Recently in Corporate Category

Overview

On Wednesday, January 3rd, researchers from Google Project Zero, Cyberus Technology, Graz University of Technology, and other organizations released details about a pair of related vulnerabilities, dubbed Meltdown and Spectre.  These vulnerabilities appear to affect all modern processors and enables malicious code to read sensitive portions of memory on nearly all systems, including computers and mobile devices.  

Akamai is aware of side-effects of "speculative execution", the core capabilities that enable the Meltdown and Spectre vulnerabilities.   We are testing the performance and efficacy of the available patches on our systems.  Because of our technical approach to handling data of many customers, we do not believe these vulnerabilities pose a significant threat to the Akamai platform. Akamai does not rely on the capabilities that enable these vulnerabilities.  We will continue to update further, as more details become public.

Details

All modern CPU architectures use a technique called "speculative execution", including Intel, AMD, and ARM.  This technique takes advantage of times when the CPU is waiting for a slow process, such as reading or writing to main memory, to proactively perform tasks predicted from the current activities.  This speeds up overall processing by completing tasks before they're required, and if the task is not needed, the CPU unwinds the work and frees up the resources. Unfortunately, this process is not perfect, and the CPU can be tricked into giving access to read kernel memory.

 The vulnerability that speculative execution introduces leads to the paired vulnerabilities called Meltdown and Spectre.  Both vulnerabilities grant a user program read access to the kernel memory and to the memory space of other programs and hence all secrets they contain.  The impact of these vulnerabilities is especially concerning in the case of shared cloud services, as they can lead to escaping the memory space of the hypervisor to read other sections of virtual memory and potentially access secrets of other virtual hosts.

 The difference between Meltdown and Spectre is in the mechanism they use to read memory. Meltdown allows a user program to read any physical memory on the machine directly during speculative execution, leaving "tell-tale" effects that indicate what value has been read. With Spectre, a user program "tricks" the kernel into reading the memory itself during speculative execution and leaving "tell-tale" effects (that the user can see) that indicate what value has been read.

Because these vulnerabilities are at the hardware level, they affect almost all operating systems.  Patches for Meltdown are available for the most popular operating systems, with additional patches being released quickly. The Spectre vulnerability is not patchable at this time, and it is projected this will require new hardware to mitigate, meaning a new generation of CPU's.  The potential of patching software compilers to disable the exposed features that make Spectre possible exists, but it comes with significant costs.

 An additional concern with patching these vulnerabilities is that they cause a significant performance penalty on the CPU. This is a significant impact that many high use systems may not be able to absorb.

 Impact to Akamai

Akamai is in the process of evaluating the patches for these vulnerabilities.  Our desktop platforms--Macs, Windows, Linux--are as affected as anyone else's.  We're rolling out vendor patches and making suggested configuration changes as we receive them. Our production systems are not significantly impacted by it at this time.  There are two primary aspects of Akamai's environment that limit exposure to Meltdown and Spectre.  First, Akamai's platforms do not rely on CPU-enforced page table isolation for separation of customer data.  Second, the platforms do not allow for the execution of arbitrary code by customers or users, severely limiting any potential to exploit this weakness.  

Akamai believes there is minimal customer impact from these vulnerabilities, but we will continue to proactively evaluate this problem. Customer secrets and personally identifiable information are not exposed by this vulnerability. 

Details about the Meltdown and Spectre vulnerabilities are still evolving, and Akamai is continuing to research their impact on our systems and our customers.  

More details can be found in Intel's Newsroom https://newsroom.intel.com/.

When Matt Soares was offered a role at Akamai, it was the flexibility that sold him. "It allowed me to make it my own and I thought that was pretty cool!" he said. Today, Matt is the lifeline of the Akamai Americas campuses as the manager of facilities operations. If a employee's  office isn't below freezing, they can probably thank him. During his days at Akamai, he's involved in office functionality and in the planning of the new Cambridge headquarters building. He's also a chronic cereal wolfer and a big fan of his newest cooking accessory. Matt recently shared a little about his professional and personal experiences, his biggest challenge, favorite mistake and go-to winter pastime.

Akamai's InfoSec team has been documenting security vulnerabilities on this blog for years, and we have long evangelized the security benefits of keeping companies' systems current by applying the latest patches.  Today, management of vulnerabilities and application of the latest patches has become a critical component of any InfoSec program.

In my work with Family Reach, an organization that helps families battling cancer with out-of-pocket medical expenses and everyday living costs, I learned of a striking statistic: The number one cause of financial bankruptcy for families is paying for the costs associated with cancer.

This statistic is one that Family Reach helps to combat every day, and one of the key drivers of its upcoming Cooking Live event. Created by chef Ming Tsai four years ago, Cooking Live brings together some of the nation's top celebrity chefs to raise awareness of the impact of cancer on families and to cook for some of the families involved with Family Reach.

Cooking Live takes place on Monday, November 2, from 7:30 to 9 p.m. ET. Renowned chefs Masaharu Morimoto, Bryce Shuman, Ken Oringer and Johnny Iuzinni will join host Ming Tsai and celebrity sous chefs Emily Blunt and John Krasinski as they prepare a five-course meal while addressing the serious needs Family Reach addresses on a daily basis.

We recently said farewell to the twenty terrific young women of the Akamai Girls Who Code Summer Immersion Program. They learned and grew so much over their seven weeks with us, and we will miss them!   

At their graduation ceremony, Tom Leighton spoke about how much is possible if one is intelligent, curious, and hard working. I see that every day at Akamai, and I saw it in spades among the girls in our program. They approached each new opportunity with gusto, whether it was learning about the internet, algorithms for genome sequencing, data visualization, data structures, or personal robots. They were always curious and asked great questions. They brought the same energy to coding, and the Girls Who Code staff said they often had to pry the girls off of their computers at the end of the day to send them home. It was wonderful to witness their satisfaction in making things work - whether debugging the ball physics in their "Pong" game, or building a personal web site.