Researchers have devised an attack that forces Apple’s Safari browser to divulge passwords, Gmail message content, and other secrets by exploiting a side channel vulnerability in the A- and M-series CPUs running modern iOS and macOS devices.

iLeakage, as the academic researchers have named the attack, is practical and requires minimal resources to carry out. It does, however, require extensive reverse-engineering of Apple hardware and significant expertise in exploiting a class of vulnerability known as a side channel, which leaks secrets based on clues left in electromagnetic emanations, data caches, or other manifestations of a targeted system. The side channel in this case is speculative execution, a performance enhancement feature found in modern CPUs that has formed the basis of a wide corpus of attacks in recent years. The nearly endless stream of exploit variants has left chip makers—primarily Intel and, to a lesser extent, AMD—scrambling to devise mitigations.

. . .

  • fiat_lux@kbin.social
    link
    fedilink
    arrow-up
    17
    arrow-down
    8
    ·
    1 year ago

    Because Apple are pieces of shit which force Safari to underpin any Web interaction on those devices, which wouldn’t be such a problem if mobile Safari were worth a damn.

    But you’re right and it’s a valid point. I did miss that sentence on initial read and had forgotten about that problem. Thanks for the reminder!

    • tsonfeir@lemm.ee
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      2
      ·
      1 year ago

      It also said this hasn’t actually ever been exploited. So, looks like they’ll collect the bounty and move on. Bugs are bugs.