Since the news broke on the Meltdown and Spectre security vulnerabilities, there have been many questions surrounding the risks and how to protect yourself. As a telecom software company, we have many years of experience dealing with security threats but have never witnessed one quite like this. Fortunately, because of our unique architecture, these vulnerabilities have minimal impact on our products.

 What We Know Thus Far
Google researchers have discovered fundamental flaws to the architecture of chips that could enable access to sensitive information on computers, servers, and smartphones. The flaws have existed for more than 20 years and relate to features in a computer’s processor that enable it to predict and access information before it is needed.  This technique, used to speed up processing, is called "speculative execution". 

The Meltdown and Spectre flaws could have serious implications for users, allowing hackers to access encryption keys held in a device’s memory. Meltdown makes it possible for a program to break into an operating system’s central memory and access private data. Spectre, on the other hand, makes it possible for a program to access another program's memory.

Technology companies are now rushing to release software updates know as patches to prevent the vulnerability from being exploited by hackers. A number of patches have already been applied as companies attempted to get ahead of the issue before it became public. There will be a steady stream of further patches issued in the coming weeks and users are recommended to take action as soon as they are prompted.

How These Vulnerabilities are Fundamentally Different
Most security vulnerabilities are really just software bugs. This means the bug can be fixed by simply updating the software. Easy to do -- you just ask an IT admin to update to the latest version of Windows and the problem is inherently fixed.

However, the Meltdown and Spectre exploits take advantage of a hardware design flaw. This means that the physical computer processor is being manipulated to circumvent the computer’s security. Now you have two problems. First, you can’t easily ask your IT admin to go around and replace all the computer chips in every computer. Yikes! Second, in the age of virtualization, the software bug can now be exploited so that, if two customers share the same physical server, customer A can now access customer B’s data! Double yikes!

Illustrating the Risk this Threat Poses
Let’s say I’m a hacker, and let’s say Amazon Web Services (AWS) is impacted by Meltdown and Spectre (they might not be, this is just hypothetical). I could, in theory, sign up for an AWS virtual server of my own. AWS will assign me a virtual machine on a physical box shared with other customers, under the assumption that we’ll share it without being able to access each other’s data because that’s what the software enforces. Let’s also pretend the box I end up on is shared with a Bank of America server.

Using this new exploit, it turns out that I can probably access some of Bank of America’s data -- without them even knowing -- even though the assumption is that our boxes have a virtual “wall” between them. And to fix it? It’s a hardware bug, so someone is going to have to physically pop open that box and replace the processor.

Virtual machines and shared user program spaces all have a major security flaw, and it’s in the physical chip itself, which is tough to replace. So now we have to get creative on how to fix this with software since replacing all computer processors manufactured in the last 20 years is pretty unlikely.

Meltdown and Spectre VS 2600Hz Security
Let’s discuss the good news: 2600Hz doesn’t use virtualization. Why?

2600Hz has always believed that:

• We should never depend on a cloud-based service to deliver OUR service, as that limits geography, network access and security controls
• We should avoid sharing machines because we never know what will be impacted (performance, security, network stack, maintenance)
• We should avoid sharing networks with others for the same ‘lack of control’ reasons listed above
• We should ensure cost control by owning the majority of components
• We should store our customer data on non-cloud services hosted on our corporate network or data center, where we can provide additional layers of security and control, as well as additional intrusion detection and network design controls

This doesn’t imply one should never use shared environments or cloud services, or that we do it “better”. However, it does mean that our strategy is paying off.

Why is this good news? Since we do not allow customers to access or run custom software on our servers, placement of rogue code that can violate the Linux Kernel Page Table is likely to be much harder (if not impossible) in our environment.

Based on the above 2600Hz philosophy, the security of the Hosted Platform and Private Cloud services we manage are NOT significantly impacted. The exploit currently requires the attacker to execute remote code on a server, and as always our deployments do not allow this to occur in the first place.

Many other cloud hosted services (like AWS or Rackspace) are forced to correct this vulnerability as it does represent risk to their primary security barrier because those services allow logins and code execution by any customer, which is why this is front-page news.

Going Forward...
While this vulnerability incident is manageable, it is the most serious one we’ve witnessed. It requires prompt attention for the foreseeable future, as what has been uncovered is more of a strategy for circumventing multi-tenant server security, not just a single exploit. We expect multiple changes to the architecture of modern operating systems will be needed before we’re “out of the woods” on this design, so this fix is more a marathon, not a race, to the finish.

Though we are on the safer end of things, 2600Hz customers can expect multiple security updates over the coming months. 2600Hz is committed to ensuring customers data and private services remain reliable and secure.

If you have any questions or comments, please feel free to conect with us in our community forums.