Researchers have devised an attack that forces Apple’s Safari browser to divulge passwords, Gmail message content, and other secrets by exploiting a side channel vulnerability in the A- and M-series CPUs running modern iOS and macOS devices.

iLeakage, as the academic researchers have named the attack, is practical and requires minimal resources to carry out. It does, however, require extensive reverse-engineering of Apple hardware and significant expertise in exploiting a class of vulnerability known as a side channel, which leaks secrets based on clues left in electromagnetic emanations, data caches, or other manifestations of a targeted system. The side channel in this case is speculative execution, a performance enhancement feature found in modern CPUs that has formed the basis of a wide corpus of attacks in recent years. The nearly endless stream of exploit variants has left chip makers—primarily Intel and, to a lesser extent, AMD—scrambling to devise mitigations.

. . .

  • WhatAmLemmy@lemmy.world
    link
    fedilink
    English
    arrow-up
    114
    arrow-down
    14
    ·
    1 year ago

    While iLeakage works against Macs only when running Safari, iPhones and iPads can be attacked when running any browser because they’re all based on Apple’s WebKit browser engine.

    Member how Apple argues ((security)) to justify their monopoly enforcement of WebKit on iOS? Lol. Good one.

  • IchNichtenLichten@lemmy.world
    link
    fedilink
    English
    arrow-up
    62
    arrow-down
    6
    ·
    1 year ago

    Of course they bury the important bit right at the end of the article:

    “There’s no indication that this vulnerability has ever been discovered before, let alone actively exploited in the wild.

    That means the chances of this vulnerability being used in real-world attacks anytime soon are slim, if not next to zero. It’s likely that Apple’s scheduled fix will be in place long before an iLeakage-style attack site does become viable.”

  • AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    1
    ·
    1 year ago

    This is the best summary I could come up with:


    Researchers have devised an attack that forces Apple’s Safari browser to divulge passwords, Gmail message content, and other secrets by exploiting a side channel vulnerability in the A- and M-series CPUs running modern iOS and macOS devices.

    The researchers have successfully leveraged iLeakage to recover YouTube viewing history, the content of a Gmail inbox—when a target is logged in—and a password as it’s being autofilled by a credential manager.

    Once visited, the iLeakage site requires about five minutes to profile the target machine and, on average, roughly another 30 seconds to extract a 512-bit secret, such as a 64-character string.

    “In particular, we demonstrate how Safari allows a malicious webpage to recover secrets from popular high-value targets, such as Gmail inbox content.

    Finally, we demonstrate the recovery of passwords, in case these are autofilled by credential managers.”

    The design of A-series and M-series silicon—the first generation of Apple-designed CPUs for iOS and macOS devices respectively—is the other.


    The original article contains 327 words, the summary contains 157 words. Saved 52%. I’m a bot and I’m open source!

  • fiat_lux@kbin.social
    link
    fedilink
    arrow-up
    14
    arrow-down
    26
    ·
    edit-2
    1 year ago

    Title

    can force MacOS and IOS browser_s_

    First paragraph

    forces Safari

    Of course it’s fucking Safari. Yes it is the default browser and wrapper that apps will leverage, but Safari is not plural. Be better, ars tech.

    iLeakage

    No. I’m not calling it that. Stop trying to force catchy names, researchers. Because historically, you suck at it as a profession.

      • fiat_lux@kbin.social
        link
        fedilink
        arrow-up
        17
        arrow-down
        8
        ·
        1 year ago

        Because Apple are pieces of shit which force Safari to underpin any Web interaction on those devices, which wouldn’t be such a problem if mobile Safari were worth a damn.

        But you’re right and it’s a valid point. I did miss that sentence on initial read and had forgotten about that problem. Thanks for the reminder!

        • tsonfeir@lemm.ee
          link
          fedilink
          English
          arrow-up
          7
          arrow-down
          2
          ·
          1 year ago

          It also said this hasn’t actually ever been exploited. So, looks like they’ll collect the bounty and move on. Bugs are bugs.

    • CosmicTurtle@lemmy.world
      link
      fedilink
      English
      arrow-up
      19
      arrow-down
      1
      ·
      1 year ago

      Stop trying to force catchy names, researchers.

      From someone who works regularly with vulnerability management, it’s actually needed.

      Vulnerabilities have really boring numbers and it’s difficult for humans to discuss them in a meaningful way. I believe the first vulnerability to get a “name” was heartbleed, the theory being that with a name people would take it seriously and discuss it properly. Given the severity of this vulnerability, it probably got a name but since it’s being patched by the vendors affected, it was probably not needed.

      Heartbleed was needed because individual web sites had to update their software immediately or have their traffic intercepted.

      • fiat_lux@kbin.social
        link
        fedilink
        arrow-up
        7
        arrow-down
        2
        ·
        1 year ago

        Yeah, I hear you, fair point. I can’t recall CVE numbers off the top of my head either.
        Heartbleed was also a great name, whereas iLeakage is… a choice.

        I’ll probably be referring to it as ‘the latest Safari security failure’, hopefully they can ensure that description stays relevant for a few weeks.