Businesses cautious in installing patches to fix chip flaw

WASHINGTON (Reuters): Chances that a fix to a major microchip security flaw may slow down or crash some computer systems are leading some businesses to hold off installing software patches, fearing the cure may be worse than the original problem.

Researchers this week revealed security problems with chips from Intel Corp (INTC.O) and many of its rivals, sending businesses, governments and consumers scrambling to understand the extent of the threat and the cost of fixes.

Rather than rushing to put on patches, a costly and time-intensive endeavor for major systems, some businesses are testing the fix, leaving their machines vulnerable.

“If you start applying patches across your whole fleet without doing proper testing, you could cause systems to crash, essentially putting all of your employees out of work,” said Ben Johnson, co-founder of cyber-security startup Obsidian.

Banks and other financial institutions spent much of the week studying the vulnerabilities, said Greg Temm, chief information risk officer with the Financial Services Financial Services Information Sharing and Analysis Center, an industry group that shares data on emerging cyber threats.

The flaws affect virtually all computers and mobile devices, but are not considered “critical” because there is no evidence that hackers have figured out how to exploit them, said Temm, whose group works with many of the world’s largest banks.

“It’s like getting a diagnosis of high blood pressure, but not having a cardiac arrest,” Temm said. “We’re taking it seriously, but it’s not something that is killing us.”

Banks are testing the patches to see if they slow operations and, if so, what changes need to be made, Temm said. For instance, computers could be added to networks to make up for the lack of processor speed in individual machines, he added.

Some popular antivirus software programs are incompatible with the software updates, causing desktop and laptop computers to freeze up and show a “blue screen of death,” researcher Johnson said.

Antivirus software makers responded by rolling out fixes to make their products compatible with the updated operating systems, he said. In a blog posting on Friday, Microsoft Corp (MSFT.O) said it would only offer security patches to Windows customers whose antivirus software suppliers had confirmed with Microsoft that the patch would not crash the customer’s machine.

“If you have not been offered the security update, you may be running incompatible antivirus software, and you should consult the software vendor,” Microsoft advised in the blog post.

Government agencies also are watching. The Ohio Attorney General’s office is monitoring the situation, a spokesman said by email.

“Intel continues to believe that the performance impact of these updates is highly workload-dependent and, for the average computer user, should not be significant and will be mitigated over time,” the world’s No. 1 chipmaker said on Thursday in a release.

It cited Amazon.com Inc (AMZN.O), Apple Inc (AAPL.O), Alphabet Inc’s (GOOGL.O) and Microsoft as saying that most users had seen no significant impact on performance after installing the patches.

The cloud vendors are among a group of firms that quickly patched their technology to mitigate against the threat from one of those vulnerabilities, dubbed Meltdown, which only affects machines running Intel chips.