Vulnerability with a risk of private key leakage has been discovered in Apple’s macOS chips
It stems from the microarchitecture of the chips and cannot be eliminated
22.03.2024 - 13:12
234
3 min
0
What’s new? A recently discovered vulnerability in Apple’s M-series chips allows attackers to extract encryption keys from Mac computers, Ars Technica reports, citing academic researchers. The flaw cannot be fixed, as it is a consequence of the chip’s microarchitecture, but can be mitigated by creating third-party security software.
What else is known? An attacker can exploit the vulnerability when a targeted cryptographic operation and a malicious application with normal system user rights run on the same processor cluster.
In this case, the use of third-party security software can significantly degrade the performance of cryptographic operations, especially on earlier generations of M1 and M2 chips.
The attack, which the researchers called GoFetch, uses an application that, like most third-party apps on macOS, does not require administrator privileges. The M-series chips are divided into clusters. For example, the M1 has two clusters: one containing four efficiency cores and the other containing four performance cores.
As long as the malicious application and the crypto application targeted by the hacker are running in the same performance cluster, even if they are running on different cores within the cluster, GoFetch can mine the secret key.
As the researchers write, the GoFetch app takes less than an hour to extract a 2048-bit RSA key and just over two hours to extract a 2048-bit Diffie-Hellman key. Extracting the material needed to assemble the Kyber-512 key would take 54 minutes, while the Dilithium-2 key would take about 10 hours.
Unciphered professionals have found a way to hack the Trezor T crypto wallet
The company managed to obtain a seed phrase and a PIN code using a discovered vulnerability in the device’s chip
Late last year, hackers attacked decentralized applications using a code vulnerability in the Ledger Connect tool, which is required to connect to Ledger hardware wallets. The vulnerability was later fixed.
Useful material?
Telegram 
Twitter Technologies
Network fees will be integrated into the cost of swaps
Nov 22, 2024
Market
The company’s unrealized profits from investing in its first cryptocurrency approached $14 billion
Nov 19, 2024
Incidents
The search, the reason for which was not announced, took place a week after the election, the results of which Polymarket users predicted quite accurately
Nov 14, 2024
Market
Analysts point to the growing popularity of the first cryptocurrency as a safe haven asset
Nov 13, 2024
Market
The product will begin trading on the Swiss Exchange on November 19
Nov 12, 2024
Market
The company’s unrealized profits from investing in the first cryptocurrency approached $13 billion
Nov 12, 2024
Cryptocurrency rates
-
Bitcoin
$97 971
BTC
-0.07%
-
Ethereum
$3 357.19
ETH
-1.92%
-
BNB Smart Chain
$579.4
BSC
+1.23%
-
Ripple
$1.41
XRP
-4.18%
-
Dogecoin
$0.424062
DOGE
-3.67%
-
Cardano
$1.01
ADA
-5.69%
-
Stellar XLM
$0.526483
XLM
+3.3%
-
Polkadot
$8.65
DOT
-10.83%
-
Bitcoin Cash
$510.7
BCH
-1.43%
-
Litecoin
$96.38
LTC
-4.75%