Foreshadow

The Foreshadow attack is a collection of vulnerabilities that let threat actors access CPU cache information inappropriately. Although it can't install threats or give an attacker control over your system, directly, it may be one step in a series of attacks for doing so. Users with Intel processors should install the appropriate security patches that remove the Foreshadow attack's vulnerability and, if necessary, run anti-malware scans for detecting any threats that an attacker could have previously installed.

A Foreshadowing of Troubles for Someone's CPU

In 2018, Belgium-based researchers revealed some of the details of a range of exploits that impacted Intel-brand CPUs. Unlike the Spoiler Vulnerability, patch-based mitigation was deemed practical, and Intel provides updates that reduce users' endangerment from the Foreshadow attack, which consists of vulnerabilities CVE-2018-3615, CVE-2018-3620, and CVE-2018-3646. This group of security weaknesses allows an attacker's access to normally-inaccessible information that could help their future infection efforts.

The Foreshadow attack, or L1 Terminal Fault, gives threat actors information that's in the 'level one' or built-in data caches of Intel processors. It always requires local user access, but may use a terminal page fault with or without guest privileges, and incorporates side-channel analysis. NG or Next-Generation variants of the Foreshadow attack can affect virtual machines, hypervisors, OS memory, and SMM memory, while the 'vanilla' version collects data from SGX enclaves.

Since the Foreshadow attack is overly-sophisticated and difficult-to-enact against arbitrary, random PC users, its possible impact is the highest against corporate entities, governments and NGOs. Alone, the Foreshadow attack doesn't grant a threat actor access to the user's passwords or other credentials, and it doesn't function as being a backdoor for installing unwanted software, but it can facilitate other actions for doing these things.

Staving Off the Shadow of Processor Problems

The Foreshadow attack affects a fairly robust range of CPUs, including Intel's i3, i5, and i7 processors, generations two through eight of Intel Core, the Intel Core-X series, Intel Xeon, and others. Users can consult the Intel website for a complete list of processors that are vulnerable to the Foreshadow attack. Installing appropriate security updates will reduce the risk from this flaw, and Intel no longer manufactures the designs that include it.

Users also should monitor their PCs regularly for signs of threats that may have relationships with the Foreshadow attack, the Spoiler Vulnerability and other exploits. Threat actors may drop backdoor Trojans that communicate with C&C servers regularly; network traffic-monitoring tools and firewalls can, in some cases, detect or block this flow of data. Always disable network connectivity when dealing with a threat that gives attackers access to your computer, and have anti-malware products scan the system for removing threats that a Foreshadow attack might have helped install.

The Foreshadow attack is a reasonably fixable example of the many security flaws in processor architecture. Since it affects such a range of products, users shouldn't underestimate the power of a little patch.