Can spectre or Meltdown affect my 27 inch Mid 2011 iMac running El Captian?

[Benz63amg]

So i'm running El Captian on my 27 inch Mid 2011 iMac and i dont have any desire in updating to High Sierra or any newer OS as i like the way El Captian runs on my iMac, from what i understand, if i DON'T install any third party apps and pretty much just use my iMac to browse the internet using Google Chrome, Can my iMac be affected by the Spectre and Meltdown hacks?

 

[casperes1996]

So i'm running El Captian on my 27 inch Mid 2011 iMac and i dont have any desire in updating to High Sierra or any newer OS as i like the way El Captian runs on my iMac, from what i understand, if i DON'T install any third party apps and pretty much just use my iMac to browse the internet using Google Chrome, Can my iMac be affected by the Spectre and Meltdown hacks?

Apple has released a software update for El Capitan that mitigates Spectre and Meltdown.
There are also no known attacks using these attack vectors. They are still purely theoretical, and the only applications of these vulnerabilities that are known are research related.

By isolating all of the kernel space memory in a separate memory map the OS tries to keep sensitive data safe, but I'd imagine, on any platform, there's still a risk of data leakage from other userland processes.

 

[Benz63amg]

Apple has released a software update for El Capitan that mitigates Spectre and Meltdown.
There are also no known attacks using these attack vectors. They are still purely theoretical, and the only applications of these vulnerabilities that are known are research related.

By isolating all of the kernel space memory in a separate memory map the OS tries to keep sensitive data safe, but I'd imagine, on any platform, there's still a risk of data leakage from other userland processes.

My question is still this though, can my iMac be affected if i DON'T install any sort of apps whether from the Appestore or any third party app and basically just use my iMac to browse the web using google chrome (gmail, facebook, youtube etc) ?

 

[casperes1996]

My question is still this though, can my iMac be affected if i DON'T install any sort of apps whether from the Appestore or any third party app and basically just use my iMac to browse the web using google chrome (gmail, facebook, youtube etc) ?

I don't see why it wouldn't be. Websites can run arbitrary code on your system. Web browsers try and protect against Spectre (spectre being needed to abuse meltdown in the first place), but it's not entirely certain the mitigations are enough. But! If your macOS is up to date (not necessarily the newest release; Just keep El Cap updated) and your browsers are up to date, you are at no greater risk than anyone on HS.

 

[Benz63amg]

I don't see why it wouldn't be. Websites can run arbitrary code on your system. Web browsers try and protect against Spectre (spectre being needed to abuse meltdown in the first place), but it's not entirely certain the mitigations are enough. But! If your macOS is up to date (not necessarily the newest release; Just keep El Cap updated) and your browsers are up to date, you are at no greater risk than anyone on HS.

The thing is that I read several posts by people that updated to that newly released El Capitan update with the security update and it literally killed their iMac which now only displays a blank white screen and no longer boots(one person said he contacted a repair center and they told him that the GPU more than likely needs to be replaced) but that just so happens that it went down right after the latest security update Apple issued so I’m afraid to update the operating system on my iMac at all as it’s been running flawlessly even since I updated to whatever El Captian version I have installed currently (I can’t recall what’s the exact version right now and I’m not home to check) and

When the news about meltdown and spectre broke on the news I realized that Apple will now issue a software update for their operating systems as well as the mobile operating systems which I’m more than likely going to be forced to install to be on the safe side. (I always have the latest version on my iPhone) it’s just the iMac that I’m hesitating to update. And I’m not only going by these posts of the people that had issues after the security update, I recall having a similar issue myself sometime around 2012 when I installed a security update for whichever operating system was current back then and my iMac wasn’t booting anymore right after the update was being installed and I had to use disk warrior to rescue my data and reinstall the entire os as the update corrupted it in one way or another so you can see why I’m hesitant in regards to these security updates.

 

[casperes1996]

When the news about meltdown and spectre broke on the news I realized that Apple will now issue a software update for their operating systems as well as the mobile operating systems which I’m more than likely going to be forced to install to be on the safe side. (I always have the latest version on my iPhone) it’s just the iMac that I’m hesitating to update. And I’m not only going by these posts of the people that had issues after the security update, I recall having a similar issue myself sometime around 2012 when I installed a security update for whichever operating system was current back then and my iMac wasn’t booting anymore right after the update was being installed and I had to use disk warrior to rescue my data and reinstall the entire os as the update corrupted it in one way or another so you can see why I’m hesitant in regards to these security updates.

I can indeed understand you. I can however tell you that I've administered about 20 macOS security updates over the past 3 years, and have had no issues with them at all. Regardless, if you don't want to update, as I said, there's no attacks currently that use Spectre or Meltdown. You can safely wait until you feel the security update is safe and tested, without fear of getting attacked. And as I said, Chrome likely also has mitigations in the latest releases to attempt to prevent use of Spectre through JavaScript or other web code execution models. So whilst you are not definitively protected, you are still not at full risk

 

[chrfr]

So i'm running El Captian on my 27 inch Mid 2011 iMac and i dont have any desire in updating to High Sierra or any newer OS as i like the way El Captian runs on my iMac, from what i understand, if i DON'T install any third party apps and pretty much just use my iMac to browse the internet using Google Chrome, Can my iMac be affected by the Spectre and Meltdown hacks?

You need to install all the applicable security updates for El Capitan, and keep your browsers updated. Chrome does not yet have mitigations in place so you'd be better off using either Firefox or Safari 11.0.3. If you don't install these updates, then yes, your computer is vulnerable, but it's also vulnerable to a lot of things that are easier to exploit than Spectre or Meltdown.

 

[casperes1996]

You need to install all the applicable security updates for El Capitan, and keep your browsers updated. Chrome does not yet have mitigations in place so you'd be better off using either Firefox or Safari 11.0.3. If you don't install these updates, then yes, your computer is vulnerable, but it's also vulnerable to a lot of things that are easier to exploit than Spectre or Meltdown.

Chrome hasn't gotten Spectre mitigations yet?... That's quite disappointing really. I really expected more

 

[chrfr]

Chrome hasn't gotten Spectre mitigations yet?... That's quite disappointing really. I really expected more

You can work around it, but it's not going to be enabled by default until Chrome 64 ships some time soon:
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
Edit: Chrome 64 was due to be released yesterday, but wasn't.

 

[Benz63amg]

i just updated to Chrome 64 on my iMac.