On January 2nd, 2018, The Register reported a security design flaw impacting all Intel processors that have been manufactured within the last decade. You can read about the design flaw here as originally reported. The information contained dips into some very technical detail, and there's a lot of confusion out in the internet regarding this topic. We want to communicate the essential details about the situation to minimize confusion and worry.
Don't have time to read the article? That's okay. Just make sure you stay current on macOS and iOS updates on all of your Apple devices. Check under the "That sounds scary! What should I do?" section when you have time.
The Issue Explained
There are two vulnerabilities that have been discovered to impact Intel processors. They have been named "Meltdown" and "Spectre" by security researchers. In practical terms, these vulnerabilities could allow an attacker to access and steal data from the memory of currently running applications. This includes programs such as password managers and browsers, and can also allow an attacker to access e-mails, photos, and documents. Any data could be vulnerable.
As these are vulnerabilities rooted in the CPU itself, this impacts PCs, Macs, Linux-based operating systems, as long as they have an Intel processor.
That sounds scary! What should I do?
Let's first cover what you need to do the address the security flaw, as that is the biggest concern. Much of this information is sourced from the "How Apple Users can protect themselves against Spectre and Meltdown" article in Computerworld.
- Keep Current on OS Updates. Apple has released a patch to macOS High Sierra (10.13.2) that protects against Meltdown and Spectre. iOS has also been patched (11.2). Check frequently for OS updates. Contact Apple for information regarding older versions of macOS and iOS.
- Feel free to call MacPractice Support if updating your OS from El Capitan to Sierra, or Sierra to High Sierra. We can review your currently released build of MacPractice and advise you on how best to proceed.
- Use and update the Safari browser instead of third party browsers for the time being. Apple has updated Safari to 11.0.2, which protects against Spectre. Keep current on Safari updates.
If you must use a third party browser, also keep it fully updated. We strongly recommend avoiding use of other browsers such as Google Chrome for the time being unless necessary.
- Only download apps from the App Store, and trusted vendors. Most applications in the App Store have been vetted by Apple, and thus should be safe to use.
- Don't click on unknown links. This advice will always hold true. If you don't know where a link will take you, be extremely cautious. When in doubt, don't follow the link.
What about CPU performance?
A truly unfortunate side effect of this vulnerability is that the fix can cause a slowdown to your CPU. Early estimates touted a 5% to 30% dip in performance. Actual results haven't been thoroughly benchmarked yet, but the impact seems to be a bit on the lighter side. Your results may vary. For what it's worth, Apple has stated that their mitigations do not have any measurable impact on device performance.
There will be much more research and more information coming out in the weeks to come, so it's important to keep informed.