3 ms·

Apple Silicon vulnerability leaks encryption keys, and can't be patched easily

48 points by hotdailys 3y ago

politician 3y ago
Will this result in a new tool to unlock confiscated iPhones?
- ViktorRay 3y ago
  Article says it affects M chips which aren’t on iPhones. Just on MacBooks
  - datavirtue 3y ago
    iPads aren't shipping with M1 chips?
    - bdcravens 3y ago
      yes, but iPhones are not
- Kluggy 3y ago
  No. The attacker needs to load on a program and then run it against the target program to extract keys. This doesn’t work with anything in the Secure Enclave and things like iCloud don’t expose an endpoint for the attacker program to send data to. Plus you can’t load a program on the device if it’s locked.
deleted 3y ago
[deleted]
consumer451 3y ago
This is a summary of the Ars reporting [0] on the original research [1]. [0] https://arstechnica.com/security/2024/03/hackers-can-extract-secret-encryption-keys-from-apples-mac-chips/ https://arstechnica.com/security/2024/03/hackers-can-extract... [1] https://gofetch.fail/ https://gofetch.fail/
pvg 3y ago
Recent thread: https://news.ycombinator.com/item?id=39779195 https://news.ycombinator.com/item?id=39779195
ChrisArchitect 3y ago
[dupe]
heresie-dabord 3y ago
Apple experts, how subtle is this constraint for this exploit? > The GoFetch attack uses the same user privileges as many other third-party macOS apps, rather than root access. This lowers the barrier to entry for actually run the attack, but it's not entirely the whole story. > The GoFetch app running the attack must also be used on the same chip cluster as the cryptographic target app in order to function, and both must use the efficiency cores or the performance cores at the same time. = = = edit for additional context > The threat resides in the chips’ data memory-dependent prefetcher, a hardware optimization that predicts the memory addresses of data that running code is likely to access in the near future. [...] DMPs are a relatively new phenomenon found only in M-series chips and Intel's 13th-generation Raptor Lake microarchitecture
- deleted 3y ago
  [deleted]
- sliken 3y ago
  Additionally the exploit is not present on the e-cores and the M3 allows turning off the speculation on a processes by process basis so encryption programs can safely just disable it.

48 points by hotdailys 3y ago

politician 3y ago

Will this result in a new tool to unlock confiscated iPhones?

ViktorRay 3y ago
Article says it affects M chips which aren’t on iPhones. Just on MacBooks
- datavirtue 3y ago
  iPads aren't shipping with M1 chips?
  - bdcravens 3y ago
    yes, but iPhones are not
Kluggy 3y ago
No. The attacker needs to load on a program and then run it against the target program to extract keys. This doesn’t work with anything in the Secure Enclave and things like iCloud don’t expose an endpoint for the attacker program to send data to. Plus you can’t load a program on the device if it’s locked.

deleted 3y ago

[deleted]

consumer451 3y ago

This is a summary of the Ars reporting [0] on the original research [1]. [0] https://arstechnica.com/security/2024/03/hackers-can-extract-secret-encryption-keys-from-apples-mac-chips/ https://arstechnica.com/security/2024/03/hackers-can-extract... [1] https://gofetch.fail/ https://gofetch.fail/

pvg 3y ago

Recent thread: https://news.ycombinator.com/item?id=39779195 https://news.ycombinator.com/item?id=39779195

ChrisArchitect 3y ago

[dupe]

heresie-dabord 3y ago

Apple experts, how subtle is this constraint for this exploit? > The GoFetch attack uses the same user privileges as many other third-party macOS apps, rather than root access. This lowers the barrier to entry for actually run the attack, but it's not entirely the whole story. > The GoFetch app running the attack must also be used on the same chip cluster as the cryptographic target app in order to function, and both must use the efficiency cores or the performance cores at the same time. = = = edit for additional context > The threat resides in the chips’ data memory-dependent prefetcher, a hardware optimization that predicts the memory addresses of data that running code is likely to access in the near future. [...] DMPs are a relatively new phenomenon found only in M-series chips and Intel's 13th-generation Raptor Lake microarchitecture

deleted 3y ago
[deleted]
sliken 3y ago
Additionally the exploit is not present on the e-cores and the M3 allows turning off the speculation on a processes by process basis so encryption programs can safely just disable it.