Windows Analytics Helps Assess Risk of Meltdown, Spectre Attacks

Microsoft is stepping up its efforts to help IT professionals better assess whether their Windows devices are protected against the industry-wide Meltdown and Spectre attack techniques.

Publicly detailed in the beginning of this year, the two attacks allow malicious applications to bypass memory isolation mechanisms and access potentially sensitive data. Residing in the processors themselves, the bugs affect billions of devices.

Tech companies were informed on the bugs last year and worked hard on releasing both software and firmware mitigations, but some of the patches added instability and their delivery was stopped. Microsoft too decided to disable mitigations for one Spectre attack variation as systems became unstable.

After halting the initial patches several weeks ago, Intel recently rolled out new microcode updates to address one of the Spectre vulnerabilities in its Skylake processors. IBM, Oracle, and many other vendors rushed to push out patches for the bugs as well, and malware that abuses the vulnerabilities emerged as well.

Being hardware-based security vulnerabilities, Meltdown and Spectre represent a challenge for the entire industry, Microsoft says. Not only are updates required for both CPU microcode (firmware) and the operating system, but the anti-virus has to be compatible with the patches as well, at least on Windows.

To help IT professionals assess whether the Windows devices in their networks are protected against Spectre and Meltdown, Microsoft has added new capabilities to its free Windows Analytics service.

With the help of these new features, admins can access reports on the status of all Windows devices they manage, Terry Myerson, Executive Vice President, Windows and Devices Group, explains.

Now, admins can learn whether the anti-virus (AV) software is compatible with the required Windows OS updates, thus knowing whether it is safe or not to install the patches.

Furthermore, information on which Windows security update is running on a managed device and if any of these updates have been disabled is now available (IT administrators have the option to install the security update but disable the fix).

Now, Windows Analytics also offers details on the firmware installed on the device, providing information on whether the firmware includes the specific protections required. This insight, however, will be initially limited to the list of approved and available firmware security updates from Intel.

“We will be adding other CPU (chipset) partners’ data as it becomes available to Microsoft,” Myerson points out.

Windows Analytics is currently running on millions of devices, Microsoft says. The newly included capabilities will be available on all Windows 7 SP1, Windows 8.1 and Windows 10 devices running the service.

Related: Intel Releases New Spectre Patches for Skylake CPUs

Related: Malware Exploiting Spectre, Meltdown Flaws Emerges