Intel Meltdown / Spectre Patch Tested on Avigilon, Exacq and Milestone VMSes

IPVM

What do you do, if after you upgrade / patch, you realize you have a performance problem on your VMS? Replace the CPU? Replace the server? What are one's practical options?

Reactions:

(1)

Brian Karas

In reply to John Honovich

IPVM

It is hard to say with limited data being released so far. In some cases, you may be able to upgrade to a faster processor. Similarly, upgrading to faster RAM (if possible) may also help.

Until VMS manufacturers can issue some solid guidance on this, I would limit investments in upgrading components, or servers, as much as possible. It could turn out that server upgrades are the most practical approach for older hardware, as you would likely want to leave a decent chunk of free CPU to absorb any future enhancements that also add to processor utilization.

Also, this has not been addressed so far, but if the server is supporting multiple applications (e.g.: VMS server and also mobile gateway server, etc.), it may be cost-effective to off-load some applications to other hardware to free up CPU for the core VMS.

Reactions:

(4)

Undisclosed Manufacturer #4

•Jan 26, 2018

In reply to John Honovich

With Milestone 2018 R1 you have the option to add one or more NVidia cards to a client machine to increase processing power. Milestone automatically load balances the GPU's and uses CPU for leftover needs. Due out Feb 20, 2018

With Milestone 2018 R2, you have the option to drop one or more NVidia cards into your recording servers to offload the decompression tasks. This is not due out till mid-summer so a bit of a gap for those patching now, but at least it is a real and relatively low-cost option that we have.

Reactions:

Tom Sharples

Why are these exploits even an issue in a closed environment such as a VMS server? No one is going to be using one to surf the net or adding random apps, or am I missing something?

Reactions:

(2)

(1)

Undisclosed Integrator #2

In reply to Tom Sharples

Unfortunately from the integrator's point of view, security networks are not so closed environments anymore.

IT departments are pushing towards opening security networks to other segments of the network, and sometimes yes they are open to the Internet as well either for remote assistance, remote monitoring or connecting remote sites.

Reactions:

(2)

(1)

Undisclosed Integrator #1

Impact on server load when viewing live or playback video was even more significant, increasing CPU load by 80-90% on low camera count systems using Avigilon and Exacq

Forgive my low reading comprehension but am I understanding this right? I'm hoping what is meant is that if we're at 10% load it is jumping to 18%-19%.

Reactions:

(1)

Ethan Ace

In reply to Undisclosed Integrator #1

Yes, that's correct. I'll edit that so it's more clear.

Reactions:

(2)

Rob Kilpatrick

In reply to Undisclosed Integrator #1

IPVM • IPVMU Certified

Yes, you were reading it correctly.

For example, the exacq server in the low throughput test increased by 4% cpu usage, going from 8% pre-patch to 12% post patch, this was a 50% increase.

Reactions:

(1)

Bob Schenck

Dell and HP purge Intel’s Spetcre patch over reboot woes

IPVMU Certified

The problem right now with BIOS updates is Intel released code that is causing a reboot problem. Dell, HP, and Lenovo have all removed the latest BIOS patches from their downloads and are recommending anyone who installed them to roll back. If you recently patched your BIOS, you should go back and check to be sure you didn't install a version that has been retracted.

Reactions:

(1)

(4)

Michael Miller

https://www.scmagazine.com/intel-advises-companies-to-stop-installing-spectremeltdown-update/article/738625/

“We recommend that OEMs, cloud service providers, system manufacturers, software vendors and end users stop deployment of current versions, as they may introduce higher than expected reboots and other unpredictable system behavior,” he wrote.

Reactions:

(2)

Alex Knapik

Purely from a testing methodology standpoint, was testing done with Milestone Smart Client hardware acceleration enabled? It could stand to reason CPU usage and impact would be less than this if GPUs would being used to decode and render...

Reactions:

(2)

(1)

Undisclosed Integrator #1

In reply to Alex Knapik

Alex, since you are with Milestone, what does your internal testing show?

Reactions:

(2)

Campbell Chang

Don't suppose you can build an AMD Ryzen machine and retest this?

Intel has done a great job convincing everyone that Meltdown affects everyone despite AMD being entirely unaffected by this. So I'd be super curious to find out how much the Meltdown patch affects the speed vs Spectre.

Reactions:

(2)

Undisclosed Manufacturer #3

We are currently evaluating this situation and discussing with customers whether or not to actually applying the BIOS patches.

The reason for this is that we want the customers to have a choice. Many of our customers have distinctly disconnected networks for CCTV and very high control over what can be installed on their machines, like web browsers.

To do this we need to call on our corporate security experts to look at the attack vectors and recommend actions.

With these high impacts we are seeing, many of our customers will have to do expensive and time consuming upgrades if there is no way around the BIOS patches.

Reactions:

(1)

Tim Cook

IPVMU Certified

This BIOS vulnerability, can it affect dedicated Linux OS recorders/NVR's with Intel chips or only Windows/Intel devices?

How about the Meltdown vulnerability on these same devices?

Reactions:

Brian Karas