Security News

Microsoft is integrating its Pluton security processor directly into Intel, AMD, and Qualcomm CPUs to better secure Windows PCs. Windows 10 gains enhanced security by utilizing specialized chips called Trusted Platform Modules to provide hardware-based security functions. Microsoft is now partnering with Intel, AMD, and Qualcomm to introduce the Pluton security processor as an on-die chip in their CPUs.

Researchers at the University of Birmingham have managed to break Intel SGX, a set of security functions used by Intel processors, by creating a $30 device to control CPU voltage. Break Intel SGX. The work follows a 2019 project, in which an international team of researchers demonstrated how to break Intel's security guarantees using software undervolting.

Researchers have disclosed the details of a new side-channel attack method that can be used to obtain sensitive information from a system by observing variations in the processor's power consumption. The PLATYPUS attack relies on having access to Intel's Running Average Power Limit, a feature introduced by the company with the Sandy Bridge microarchitecture and which is designed for monitoring and controlling the CPU and DRAM power consumption.

An international team of security researchers is presenting new side-channel attacks, which use fluctuations in software power consumption to access sensitive data on Intel CPUs. Power side-channel attacks are attacks that exploit fluctuations in power consumption to extract sensitive data such as cryptographic keys.

Microsoft has released a new batch of Intel microcode updates for Windows 10 20H2, 2004, 1909, and older versions to fix new hardware vulnerabilities discovered in Intel CPUs. When Intel finds bugs in their CPUs, they release microcode updates that allow operating systems to patch the behavior of the CPU to fix, or at least mitigate, the bug.

Oracle on Tuesday released its Critical Patch Update for October 2020, which includes 402 new security patches released across the company's product portfolio. The advisory for the latest CPU includes information on the patches released after the previous CPU, but the patches are typically cumulative, Oracle notes.

Intel on Wednesday announced the new security technologies that will be present in the company's upcoming 3rd generation Xeon Scalable processor, code-named "Ice Lake.". "Protecting data is essential to extracting value from it, and with the capabilities in the upcoming 3rd Gen Xeon Scalable platform, we will help our customers solve their toughest data challenges while improving data confidentiality and integrity. This extends our long history of partnering across the ecosystem to drive security innovations," said Lisa Spelman, corporate VP of the Data Platform Group and GM of the Xeon and Memory Group at Intel.

Cadence Design Systems announced Cadence System-Level Verification IP, a new suite of tools and libraries for automating system-on-chip testbench assembly, bus and CPU traffic generation, cache-coherency validation and system performance bottleneck analysis. Using Cadence System VIP, customers creating complex hyperscale, automotive, mobile and consumer chips can improve chip-level verification efficiency by up to 10X. The new Cadence System VIP solution takes Cadence's market leadership in IP-level verification automation and brings it to the chip level.

Intel's upcoming class of mobile CPUs, code named "Tiger Lake," will feature a long anticipated security layer, called Control-flow Enforcement Technology, which aims to protect against common malware attacks. "Intel CET delivers CPU-level security capabilities to help protect against common malware attack methods that have been a challenge to mitigate with software alone," said Tom Garrison, vice president and general manager of Client Security Strategy and Initiatives with Intel, in a Monday post.

Intel on Monday unveiled a new security technology for its processors that will help protect systems against attack methods commonly used by malware. Intel CET has two main components: indirect branch tracking, which should provide protection against jump oriented programming and call oriented programming attacks; and shadow stack, which provides return address protection against return-oriented programming attacks.