A newly discovered vulnerability baked into Apple’s M-series of chips allows attackers to extract secret keys from Macs when they perform widely used cryptographic operations, academic researchers have revealed in a paper published Thursday.

The flaw—a side channel allowing end-to-end key extractions when Apple chips run implementations of widely used cryptographic protocols—can’t be patched directly because it stems from the microarchitectural design of the silicon itself. Instead, it can only be mitigated by building defenses into third-party cryptographic software that could drastically degrade M-series performance when executing cryptographic operations, particularly on the earlier M1 and M2 generations. The vulnerability can be exploited when the targeted cryptographic operation and the malicious application with normal user system privileges run on the same CPU cluster.

  • SteefLem@lemmy.world
    link
    fedilink
    English
    arrow-up
    7
    ·
    8 months ago

    So apple want everyone that has a m1 or m2 to buy the……m3 :) Joke. But thats serious fuck up.

    • hudson@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      2
      ·
      8 months ago

      It sounds pretty bad, but, fortunately, it’s able to be mitigated with software patches. for now, anyway. Also, fortunately, it’s in older–series chips and won’t present a problem moving forward with newer series chips.

      Still, not good.

      • Ptsf@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        7 months ago

        The vulnerability is actually present in modern series chips as well, it’s just that they include an optional chip flag that cryptography libraries may leverage to disable the speculative processing that causes the leak.

  • ApeNo1@lemm.ee
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    1
    ·
    8 months ago

    Looks like these M series vulnerabilities will be Apple’s Downfall.

  • sadreality@kbin.social
    link
    fedilink
    arrow-up
    2
    arrow-down
    1
    ·
    8 months ago

    The real question is this on purpose or not.

    Either way, Apple done fucked up. If this was on purpose, seems like a rookie move since they need this bitch to stay zero day.