Intel 'Zombieload' security hole impacts chips in just about every PC as well as servers

Researchers that found the last huge Intel security hole have found a new one.This time, however, Intel and the rest of the industry were ready with patches.The hole impacts just about every PC and server that uses any kind of Intel processor.It lets hackers potentially see your web history, your passwords and the your disk encryption keys.Visit Business Insider's homepage for more stories.The same researchers that found the Intel Spectre and Meltdown flaws which sent Intel and the whole tech industry reeling has found another problem with Intel chips. And they say this vulnerability, named ZombieLoad, impacts PCs and servers of all flavors if they run Intel chips.The good news is that the researchers have already reported it to Intel and other vendors, and security patches are being issued now.Intel has already patched several of its current processors, and it released microcode that will patch others, it tells Business Insider. Among the Intel chips that are vulnerable are the Xeon, Broadwell, Sandy Bridge, Skylake, Haswell chips, Kaby Lake, Coffee Lake, Whiskey Lake, Cascade Lake, Atom and Knights processors, the company reported. Intel has given this vulnerability a security rating of “medium.” PC makers Apple and Microsoft have also issued patches. As have browser makers Google and Mozilla.While all of this sounds like a yawn — just another hole that vendors are patching — it is creating hubbub because it is another example of an entirely new type of security hole that impacts modern processors. It follows the discovery of the so-called Meltdown, Spectre, and Foreshadow holes in processors, which came to light last year.And there are a lot of vulnerable Intel processors out there in the world that need to be patched. However, chips that have already been patched from the Spectre hole are less vulnerable to ZombieLoad, Intel says.ZombieLoad is eye-popping because it allows hackers to see things like browser history, website content, user keys, and passwords, or system-level secrets, such as disk encryption keys. In other words, it may give hackers the literal keys to the secrets locked away through encryption on your computer. And it can be used on PCs and servers, even those in the cloud, although the big cloud vendors like Microsoft and Google have been given warnings to patch before the researcher went public with this hole.An Intel spokesperson explains that the company is already well aware of this new security hole, which has the technical name of Microarchitectural Data Sampling (MDS):“Microarchitectural Data Sampling (MDS) is already addressed at the hardware level in many of our recent 8th and 9th Generation Intel Core processors, as well as the 2nd Generation Intel Xeon Scalable Processor Family. For other affected products, mitigation is available through microcode updates, coupled with corresponding updates to operating system and hypervisor software that are available starting today.We've provided more information on our website and continue to encourage everyone to keep their systems up to date, as its one of the best ways to stay protected. We'd like to extend our thanks to the researchers who worked with us and our industry partners for their contributions to the coordinated disclosure of these issues.”Zombieload was discovered and reported by security researchers Michael Schwarz, Moritz Lipp, Daniel Gruss (of the Graz University of Technology) and Jo Van Bulck (of the computer science research group at KU Leuven university.)These guys are becoming so famous in the security worlds that with this new hole, they've become a Twitter internet meme.