0

I have an un-patched 32-bit PC (no microcode is available) running Ubuntu 16.04.

If I will use just the guest account (not the administrator account) for browsing, would it be possible to steal the WiFi password?

Would it be possible to steal the administrator password of the PC?

marked as duplicate by Ipor Sircer, Stephen Kitt, Jeff Schaller, Kusalananda, LinuxSecurityFreak May 17 '18 at 5:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I do not understand the obsession of some with excessive downvoting of trivial questions. If you value your precious time so much, that you don't want to answer or comment, you should not be on SE. Excessive downvoting is not helpful to anyone. – ajeh May 16 '18 at 20:44
  • The nature of Meltdown and Spectre vulnerabilities lies in the possibility to obtain another processes's data in a malicious process. UNIX user access is not an obstacle for this sort of exploits. So using a guest account is a good idea in general, but will not help in this instance. – ajeh May 16 '18 at 20:46
0

I would advise you to do first things first:

  1. Upgrade your BIOS depending on the machine you are having, there might already be at least partial patch. Please check at your manufacturer site.

  2. Download spectre-meltdown-checker script from GitHub; direct link.

    Executing the script, you may verify, if your system is vulnerable.

    The script checks for all variants, namely:

    You can execute it immediately after download like this:

    sudo sh spectre-meltdown-checker.sh
    

    You will get results more or less similar to this:

    Image version:

    spectre + meltdown

    Text version:

    Checking for vulnerabilities on current system
    Kernel is Linux 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64
    CPU is Intel(R) Xeon(R) CPU E3-1225 v3 @ 3.20GHz
    
    Hardware check
    * Hardware support (CPU microcode) for mitigation techniques
      * Indirect Branch Restricted Speculation (IBRS)
        * SPEC_CTRL MSR is available:  YES
        * CPU indicates IBRS capability:  YES  (SPEC_CTRL feature bit)
      * Indirect Branch Prediction Barrier (IBPB)
        * PRED_CMD MSR is available:  YES
        * CPU indicates IBPB capability:  YES  (SPEC_CTRL feature bit)
      * Single Thread Indirect Branch Predictors (STIBP)
        * SPEC_CTRL MSR is available:  YES
        * CPU indicates STIBP capability:  YES  (Intel STIBP feature bit)
      * Enhanced IBRS (IBRS_ALL)
        * CPU indicates ARCH_CAPABILITIES MSR availability:  NO
        * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO
      * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO):  NO
      * CPU microcode is known to cause stability problems:  NO  (model 60 stepping 3 ucode 0x24 cpuid 0x306c3)
    * CPU vulnerability to the three speculative execution attack variants
      * Vulnerable to Variant 1:  YES
      * Vulnerable to Variant 2:  YES
      * Vulnerable to Variant 3:  YES
    
    CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
    * Mitigated according to the /sys interface:  YES  (Mitigation: __user pointer sanitization)
    * Kernel has array_index_mask_nospec (x86):  YES  (1 occurrence(s) found of 64 bits array_index_mask_nospec())
    * Kernel has the Red Hat/Ubuntu patch:  NO
    * Kernel has mask_nospec64 (arm):  NO
    > STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)
    
    CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
    * Mitigated according to the /sys interface:  YES  (Mitigation: Full generic retpoline, IBPB, IBRS_FW)
    * Mitigation 1
      * Kernel is compiled with IBRS support:  YES
        * IBRS enabled and active:  YES  (for firmware code only)
      * Kernel is compiled with IBPB support:  YES
        * IBPB enabled and active:  YES
    * Mitigation 2
      * Kernel has branch predictor hardening (arm):  NO
      * Kernel compiled with retpoline option:  YES
        * Kernel compiled with a retpoline-aware compiler:  YES  (kernel reports full retpoline compilation)
    > STATUS:  NOT VULNERABLE  (Full retpoline + IBPB are mitigating the vulnerability)
    
    CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
    * Mitigated according to the /sys interface:  YES  (Mitigation: PTI)
    * Kernel supports Page Table Isolation (PTI):  YES
      * PTI enabled and active:  YES
      * Reduced performance impact of PTI:  YES  (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
    * Running as a Xen PV DomU:  NO
    > STATUS:  NOT VULNERABLE  (Mitigation: PTI)
    
  3. Update your whole system, browsers including with:

    sudo apt-get update
    sudo apt-get dist-upgrade
    
0

Specifically Meltdown which affects Intel based CPUs for the most part without a microcode update to mitigate it can still be mitigated by the OS as long as you updated Ubuntu 16.04 recently.

Note that web browsers also need to be patched for Spectre so you also need an up to date web browser.

Spectre is much broader and there is no one patch for it. Basically the latest security updates are your best bet.

To check your web browser if its certainly vulnerable: https://xlab.tencent.com/special/spectre/spectre_check.html

  • "Note that web browsers also need to be patched for Meltdown" any source for that? As far as I understand, exploiting meltdown requires you to register a custom segmentation fault signal handler and dereference invalid pointers, and you can't do either in JavaScript. – NieDzejkob May 17 '18 at 12:01
  • @NieDzejkob Terms got mixed up here. I'm technically not wrong since I think of Meltdown as the set of Spectre-family vulnerabilities that are due to the design of Intel chips and this is true. But reading the literature its more specifically called Spectre Variant 1. However, Meltdown does not require anything you just said. – jdwolf May 18 '18 at 1:21
-1

Meltdown and Spectre can only be exploited by executing native code, something a website can't do normally (a. k. a. if everything is up to date and nothing is on fire in the world of other vulnerabilities). Using the guest account won't change whether an attack using Meltdown or Spectre is successful.

  • Your last sentence is correct, but the first one is wrong. It is possible for a browser to be compromised into running unauthorized code which would then exploit M&S vunerabilities. How realistic it is is a different topic. You should review your answer. – ajeh May 16 '18 at 20:47
  • @ajeh nor·mal (nôr′məl) adj. 1. Conforming with, adhering to, or constituting a norm, standard, pattern, level, or type; typical. I don't think it's typical for a browser to have unpatched vulnerabilities. – NieDzejkob May 16 '18 at 21:01
  • Discovering vulnerabilities and patching them takes time. Often there's large enough time span between that for whole lot of things to be exploited, and even before the discovery. Also average windows of vulnerability is 26 days ( en.m.wikipedia.org/wiki/… ) . That's enough for whole lot of hell to break loose – Sergiy Kolodyazhnyy May 16 '18 at 21:09
  • @NieDzejkob Meltdown and Spectre were exploitable using JavaScript, no need for native code; that has been mitigated in most browsers, but it’s not true that the vulnerabilities can only be exploited by executing native code. – Stephen Kitt May 16 '18 at 21:35
  • @NieDzejkob I will not pay attention to snappy tone, but to the point, vulnerabilites are being introduced and re-introduced all the time, especially in open-source code. Stating that M&S patching of all browsers is a done deal is extremely naive or arrogant depending on whether you are a part of a browser development team. Software is not something immutable and changes all the time. Only when Intel patches their CPUs, users may be confident to a degree. – ajeh May 16 '18 at 21:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.