Researchers have uncovered yet another flaw in Intel’s hardware — ZombieLoad.

It allows hackers to steal sensitive information directly from PCs, laptops, and even cloud processors. In can also allow attackers to eavesdrop on virtually every bit of raw data that a victim’s processor touches.

“ZombieLoad is a global problem,” suggests Venafi “because virtually every Intel chip in the world dating back to 2011 is vulnerable and the bug causes targeted processors to ‘leak’ sensitive data including passwords, private keys, and private messages.”

“Spying tools should never be underestimated, as they are constantly being tried and tested in the wild,” suggested Jake Moore, security specialist at ESET. But Moore was quick to point out that it isn’t just cybercriminals who like to eavesdrop on a target, the so-called good guys are not immune to the odd bit of eavesdropping. He cited EternalBlue as an example — exploited by actors on both sides.

Machine identities, Venafi, and why being quantum ready is good strategy for today, and not just when quantum computers arrive

Quantum computing maybe be a few years off, but there is more to being quantum ready than preparing for that day

“Things like code signing keys, TLS digital certificates, SSH keys are all incredibly valuable targets, and chip vulnerabilities like this make it possible for hackers to steal these critical security assets when running on nearby cloud and virtual machines,” said Kevin Bocek, VP of security strategy & threat intelligence at Venafi.

He added: “Security teams need to accept that they won’t be able to avoid vulnerabilities like ZombieLoad. Some security professionals have forgotten about Heartbleed, but this vulnerability proves that we should expect similar attacks in the future.”

Should your organisation renew its focus on hardware?

As the demand on the computing infrastructure increases beyond what cloud infrastructure can handle, is it time to rethink hardware?

So what can be done about ZombieLoad?

“Security teams need to focus on protecting the keys and certificates attackers are targeting. Properly responding to a chip vulnerability requires complete visibility of where all keys and certificates are located, intelligence on how they are being used and the automation to replace them in seconds, not days or weeks,” said Bocek.

Dry rehearsal

One day, quantum computing, with all its security flaws will arrive. But Venafi argues that the practice of automating the regular changing of machine identities and certificates will not only help protect against dangers from threats such as ZombieLoad, but help prepare for quantum computers.

“Security professionals should consider vulnerabilities like ZombieLoad a dress rehearsal for the day quantum computing breaks all machine identities,” said Bocek.

Nominations are OPEN for the Tech Leaders Awards, organised by Information Age and taking place on 12th September 2019 at the Royal Lancaster, London. Categories include CIO of the Year, CTO of the Year, Digital Leader of the Year and Security Leader of the Year. Recognise and reward excellence in the tech industry by submitting a nomination today