Vulnerability with a risk of private key leakage has been discovered in Apple’s macOS chips
It stems from the microarchitecture of the chips and cannot be eliminated
22.03.2024 - 13:12
129
3 min
0
What’s new? A recently discovered vulnerability in Apple’s M-series chips allows attackers to extract encryption keys from Mac computers, Ars Technica reports, citing academic researchers. The flaw cannot be fixed, as it is a consequence of the chip’s microarchitecture, but can be mitigated by creating third-party security software.
What else is known? An attacker can exploit the vulnerability when a targeted cryptographic operation and a malicious application with normal system user rights run on the same processor cluster.
In this case, the use of third-party security software can significantly degrade the performance of cryptographic operations, especially on earlier generations of M1 and M2 chips.
The attack, which the researchers called GoFetch, uses an application that, like most third-party apps on macOS, does not require administrator privileges. The M-series chips are divided into clusters. For example, the M1 has two clusters: one containing four efficiency cores and the other containing four performance cores.
As long as the malicious application and the crypto application targeted by the hacker are running in the same performance cluster, even if they are running on different cores within the cluster, GoFetch can mine the secret key.
As the researchers write, the GoFetch app takes less than an hour to extract a 2048-bit RSA key and just over two hours to extract a 2048-bit Diffie-Hellman key. Extracting the material needed to assemble the Kyber-512 key would take 54 minutes, while the Dilithium-2 key would take about 10 hours.
Unciphered professionals have found a way to hack the Trezor T crypto wallet
The company managed to obtain a seed phrase and a PIN code using a discovered vulnerability in the device’s chip
Late last year, hackers attacked decentralized applications using a code vulnerability in the Ledger Connect tool, which is required to connect to Ledger hardware wallets. The vulnerability was later fixed.
Useful material?
Market
The expert also warned of the risks of the growing popularity of launching projects with high fully diluted valuations
May 20, 2024
Market
Analysts note that from 2024 to 2030, tokens worth $155 billion will be unlocked
May 17, 2024
Technologies
The new mechanism has already made it possible to calculate over tens of millions of fraudulent addresses
May 16, 2024
Incidents
The amount of damage amounted to $25 million in cryptocurrencies
May 16, 2024
Market
FTX customers will be compensated in cash, unlike Mt. Gox and Gemini customers who will receive cryptocurrencies
May 16, 2024
Technologies
It is available to crypto wallet users worldwide as an additional feature
May 15, 2024