In 2018, the digital world faced a nightmare when two security flaws were discovered in the physical chips of every computer and smartphone on Earth.
Unlike typical viruses, Spectre and Meltdown were long-standing hardware vulnerabilities caused by speculative execution, a design choice that improved performance but unintentionally exposed sensitive data, such as passwords. Since the flaws were built into computer hardware, fixing them required security patches that often reduced performance, highlighting the trade-off between speed and security.
Follow the chain from processor optimization to observable cache trace, then compare the two attacks built from it.
From a quiet performance trick to a global scramble, in just over two decades.
Two decades of chips shipped with the flaw baked in, meaning almost every device in use by 2018 was affected at once. No single vendor could patch it alone, since the design choice sat at the hardware level across the entire industry.
Coordinated disclosure bought vendors months to prepare fixes before attackers could learn the details. That head start is the reason patches existed at all by the time the story became public.
The early leak forced every vendor to publish incomplete fixes under pressure, well before their planned coordinated date. Some patches shipped with known gaps simply because there was no time left to close them.
Cloud providers had to reboot fleets of servers simultaneously, one of the largest coordinated infrastructure patches in history. The performance cost also meant customers were quietly paying for the fix in slower workloads for months afterward.
Software patches alone were never enough, so the fix eventually had to move back into silicon itself. It marked a rare case where a security flaw reshaped how future CPUs were physically designed.
Observe how cache timing can expose a secret even when an application never displays it.
Switch to the attacker view
Click View as Attacker to leave the user's perspective and see the probe array the application never shows.
Trigger a memory access
Press Trigger Memory Access to start a round. This is also what opens the 10-second attack window, every probe address gets a fresh, randomized access time.
Race the attack window
Once triggered, the countdown runs regardless of view. Reconstruct as much of the password as you can before it hits zero.
Pick the fastest address
Select the probe with the lowest cycle count. A correct pick locks in one character. Wrong pick raises detection risk.
Balance speed, cycle cost, and cache-trace risk while handling a stream of branch instructions.
Read the instruction card
See what the code does, how sensitive the data is, and how confident the branch predictor is.
Check the policy read
A plain-language take on whether this branch is actually worth speculating on.
Pick a player action
Wait, Speculate, Speculate + Flush, or Fence. Each spends cycles and risk differently.
Beat the clock
Every round gives you a shrinking window to decide. Let it run out and the CPU speculates anyway, no cleanup included.
Watch both gauges
The run ends if Cache Trace Risk hits 100%, the Cycle Budget hits 0, or all 10 rounds clear.
What Each Action Does
Resolve the branch condition first, then run the code once the answer is known.
Costs about 3-4 cycles. No speculative work ever runs, so this never creates a cache trace.
Guess the branch outcome and execute immediately, before the check resolves.
Only 1 cycle if the guess is right. If it's wrong, the result is discarded, but it can still leave a cache trace and raise risk, especially on sensitive data.
Speculate like above, then actively clear out any leftover cache state.
Costs 3-4 cycles either way. Cuts down the leftover trace risk from a wrong guess, but a flush is never perfectly clean.
Block speculation from crossing this branch at all.
Costs 4-5 cycles, the most of any option. Cache trace risk stays at zero no matter what the predictor thinks.
if (imageLoaded)
displayImage();Data type: Public
The data is public and the predictor has useful confidence, so the security cost of early work is low.
Tip: press 1, 2, 3, or 4 to act instantly.
Coordinate a limited response team and choose the correct mitigation for every exposed system.
Mission Briefing
You're a cybersecurity engineer on January 3, 2018, the day Spectre and Meltdown went public. Five systems are exposed to speculative-execution side-channel attacks. Secure as many as you can before the window closes.
No two systems share the exact same fix. Match the patch to the vulnerability, guessing wrong burns your window just as fast as guessing right.
The research and reporting this exhibit draws from.
(2023). SPECTRE: Analysis of attacks and defense mechanisms against Spectre. In Proceedings of the International Congress on Advanced Research and Applications. Turkey. https://www.researchgate.net/publication/380897005_SPECTRE_ANALYSIS_OF_ATTACKS_AND_DEFENSE_MECHANISIMS_AGAINST_TO_SPECTRE
(2018). A review on Spectre attacks and Meltdown with its mitigation techniques. International Journal of Engineering & Technology, 7(3.28), 209–213. https://www.researchgate.net/publication/329810347_A_Review_on_spectre_attacks_and_meltdown_with_its_mitigation_techniques
(2018). Meltdown. arXiv:1801.01207. https://arxiv.org/abs/1801.01207
(1982). Cache memories. ACM Computing Surveys, 14(3), 473–530. https://doi.org/10.1145/356887.356892
(2020). Mitigating risk of Spectre and Meltdown vulnerabilities. International Journal of Advanced Trends in Computer Science and Engineering, 9(5), 741–746. https://www.researchgate.net/publication/344411705_Mitigating_Risk_of_Spectre_and_Meltdown_Vulnerabilities