Source URL: https://www.bleepingcomputer.com/news/security/new-apple-cpu-side-channel-attack-steals-data-from-browsers/
Source: Hacker News
Title: New Apple CPU side-channel attacks steals data from browsers
Feedly Summary: Comments
AI Summary and Description: Yes
Summary: A recent disclosure by security researchers reveals critical side-channel vulnerabilities in modern Apple processors, specifically regarding the FLOP and SLAP attacks. These flaws exploit speculative execution mechanisms to leak sensitive data remotely via web browsers, posing significant threats to user privacy and information security.
Detailed Description:
The research conducted by teams from the Georgia Institute of Technology and Ruhr University Bochum has unveiled two significant vulnerabilities in Apple’s latest processors, categorized as side-channel attacks: FLOP (False Load Output Prediction) and SLAP (Speculative Load Address Prediction). These attacks exploit the speculative execution implemented in Apple CPUs, which is similar to the vulnerabilities seen in past notorious exploits like Spectre and Meltdown.
**Key Points:**
– **Nature of Vulnerabilities:**
– FLOP and SLAP utilize faults in the speculative execution to predict memory addresses and values inaccurately, leading to erroneous computations on sensitive data.
– Both attack vectors allow malicious actors to siphon off sensitive information without needing physical access to the hardware.
– **Attack Mechanisms:**
– FLOP:
– Targets M3, M4, and A17 processors by exploiting incorrect guessing of memory values.
– Demonstrates evasion of browser sandboxing, allowing attackers to retrieve information from applications like Proton Mail and Google Maps.
– SLAP:
– Affects M2 and A15 processors and focuses on predicting the next accessed memory address.
– Allows for data reconstruction from Gmail, Amazon, and Reddit by training the CPU on specific access patterns.
– **Execution of Attacks:**
– Both attacks can be initiated remotely through malicious web pages containing JavaScript or WebAssembly, activating the vulnerabilities without any need for installed malware.
– This makes them particularly dangerous, as user intervention is minimal; simply visiting a webpage could lead to data breaches.
– **Implications and Mitigations:**
– The existence of these vulnerabilities poses severe implications in the arena of information security, primarily because they facilitate unauthorized access to sensitive personal data.
– Although Apple has been made aware of these vulnerabilities and plans to release security updates, they remain unmitigated as of the latest reports. Immediate workarounds suggested include disabling JavaScript in affected browsers, though this action may disrupt conventional web activities.
– **Significance:**
– These findings enrich the discourse in security circles by illustrating how advanced speculative execution techniques in modern processors can introduce new vulnerabilities.
– Compliance and security professionals must be vigilant, as these attacks bypass existing security frameworks, highlighting the need for more robust control measures and privacy protocols in cloud and infrastructure services.
This disclosure not only sheds light on the active threat to many users but also calls attention to the ongoing challenges in hardware security amidst rapid technological advancement.