Recently two new vulnerabilities, Meltdown and Spectre were published which lets someone read more memory than they are supposed to be able to. How does this effect my wallets and what can I do to secure my Bitcoin?
If you use a modern computer (i.e. one that has a processor that came out in at least the past 10 years), you are effected by the Meltdown and Spectre vulnerabilities. In fact, even if you use an older computer, you may still be effected as it is theorized that Intel CPUs dating back to 1995 may still be vulnerable. However CPUs that old were not tested. Meltdown primarily effects Intel CPUs while Spectre affects a wide range of CPUs, including Intel, AMD (including Ryzen), and ARM (used in smartphones) processors.
All wallet software are effected by the Meltdown vulnerability. Meltdown allows a malicious software to read any bit of memory that it knows the location of. It is capable of dumping the entire contents of the physical RAM in your computer. This means that any wallet which is currently running and has private keys loaded into memory is at risk of having the private keys stolen. Wallet encryption does not help here as the private keys will need to be unencrypted in memory in order for you to be able to sign transactions. Thus any malware exploiting Meltdown will be able to read those private keys.
Lastly, Meltdown appears to only effect Intel CPUs, so if you have an AMD CPU, you shouldn't be effected by this vulnerability
Spectre is more limited in scope than Meltdown is and targets specific processes. It also requires that specific knowledge of the software that is being attacked which does make the attack much harder to pull off. Spectre effects every piece of software which receives an input from somewhere, so all wallet software will be vulnerable.
Spectre effects a wide range of CPUs and it has no known software patches. It effects all modern Intel, AMD, and some ARM CPUs. This means that both computers and smartphones are vulnerable. Some variants may be mitigated but other variants may still be exploitable. As usual, you should avoid visiting suspicious websites and downloading suspicious files to your computer. The usual due diligence applies.
Patching the vulnerabilities
Unfortunately there are no known ways to patch the vulnerabilities entirely through software. The current proposals are stop-gap measures which only reduce their effectiveness but also at the cost of performance. Because these vulnerabilities are based in the CPU hardware, the only way that they can be patched is through new hardware that is not vulnerable. It is not known whether a microcode update (aka the CPU firmware) will fix the vulnerabilities or not.
Keeping your coins safe
The only way to ensure that you are not effected by these vulnerabilities is to use hardware that is effected by the vulnerabilities or use hardware where even if they are effected, the data cannot leave the device. There are really only two options for this: use a hardware wallet, or use an offline computer solely for your wallet.
Hardware wallets do not have these vulnerabilities because they use processors that are not vulnerable. The processors do not feature Out-of-Order-Execution which is what both Meltdown and Spectre exploit in order to read data. Furthermore, even if they were vulnerable, software that runs on the hardware wallet must either be flashed as new firmware or be manually installed by the user. This makes it much more difficult (basically impossible to do without the user noticing) to get malicious software onto the device that could exploit these vulnerabilities. But as said earlier, they are not vulnerable so such software would be useless.
Hardware wallets also do not transmit any secret information (i.e. private keys) to the computer so the private keys are never exposed and thus cannot be stolen.
Offline cold storage devices
Offline cold storage devices that are not hardware wallets typically consist of older, low powered general purpose computers. Such computers are likely to be vulnerable to Meltdown and Spectre. But because they are offline, it is much more difficult for a piece of malware to both get onto the machine and get data off of it.
Although it is harder to infect and exfiltrate data from offline devices, sophisticated malware does exist and can do so. They do so by hiding on the USB drives that are typically used in such setups. By hiding on a USB drive, the malware can go from an infected online computer to the offline computer, infect the offline computer, and transmit data from the infected offline computer to the infected online computer via the USB drive. This would allow an attacker to steal private information (which may be read by exploiting Meltdown or Spectre) from an offline cold storage device.
The only secure way to send data between an offline device and an online device would be something which allows you to inspect the data before it reaches the online machine. Unfortunately this is rather difficult to do.
Meltdown and Spectre are two vulnerabilities that are based in the hardware and are difficult to fix through software patches. They have the potential to leak private keys and other secret information from a computer to an attacker whilst leaving little to no trace of it ever happening. The vulnerabilities effect all software wallets (including web wallets) which run on a computer or smartphone. The only way to secure your coins is to have the private keys stored on a device which cannot leak the private keys without the user noticed. It is thus my recommendation that you use a hardware wallet.