Researchers have devised an attack that forces Apple’s Safari browser to divulge passwords, Gmail message content, and other secrets by exploiting a side channel vulnerability in the A- and M-series CPUs running modern iOS and macOS devices.

iLeakage, as the academic researchers have named the attack, is practical and requires minimal resources to carry out. It does, however, require extensive reverse-engineering of Apple hardware and significant expertise in exploiting a class of vulnerability known as a side channel, which leaks secrets based on clues left in electromagnetic emanations, data caches, or other manifestations of a targeted system. The side channel in this case is speculative execution, a performance enhancement feature found in modern CPUs that has formed the basis of a wide corpus of attacks in recent years. The nearly endless stream of exploit variants has left chip makers—primarily Intel and, to a lesser extent, AMD—scrambling to devise mitigations.

. . .

  • @[email protected]
    link
    fedilink
    English
    51 year ago

    It also said this hasn’t actually ever been exploited. So, looks like they’ll collect the bounty and move on. Bugs are bugs.

    • fiat_lux
      link
      fedilink
      31 year ago

      Cha-ching! Good for those researchers, get that bag. It’s much better than finding out the other way.

      I’m still not calling it iLeakage though. They’ll have to make do with the well-deserved cash.