Vulnerability with a risk of private key leakage has been discovered in Apple’s macOS chips
It stems from the microarchitecture of the chips and cannot be eliminated
![Vulnerability with a risk of private key leakage has been discovered in Apple’s macOS chips](https://storage.getblock.net/source/1/qWrk7J12mrH9XMA9-mJfJ6pNadTsWgi6.webp)
22.03.2024 - 13:12
172
3 min
0
What’s new? A recently discovered vulnerability in Apple’s M-series chips allows attackers to extract encryption keys from Mac computers, Ars Technica reports, citing academic researchers. The flaw cannot be fixed, as it is a consequence of the chip’s microarchitecture, but can be mitigated by creating third-party security software.
What else is known? An attacker can exploit the vulnerability when a targeted cryptographic operation and a malicious application with normal system user rights run on the same processor cluster.
In this case, the use of third-party security software can significantly degrade the performance of cryptographic operations, especially on earlier generations of M1 and M2 chips.
The attack, which the researchers called GoFetch, uses an application that, like most third-party apps on macOS, does not require administrator privileges. The M-series chips are divided into clusters. For example, the M1 has two clusters: one containing four efficiency cores and the other containing four performance cores.
As long as the malicious application and the crypto application targeted by the hacker are running in the same performance cluster, even if they are running on different cores within the cluster, GoFetch can mine the secret key.
As the researchers write, the GoFetch app takes less than an hour to extract a 2048-bit RSA key and just over two hours to extract a 2048-bit Diffie-Hellman key. Extracting the material needed to assemble the Kyber-512 key would take 54 minutes, while the Dilithium-2 key would take about 10 hours.
![Unciphered professionals have found a way to hack the Trezor T crypto wallet](https://storage.getblock.net/source/1/MwHCRACgs0eVBepXPrDnznSeC6cXalwC.png)
Unciphered professionals have found a way to hack the Trezor T crypto wallet
The company managed to obtain a seed phrase and a PIN code using a discovered vulnerability in the device’s chip
Late last year, hackers attacked decentralized applications using a code vulnerability in the Ledger Connect tool, which is required to connect to Ledger hardware wallets. The vulnerability was later fixed.
Useful material?
Market
Australia’s largest financial institutions have refused to process payments to digital asset trading platforms due to the risk of fraud
Jul 26, 2024
Politics
According to the politician, the value of the country’s bitcoin reserves should equal the value of gold reserves
Jul 26, 2024
Mining
The capacity of the Bitaxe device used by the network participant is only 500 Gh/s
Jul 25, 2024
Trends
Meanwhile, Trump-inspired assets have not shown significant growth
Jul 22, 2024
Market
The fee will be as much as 2,5% compared to 0,25-0,19% for competitors
Jul 18, 2024
Market
This is the third consecutive month of decline
Jul 18, 2024