Skip to Content
Computing

At Least Three Billion Computer Chips Have the Spectre Security Hole

Companies are rushing out software fixes for Chipmageddon.
January 5, 2018
Yuri Samoilov | Flickr

Tech companies are still working overtime on patching two critical vulnerabilities in computer chips that were revealed this week. The flaws, dubbed “Meltdown” and “Spectre,” could let hackers get hold of passwords, encryption keys, and other sensitive information from a computer’s core memory via malicious apps running on devices.

How many chips are affected? The number is something of a moving target. But from the information released so far by tech companies and estimates from chip industry analysts, it looks as if at least three billion chips in computers, tablets, and phones now in use are vulnerable to attack by Spectre, which is the more widespread of the two flaws.

Apple says all its Mac and iOS products are affected, with the exception of the Apple watch. That’s a billion or so devices. Gadgets powered by Google’s Android operating system number more than two billion, the company said last year. Linley Gwennap of the Linley Group, which tracks the chip industry, thinks the security flaws could affect about 500 million of them.

As practically all smartphones run on iOS and Android—sorry, BlackBerry holdouts—this pretty much covers the mobile-device landscape.

Next, there are PCs and servers. These are largely powered by chips from Intel, whose share price has been battered since news of the flaws emerged. Its chief U.S. competitor, AMD, which has been gaining ground on Intel, said in a blog post  that its chips are not vulnerable to Meltdown and there is a “near zero risk” from one variant of Spectre and zero risk from another.

Still, if some level of threat from Spectre exists, AMD chips merit inclusion. Between them Intel and AMD account for over a billion PC and server chips. In addition, there are a host of smaller chipmakers such as IBM, which has said at least some of its chips are affected. This brings the total to around three billion processors, though this could change as more information emerges. 

That doesn’t mean they all need to be replaced. Tech companies have been rushing out software fixes to deal with Meltdown, and while Spectre is harder to eliminate, some patches have been issued that reduce the risk it poses. Hope is growing among security researchers for a software fix that removes the threat altogether. The good news is that Spectre is really hard to exploit—which doesn’t mean hackers won’t try.

Mark Weatherford, a former senior official at the Department of Homeland Security who’s now at cybersecurity firm vArmour, says companies may still choose to replace hardware in particularly sensitive areas; in most others, they’ll need to apply patches swiftly and take other basic security measures.

 As for consumers: if your computer or phone offers you an operating system upgrade, take it immediately.

Deep Dive

Computing

Inside the hunt for new physics at the world’s largest particle collider

The Large Hadron Collider hasn’t seen any new particles since the discovery of the Higgs boson in 2012. Here’s what researchers are trying to do about it.

Why China is betting big on chiplets

By connecting several less-advanced chips into one, Chinese companies could circumvent the sanctions set by the US government.

How Wi-Fi sensing became usable tech

After a decade of obscurity, the technology is being used to track people’s movements.

Algorithms are everywhere

Three new books warn against turning into the person the algorithm thinks you are.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.