Intel proactively fixes security flaws in its chips

Despite the skepticism surrounding Kris Kaspersky's upcoming "Remote code execution through Intel CPU bugs"

presentation to be held at this year's Hack in the Box con, it appears that he's been on the right track, as Intel has proactively taken care of the problem by fixing two of the critical flaws according to Kaspersky :

"On Friday, Kaspersky told Computerworld that he has been communicating with Intel about the flaws for nearly a month and the company has told him that it fixed the two critical flaws he brought to Intel's attention. Both of the flaws -- one in the cache controller and one in the Arithmetic logic unit -- could be used by a remote attacker to execute arbitrary code, according to Kaspersky."

And whereas he's been asked not to release proof of concept code at at the conference due to the potential implications given Intel's leading market share, and the fact that the flaw is OS independent, he'll be releasing technical details on the vulnerability. Was Intel caught off guard at the first place?

Depends on the perspective. Intel has been actively investing in R&D of security technologies to make their chips more

secure. An example of such a successful effort is Intel's Trusted Execution Technology already introduced in several of their chip families :

"Intel® Trusted Execution Technology for safer computing, formerly code named LaGrande Technology, is a versatile set of hardware extensions to Intel® processors and chipsets that enhance the digital office platform with security capabilities such as measured launch and protected execution. Intel Trusted Execution Technology provides hardware-based mechanisms that help protect against software-based attacks and protects the confidentiality and integrity of data stored or created on the client PC. It does this by enabling an environment where applications can run within their own space, protected from all other software on the system. These capabilities provide the protection mechanisms, rooted in hardware, that are necessary to provide trust in the application's execution environment. In turn, this can help to protect vital data and processes from being compromised by malicious software running on the platform"

The question based on Kaspersky's modest details ahead of the presentation is, whether or not he'll be demonstrating direct Java bytecode execution, and which chip families is he going to target. One thing's for sure, when a vendor is proactively fixing vulnerabilities you were speculating about based on off the record discussions with you, you knew what you were looking for.