October 27, 2023 at 04:35PM
Researchers have developed a side-channel exploit called “iLeakage” that affects Apple CPUs, allowing sophisticated attackers to extract sensitive information from browsers. The exploit takes advantage of speculative execution in Apple silicon CPUs and the Apple WebKit capabilities inside a browser. All recent iPhone, iPad, and MacBook models are affected, and while Apple has developed a mitigation, it is still unstable and only available on Macs. The exploit can potentially expose data such as logins, search histories, and credit card details. iPhone users are especially vulnerable because all browser apps on iOS use Safari’s engine. A fix for the vulnerability is expected in a future software release.
Key Takeaways from Meeting Notes:
– Researchers have developed a side-channel exploit called “iLeakage” for Apple CPUs, which can extract sensitive information from web browsers.
– Side-channel attacks take advantage of additional information generated by computer systems or hardware, such as sound, light, or electromagnetic radiation.
– iLeakage affects recent iPhone, iPad, and MacBook models.
– The researchers notified Apple of their findings on September 12, 2022, and Apple has developed a mitigation, but it’s still considered unstable and not enabled by default on devices.
– The exploit leverages speculative execution in Apple silicon CPUs to gain access to valuable data in the CPU cache.
– iLeakage builds on previous CPU vulnerabilities like Meltdown and Spectre and focuses on breaking the isolation between browser tabs.
– While the attack requires advanced knowledge and hasn’t been demonstrated in the wild, it has the potential to expose various types of user data, including logins, search histories, and credit card details.
– iLeakage affects all browsers on iOS because Apple’s policies require iPhone browser apps to use Safari’s engine.
– Currently, the best fix from Apple is only available for MacBooks and still in an unstable state, but it’s expected that a patch will be developed in the future.