The Elite Intel Team Still Fighting Meltdown and Spectre

Throughout 2018, researchers inside and outside Intel continued to find exploitable weaknesses related to Meltdown and Spectre class of 'speculative execution' vulnerabilities. Fixing many of them takes not just software patches, but conceptually rethinking how processors are made. From a report: At the center of these efforts for Intel is STORM, the company's strategic offensive research and mitigation group, a team of hackers from around the world tasked with heading off next-generation security threats. Reacting to speculative execution vulnerabilities in particular has taken extensive collaboration among product development teams, legacy architecture groups, outreach and communications departments to coordinate response, and security-focused research groups at Intel. STORM has been at the heart of the technical side. 'With Meltdown and Spectre we were very aggressive with how we approached this problem,' says Dhinesh Manoharan, who heads Intel's offensive security research division, which includes STORM. 'The amount of products that we needed to deal with and address and the pace in which we did this -- we set a really high bar.'

Intel's offensive security research team comprises about 60 people who focus on proactive security testing and in-depth investigations. STORM is a subset, about a dozen people who specifically work on prototyping exploits to show their practical impact. They help shed light on how far a vulnerability really extends, while also pointing to potential mitigations. The strategy helped them catch as many variants as possible of the speculative execution vulnerabilities that emerged in a slow trickle throughout 2018. 'Every time a new state of the art capability or attack is discovered we need to keep tracking it, doing work on it, and making sure that our technologies are still resilient,' says Rodrigo Branco, who heads STORM. 'It was no different for Spectre and Meltdown. The only difference in that case is the size, because it also affected other companies and the industry as a whole.'

Read more of this story at Slashdot.