What a start to the year for information security this year. The last year ended with a lot of speculation about page table isolation work in Linux kernel. The new year kicked off with details about the vulnerability sparking all these changes.
Meltdown and Spectre
You probably heard about Meltdown and Spectre about now.
Basically they are CPU bugs in all major CPUs. Meltdown, the most severe one, only seems to effect Intel CPUs while Spectre, less severe, affects pretty much all CPUs. CERT even goes so far that it says the only way to really fix the issue is to replace CPUs.
The Meltdown and Spectre page has all the information you need about both vulnerabilities and the mitigation of it.
macOS bug in IOHIDFamily
A new macOS vulnerability called IOHIDeous was made public, but ceased to function under 10.3.2, which coincidently also has the meltdown patches for macOS.
IOHIDFamily has been notorious in the past for the many race conditions it contained, which ultimately lead to large parts of it being rewritten to make use of command gates, as well as large parts being locked down by means of entitlements. I was originally looking through its source in the hope of finding a low-hanging fruit that would let me compromise an iOS kernel, but what I didn’t know it then is that some parts of IOHIDFamily exist only on macOS - specifically IOHIDSystem, which contains the vulnerability discussed herein.
On affected systems this is a local privelege escalation.
Ad networks stealing your credentials
And then it turns out Ad networks are stealing your credentials. By tricking your browser into auto filling hidden fields and submitting them to their servers. As a result you cannot trust the password manager extensions in your browser if you use the autofill functionality of the browser.
A couple of days ago I wrote about what you can do to protect yourselves. Although it is a little less convenient, it greatly increases your security.