Apple, Android or Windows: Why smartphones, laptops face 'hacking' risks

Less than a week into 2018 and we may have already seen the year’s biggest technology story. Researchers have identified a security flaw in the computer processors made by three of the world’s biggest chip designers, Intel, AMD and ARM, and a second flaw in Intel chips. This means that almost every smartphone, tablet, laptop and business computer in the world could be vulnerable to having sensitive data including passwords stolen. The cloud servers that store websites and other internet data are also at risk.

This is one of the biggest cyber security vulnerabilities we’re ever seen in terms of the potential impact to personal, business and infrastructure computer systems. What’s more, because the flaw is located in such a fundamental part of the computer, there’s no way to know whether or not a machine has been targeted and what data might have been accessed.

Both the main flaw (Spectre), and the Intel-only flaw (Meltdown) have been created by a design technique intended to enhance the chips’ performance known as “speculative execution”. The problem means hackers can access parts of the computer’s memory that should be inaccessible. Sensitive data including passwords, email, documents and photos could all be at risk.

Most cyber attacks involve finding a flaw in a computer’s software that allows hackers to access the machine’s memory or operating system. For example, in 2017 an attack known as “WannaCry” exploited a flaw in older versions of Windows. It affected around 300,000 computers in 150 countries and had a devastating effect on businesses and organisations including the UK’s National Health Service (NHS).

But the Spectre and Meltdown flaws could let hackers cut through all the layers of software to violate the very heart of a computer, the processor chip that powers its fundamental workings. Because similar designs are used by all the major chip makers, almost every computer in the world could be affected, from Apple iPhones and Android devices, to MacBooks, large desktop PCs and internet servers.