What a fantastic journey you took us all on there....
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Apple Silicon Vulnerability Allows Hackers to Extract Encryption Keys
- Thread starter MacRumors
- Start date
- Sort by reaction score
This is why the EU wanting to open up iOS is very bad for consumer. A closed highly vetted AppStore system is very beneficial to the end consumer than an open AppStore
Hmm.. My iPhone 11 Pro Max is still running great (two family members with the same).
Although my MacBook Pro from 2016 isn't upgradeable to the latest MacOS, they still support it at their store's for repairs (battery, as an example).
My wife's 2019 MacBook Pro is able to be upgraded to the latest MacOS. Almost five years? That's pretty good support and not too quick. ❤️
Were you a Mac user back in the 90's? There was a popular system add-on called RAM Doubler that claimed to compress what was stored in RAM, effectively giving the Mac access to more.
RAM Doubler remembered
RAM Doubler was a 1990s product for Mac computers which was taken down by falling RAM prices & a competing product not working. Find out what happened to this popular utility.
dfarq.homeip.net
Let’s forget DMA or anything, the nice conversations between you and danieldk have converged on a couple of suggestions regarding what makes this exploit even worse, one of them referring to attack vectors via a compromised already running software, installing new compromised software, social engineering, etc…
Would you agree that having more venues and more places to deploy software (more AppStore’s out of reach from Apple’s iron hand), more lanes available to install (side loading and whatnot), etc would offer more chances to hit jackpot with however this GoFetch thing can start to happen?
Yes, it’s true that even Apple itself escapes malware and copycats, but let’s keep it simple here: if 1 AppStore has “10 units chances of infecting someone with the GoFetch”, would 30 AppStores increase that to “300 units chances”?
Because that sounds like a pretty reasonable argument to make, then again I’m terribly ignorant in all things security and hacking. Can’t even begin to assess how likely, if and when I’m getting hacked by this go fetch stuff.
Yeah, Apple's official statement on this was: "You want fast? You want cheap? You want secure? Pick ONE (as long as it's the first one)"
I think it goes: “do you want it fast, correct or under budget? Pick two out of three.
They knew about it in October 2023. The independents who found this MASSIVE exploit gave them 100 days to fix it but Apple only patched it 5 days ago...
Apple’s unfixable CPU exploit: 3 practical security takeaways
All systems can be exploited. Whether that’s a freebie giveaway or computer hardware, humans will often find the weaknesses. Back in in 2018, Intel first swallowed this bitter pill when the widespread Spectre vulnerability came to light. Then in the more recent past, AMD got hit last summer with...
Ok I'm gonna set the record straight: it's an old engineering saying: "you can have it fast, cheap, reliable - pick two"
If you pick fast and cheap, is NOT going to be reliable
If you want it cheap and reliable, it's NOT going to be fast
If you want it fast and reliable, it's NOT going to be cheap
You CAN'T have all three
What do you want to achieve with this kind of comment? The exploit is neither massive nor practical. You need access to the target machine, access to a cryptographic API that you can invoke continuously, exact knowledge of the cryptographic algorithm, extreme level of control on what runs on the machine (since any other process running on the same L2 will render your attack inefficient), as well as huge amount of computational time and memory. This is extremely difficult to do in the real world, if even possible.
This kind of research is very important as it illustrates how difficult secure computing is on modern hardware. A “MASSIVE exploit” though? Hardly. Frankly, I’d be much more worried about exploits like rowhammer that allow attacker to modify privileged memory rather than these things.
Last edited:
All I keep seeing reading is this issue is bad but yet no one seems to be explaining in 'real world' terms just how bad. If the exploit is used just exactly what will it affect? will it mean all passwords become vulnerable? is the purpose of the exploit just to take control of someone's machine? is the exploit going to expose peoples passwords to email accounts? online bank accounts? There are already hacks and exploits that can do those things so what makes this new exploit so bad?
It can't be patched. It affects all m series chips. It can be executed remotely. Any mitigation will impact performance. It is a hardware flaw. Since it is a relatively new vulnerability I don't think there is immediate danger but what happens in the next several months will be telling.
So far only physical access to a machine has been tested taking minutes to hours to gain encryption keys not in secure enclave but in memory. But the possibility for remote execution via an infected app exists.
No matter how you slice it is pretty serious. I am sure it will be mitigated but it will come at a cost. Will the fix be issued before real wild exploits occur is anyone's guess.
Since for now it is limited to physical access there is no immediate threat.
And this is a summarization I made on my own by reading through this thread. Mostly two other people, hacky another member know much more than I.
All you have done is parrot phrase what the majority are saying and thus does not answer any of my questions. I have asked pacifically what does this exploit effect as in terms of real world usage. Yes we know it is a hardware flaw, yes we know it can be worked remotely but again all we keep on hearing is that it is dangerous and my question is dangerous how? All this technobabble is pointless and of no use to a lot of people. What people want to know is what real world applications will be affected, admin access to the computer? all passwords being vulnerable? what?
I've gone to website and read the paper and it does nothing to inform the readers of what danger the exploit can do. So, for hypothetical sake, lets say someone opens an email attachment with the exploit and it runs on their mac book. The exploit sends back the cryptographic keys of the machine. What is the hacker going to be able to do with those keys? Will they be able to access someone's bank account with those keys? will they be able to access someone's email account with those keys?
How? Can you give an example of a remote attack?
Secure computation and performance don't mix, so this is not a problem.
It's hardly a flaw, it's exploitable behavior. The hardware itself does not operate in a faulty way and does not violate any defined contracts. Again, secure computing is hard, and what recent years show is that trying to do secure compute on general-purpose CPU is a futile effort. What we really need are isolated security coprocessors (which we have) and/or "secure execution mode" where any kind of speculative execution is disabled.
Infected app ≠ remote execution.
Also the research paper did more than have access to a physical machine. They had access to the source code and could carefully set up the system so that the cryptographic function and the exploit execute within the same L2 cluster, with third-party L2 noise being kept to the minimum. Not to mention that they could repeatedly invoke the cryptographic function from the exploit. None of this is realistic in a real-world usage.
What is the basis for this statement?
Wait, this is your summary after reading a thread on Internet forums? Did you read the original paper? Do you have experience in cryptography and secure computation? Do you have a background in computer science or software development?
The OP's point is that Apple does not get serious until the media exposes it. You seem to think that it is just coincidence that Apple has a release ready 5 days after it becomes public. Well it is NOT coincidence, nor is it expediency. Apple waited until they had no choice in the public's eyes.
By this logic, why even protect the cryptographic keys? Just make them public, no one can use them right!
Let me answer that, WRONG! These keys can then be used with other exploits, probably some we do not even know about. Wake up.
I do not understand this comment. What do latest Apple software releases have to do with the exploit being discussed?
As to the exploit itself, Apple might release a minor change to the browser engine to ensure that the threads are not being executed at the same L2 cluster as the cryptographic engine for prolong period of time (or they could just time-throttle the cryptographic engine which will achieve the same effect). Given that the exploit does not look practical, it probably won't be given too much consideration. Then again, I am not a security researcher, so I might be misunderstanding the impact.
Well, considering no one seems capable of answering my simple questions it is therefore my opinion this exploit is not as dangerous as people make it out to seem because if it was people in here would be telling us to avoid doing this and avoid doing that which is basically what my questions are asking but as no one is doing so, this exploit has no relevance to us users.
What is the kind of the cryptographic keys an attacker could gain with this particular exploit that they can use elsewhere? Can you give some concrete examples?
Can you give me a reason for NOT making the cryptographic keys public? If so, you have your answer. Lets quit playing word games and actually thing.
If there is no risk, then why does Apple hide the cryptographic keys?