Side-channel attacks
Spectre and Meltdown: how malicious code reads secrets through the processor, with nothing shown on screen, and how to protect yourself.
In 30 seconds
- Where it happens
- On a computer, phone or server whose processor is affected, as soon as foreign code runs on it (JavaScript, malicious advertising, phishing)1.
- What the attacker wants
- To read memory not meant for them, and so keystrokes, passwords or encryption keys1.
- The reflex
- Install security patches as soon as possible, and only from the vendors' official sources2.
- If it is already done
- Apply the following updates anyway, because some first patches were partial2.
What it is
A side-channel attack observes a side effect of computation, for example the time a memory read takes to complete, and uses it to infer information the attacker is not allowed to read.
Spectre and Meltdown, made public on 4 January 20182, are two examples. They affect the processor itself. Spectre concerns almost all devices1, while Meltdown does not affect AMD2. Nothing appears on the employee's screen: the employee's role is to keep devices up to date and to install patches only from official sources2.
Straight answers
Would I see anything if I were targeted?
No, the sources cited here describe no sign visible on screen. A classic antivirus relies on signatures and may not detect these vulnerabilities1. CERT-FR did publish Yara rules to spot binaries linked to a public Meltdown demonstration library, which concerns security teams, not employees2.
Do I have to click on something to be attacked?
The attacker must first get code executed on the machine. CISA names malicious JavaScript, malicious advertising and phishing as ways to achieve this1.
1Inside the attacker's head1 min
The attacker wants the data another program keeps in memory. On a workstation, that is the operating system's memory, which according to CISA contains keystrokes, passwords and encryption keys1.
The starting point is code the attacker manages to get running: malicious JavaScript, malicious advertising or phishing1. Once this code is in place, CERT-FR explains that Meltdown makes it possible to access operating system memory from a user program2. CISA adds that an attacker could also elevate privileges to exploit these flaws1.
The impact is heavier where resources are shared. CERT-FR notes that from a container (Docker, LXC), it might be possible to access the data of the physical machine hosting it2.
2What you see on screen1 min
Nothing in particular. The sources cited here describe no message or slowdown as a warning sign. The only visible effect is on the defense side: after patching, performance may vary depending on use, and CISA asks administrators to monitor it on critical applications1.
A trap does exist around the subject, however, and it is visible: fake patches (see below).
3Under the hoodIT teams1 min
Modern processors try to go fast. CERT-FR describes two techniques. In so-called out-of-order execution, instructions run according to the availability of computing resources rather than in a strictly sequential way2. In speculative execution, the processor makes assumptions about results not yet available and carries on working; if the assumption is wrong, the effects are cancelled2.
Meltdown exploits a weakness of the first: an instruction can run without the required privilege level being properly checked. Its result is not validated afterwards, but the information can be recovered through a covert channel2.
Spectre exploits the second. The effects of an erroneous speculative execution on the cache persist, and by measuring access times to memory areas, the state of the cache is known. The attacker infers from it the intermediate results of the erroneous execution2. The authors of the research paper describe this as inducing the victim to speculatively perform operations that would not normally occur and whose information leaks through a side channel3.
Three identifiers designate the initial flaws: CVE-2017-5753 and CVE-2017-5715 for Spectre, CVE-2017-5754 for Meltdown2.
4Case filesReal cases1 min
3 and 4 January 2018: the disclosure
CISA states that it learned of Meltdown and Spectre on 3 January 20181. The research paper on Spectre is filed the same day3. CERT-FR dates the publication of the two vulnerabilities to 4 January 20182, and publishes an advisory the same day on VMware products: ESXi, Workstation and Fusion are affected as long as the patches are not installed4.
A fake patch in the name of the BSI
CERT-FR observes a spam campaign that takes advantage of the situation. Attackers posing as the BSI, the German equivalent of ANSSI, invite recipients to visit a copy of its website. The alert there is altered: the user is invited to install a patch that is in fact malware2. CERT-FR reminds readers to install patches only from the vendors' official sources2.
April 2018: "Total Meltdown"
According to CISA, users of 64-bit Windows 7 or 64-bit Windows Server 2008 R2 on an Intel processor, who had installed the January or February 2018 patch, needed to install the latest patch without delay. According to researcher Ulf Frisk, the earlier patches contained a flaw allowing reading and writing in kernel memory1. It carries the identifier CVE-2018-10381.
May 2018: new variants
On 21 May 2018, two new vulnerabilities based on similar principles, CVE-2018-3639 and CVE-2018-3640, are published2.
5What you do1 min
- Install system and browser updates. For Intel firmware, CERT-FR recommends increased caution, even waiting for the final version, and testing patches in controlled environments before deploying them2.
- Install only trusted software. Download patches and firmware directly from the vendor's website1.
- If your computer is managed by the company, let the IT department carry out the updates. The NCSC recommends a default update policy, with patches applied as early as possible and ideally automatically5.
- Do not follow an email that asks you to install a "patch": go through official sources2.
6Pitfalls1 min
The first pitfall is believing that antivirus protects. CISA invites readers to check with the antivirus vendor for compatibility with the patches1. According to CERT-FR, Microsoft's patches depend on the antivirus installed2.
Another pitfall: relying on a first patch. Several vendors had published only partial patches2, and the "Total Meltdown" case shows that a patch can itself contain a flaw1.
Finally, delays in updates of updates also cause problems: the NCSC specifies that deciding not to update is a risk decision at management level5.
Fact sheet
- Identifier
- CP-087
- Wing
- 1. Attacks and techniques
- Brain skill
- Securing Devices & Mobile (secure_devices)
- Brain reflex
- cr-054
- Diagram
- G3 · System & Protocol Anatomy
- Languages
- de, en, fr
- Sources
- 5 sources checked on 3 November 2026
Sources5 sources
- CISA, “Meltdown and Spectre Side-Channel Vulnerability Guidance”, 4 January 2018. https://www.cisa.gov/news-events/alerts/2018/01/04/meltdown-and-spectre-side-channel-vulnerability-guidance (accessed 3 November 2026)
- CERT-FR (ANSSI), “Multiples vulnérabilités de fuite d'informations dans des processeurs”, 4 January 2018. https://cert.cyber.gouv.fr/alerte/CERTFR-2018-ALE-001/ (accessed 3 November 2026)
- arXiv, “Spectre Attacks: Exploiting Speculative Execution”, 3 January 2018. https://arxiv.org/abs/1801.01203 (accessed 3 November 2026)
- CERT-FR (ANSSI), “Multiples vulnérabilités dans les produits VMware”, 4 January 2018. https://cert.cyber.gouv.fr/avis/CERTFR-2018-AVI-006/ (accessed 3 November 2026)
- NCSC (UK), “Vulnerability management guidance”. https://www.ncsc.gov.uk/collection/vulnerability-management/guidance (accessed 3 November 2026)
Cite this article
Brain, “Side-channel attacks”, Cyberpedia, 2026. https:/
BibTeX
@misc{brain_cp087_en_2026,
author = {Brain},
title = {Side-channel attacks},
year = {2026},
howpublished = {Cyberpedia},
url = {https://startbrain.io/cyberpedia/en/articles/side-channel-attacks-spectre-meltdown/},
note = {CC BY 4.0}
}