairly low cost garage door opener that has built-in home automation features including Wi-Fi connectivity out of the box. There are also adapters available for existing garage door openers such as the Chamberlain MyQ Smart Garage Hub that offer very similar functionality.

Linksys Velop Wireless Mesh Network

As homes become filled with more and more wireless devices, including home automation devices like the ones I feature in this article, the need for a robust and reliable wireless network becomes even more critical. In the past, some larger or older homes were very difficult to adequately cover with a strong wireless signal. Luckily in the last year, a number of newer generation wireless devices that use a technology called “mesh networking” have been introduced in to the market. Basically, mesh devices create a wireless network that uses multiple wireless access points instead of just one as most wireless routers do. Unlike the “boosters” many people have tried to deploy that generally don’t work very well, mesh devices are designed to create a unified wireless network that covers an entire building seamlessly. In my experience so far, mesh networks work far better than traditional wireless devices at covering larger areas. The Linksys Velop units have gotten very good reviews and I’ve had good luck with them on a handful of deployments recently.

Apple iPhone X

For many people, their smartphone is the virtual hub of their home automation system, so including the iPhone X on this list made sense to me. Of course, any iPhone will serve well as a home automation control device, but the iPhone X is Apple’s top tier phone at this time. One thing to note is that while Apple’s entry into the voice assistant device category is delayed, Siri voice control built in to every iPhone continues to work well as a mobile voice assistant. In fact, by using the “hey Siri” functionality, one may not even need a standalone voice assistant if they keep their iPhone near them most of the time. Apple Watch users will also generally have access to Siri on their wrist at all times too.

August HomeKit Bluetooth Deadbolt Retrofit Smart Lock

To wrap up my home automation Holiday Tech Toys list, I feature a smart door lock that can be retrofitted onto existing deadbolts. The August HomeKit Bluetooth Deadbolt Retrofit Smart Lock works with the 3 major home automation platforms and can be used to automatically lock and unlock your door. It can automatically unlock as you approach with your smartphone, or your can remotely unlock it using an app or with voice command. You can also assign virtual keys to other people such as cleaning people or pet sitters. Note that you may need an August Connect Wi-Fi Bridge in order to use the remote control features, unless you have an Apple TV 4th Generation device within Bluetooth range of the door lock.

Shop for Tech Gifts Smartly

My general advice for holiday shopping is to purchase from a place that has a good return policy, since it can be difficult to purchase the right technology as a gift. However, also make sure to NOT open the original packaging of a technology gift if there is any chance of it being returned. Once the original packaging is opened, unless there is a problem with the device, returning it simply because the recipient didn’t like it will usually incur a re-stocking fee.

Marcel Brown is the most trusted name in technology. If you need help or have questions about these or any other technologies, please feel free to contact him or post your question in the Q&A section of his website. You may also follow him on Facebook or Twitter.