Intel Kept US Cyber Security Agencies In The Dark About Spectre And Meltdown

Just when you thought the whole Spectre and Meltdown situation could not get any messier, a new report suggests Intel withheld information about the security flaws to US cyber officials, even though it gave some of its hardware partners a heads up before the situation became public knowledge. Intel defends its position, saying it had no knowledge that the vulnerabilities had been exploited.

The report essentially echoes an earlier one in which The Wall Street Journal said Intel shared information about Spectre and Meltdown to Chinese firms before the US government. At the time, Jake Williams, head of Rendition Infosec and former NSA employee said it was "near certainty" that the Chinese government knew about the security vulnerabilities in Intel chips from its correspondence with companies such as Lenovo.

According to Reuters, letters sent by tech companies to lawmakers confirm that Intel did indeed keep US government officials in the dark about Spectre and Meltdown. In one of the letters, Google's parent company Alphabet said its Project Zero team informed Intel, AMD, and ARM of the vulnerabilities in June. As is the team's standard practice, it gave the firms 90 days to fix the issues before publicly disclosing them (the deadline was ultimately extended to January 9).

Alphabet also said it left the decision of whether to inform government officials of the security flaws up to the individual companies affected. Intel chose not to because there was "no indication that any of these vulnerabilities had been exploited by malicious actors," according to Intel's letter.

In the same letter, Intel said it did not analyze whether Spectre and Meltdown could harm critical infrastructures because it believed the flaws could not affect industrial control systems. However, it did alert other technology companies of Project Zero's findings.

The security flaws have been present in pretty every processor produced in the past two decades. There have been no known attempts to exploit them, hence why Intel might have felt that leaving the government agencies such as the United States Computer Readiness Team (US-CERT) out of the loop was the way to go. Whether or not that was the right decision is something that is currently being looked into.