Security researchers have shared information on a vulnerability in Apple’s A-series and M-series chips. If exploited correctly, it could uncover any passwords or sensitive information to the bad actor. The issue, dubbed iLeakage (gross), is only exploitable in Safari on Mac and any browser on iOS/iPadOS.
Thanks to Ars Technica, we have an idea of what’s actually behind the vulnerability:
The researchers implement iLeakage as a website. When visited by a vulnerable macOS or iOS device, the website uses JavaScript to surreptitiously open a separate website of the attacker’s choice and recover site content rendered in a pop-up window. The researchers have successfully leveraged iLeakage to recover YouTube viewing history, the content of a Gmail inbox—when a target is logged in—and a password as it’s being autofilled by a credential manager. Once visited, the iLeakage site requires about five minutes to profile the target machine and, on average, roughly another 30 seconds to extract a 512-bit secret, such as a 64-character string.
“We show how an attacker can induce Safari to render an arbitrary webpage, subsequently recovering sensitive information present within it using speculative execution,” the researchers wrote on an informational website. “In particular, we demonstrate how Safari allows a malicious webpage to recover secrets from popular high-value targets, such as Gmail inbox content. Finally, we demonstrate the recovery of passwords, in case these are autofilled by credential managers.”
While a lot of this seems scary, the actual chance that it will affect the average user is slim to none. It is a highly sophisticated vulnerability to exploit which means the average script kiddie isn’t coming for your YouTube viewing history or your naughty passwords anytime soon.
The biggest challenge—and it’s considerable—is the high caliber of technical expertise required. An attacker needs to not only have years of experience exploiting speculative execution vulnerabilities in general but also have fully reverse-engineered A- and M-series chips to gain insights into the side channel they contain. There’s no indication that this vulnerability has ever been discovered before, let alone actively exploited in the wild.
Also, with the amount of information shared about the vulnerability, it’s reasonable to suspect that Apple already knows about it and is already working to patch or has already patched it and should be available to users soon.
Source: 9to5Mac
