Vulnerability with a risk of private key leakage has been discovered in Apple’s macOS chips
It stems from the microarchitecture of the chips and cannot be eliminated
22.03.2024 - 13:12
113
3 min
0
What’s new? A recently discovered vulnerability in Apple’s M-series chips allows attackers to extract encryption keys from Mac computers, Ars Technica reports, citing academic researchers. The flaw cannot be fixed, as it is a consequence of the chip’s microarchitecture, but can be mitigated by creating third-party security software.
What else is known? An attacker can exploit the vulnerability when a targeted cryptographic operation and a malicious application with normal system user rights run on the same processor cluster.
In this case, the use of third-party security software can significantly degrade the performance of cryptographic operations, especially on earlier generations of M1 and M2 chips.
The attack, which the researchers called GoFetch, uses an application that, like most third-party apps on macOS, does not require administrator privileges. The M-series chips are divided into clusters. For example, the M1 has two clusters: one containing four efficiency cores and the other containing four performance cores.
As long as the malicious application and the crypto application targeted by the hacker are running in the same performance cluster, even if they are running on different cores within the cluster, GoFetch can mine the secret key.
As the researchers write, the GoFetch app takes less than an hour to extract a 2048-bit RSA key and just over two hours to extract a 2048-bit Diffie-Hellman key. Extracting the material needed to assemble the Kyber-512 key would take 54 minutes, while the Dilithium-2 key would take about 10 hours.
Unciphered professionals have found a way to hack the Trezor T crypto wallet
The company managed to obtain a seed phrase and a PIN code using a discovered vulnerability in the device’s chip
Late last year, hackers attacked decentralized applications using a code vulnerability in the Ledger Connect tool, which is required to connect to Ledger hardware wallets. The vulnerability was later fixed.
Useful material?
Market
Funds can be seized by law enforcers due to links to illegal activity
Apr 26, 2024
Market
Tether Finance division will be responsible for the issuance and redemption of USDT stablecoins
Apr 18, 2024
Trends
The first project introduced on the platform will be BounceBit (BB)
Apr 18, 2024
Business
The rate exchange of the native ACH token reacted with a 10% increase
Apr 18, 2024
Market
Miners are hunting for the first block after halving as the value of the first satoshi could exceed $1 million
Apr 18, 2024
Market
The platform will be non-custodial and accessible to everyone
Apr 15, 2024