A team of researchers has devised a novel side-channel attack dubbed iLeakage which exploits a weakness in the A- and M-series CPUs running on Apple iOS, iPadOS, and macOS devices, to extract sensitive information from the Safari web browser.
iLeakage has been developed by a team of academics from the University of Michigan, Georgia Institute of Technology, and Ruhr University Bochum after extensive examination of Safari’s side-channel resilience. They have also published a paper and website warning users about the threat.
In a practical attack scenario, the weakness could be exploited using a malicious web page to recover Gmail inbox content and even recover passwords that are autofilled by credential managers.
iLeakage, a new Spectre-style speculative execution attack against Apple Silicon CPUs, also works against all third-party web browsers available for iOS and iPadOS due to Apple’s App Store policy that mandates all browser vendors to use Safari’s WebKit engine.
The exploit impacts all Apple devices released from 2020 that are powered by Apple’s A-series and M-series ARM processors.
Malicious JavaScript and WebAssembly embedded in a web page in one browser tab can secretly read the content of a target website when a victim visits the attacker-controlled web page.
This is done by a side-channel exploit that can be weaponized by a malicious actor to infer sensitive information through other variables like timing, power consumption, or electromagnetic emanations.
The side-channel that acts as the foundation of the latest attack is a performance optimization mechanism in modern CPUs called speculative execution.
The researchers published a series of PoC videos for attacks to recover. Apple was notified of the findings on September 12, 2022. Apple has released a mitigation for iLeakage in Safari, however it is not enabled by default, and it can be enabled only on macOS.
The researchers pointed out that iLeakage is difficult to detect, however the attack is not easy to conduct.
Comments