iLeakage: New Safari Exploit Impacts Apple iPhones and Macs with A- and M-Series CPUs

In the realm of cybersecurity, innovation doesn’t always signify progress. A recent discovery by a group of academics has uncovered an unsettling vulnerability that impacts users of Apple iPhones and Macs. This newfound vulnerability, named “iLeakage,” exploits a flaw present in Apple’s A- and M-series CPUs, which are commonly found in these devices. It poses a significant threat to the security of users across Apple’s iOS, iPadOS, and macOS platforms.

At its core, iLeakage exploit is a novel Spectre-style speculative execution attack. What distinguishes it is its ability to manipulate Apple’s Safari web browser. This manipulation prompts Safari to render a seemingly harmless webpage, all the while discreetly extracting sensitive information through speculative execution techniques. It’s a silent intrusion, a security loophole with far-reaching implications.

Imagine a scenario where a malicious actor crafts a deceptive webpage, enticing unsuspecting users into a trap. This trap lies in the webpage’s capability to steal content from Gmail inboxes and even retrieve passwords stored in credential managers. This exploit transcends traditional cybersecurity threats, leaving users and organizations exposed to unprecedented risks.

iLeakage doesn’t discriminate based on browser choice. It impacts all third-party web browsers available for iOS and iPadOS, owing to Apple’s policy mandating browser vendors to use Safari’s WebKit engine. As a result, this threat extends beyond Safari users, encompassing anyone using an alternative browser on Apple devices.

Upon discovering this vulnerability, researchers promptly alerted Apple on September 12, 2022. The impact extends to all Apple devices released from 2020, powered by A-series and M-series ARM processors. This revelation serves as a stark reminder of the pressing need for a comprehensive solution to address this vulnerability.

iLeakage’s success lies in its ability to manipulate malicious JavaScript and WebAssembly code embedded within a single browser tab. This code, often disguised within a benign-looking webpage, stealthily accesses content from a target website when a user unknowingly visits the attacker’s-controlled page. It achieves this through a side-channel exploit, leveraging variables like timing, power consumption, and electromagnetic emanations to infer sensitive information.

Speculative execution, the cornerstone of this exploit, is a performance optimization mechanism present in modern CPUs. It involves executing program instructions out of order to enhance processing speed, based on predictions about the program’s path. However, erroneous predictions can leave traces in the processor’s cache, which attackers can exploit to access confidential data through microarchitectural side-channels.

iLeakage not only bypasses Apple’s security measures but also deploys a timer-less, architecture-agnostic method. This method exploits race conditions to distinguish cache hits from cache misses when two processes, one linked to the attacker and the other to the target, run on the same CPU. This creates a covert channel that forms the foundation for an out-of-bounds read within Safari’s rendering process, ultimately leading to information leakage.

While the technical expertise required to execute iLeakage attacks makes them unlikely in practical real-world scenarios, this revelation underscores the persistent threat posed by hardware vulnerabilities, even in the face of advancements in cybersecurity for ransomware attacks.

iLeakage serves as a stark reminder of the ever-present challenges in the realm of cybersecurity. As the digital landscape evolves, so do the threats. It is imperative that users, organizations, and tech giants like Apple remain vigilant, adapting to the changing landscape to ensure the security and privacy of their data and devices. Stay tuned for updates on this critical issue as researchers and tech companies work towards comprehensive solutions to mitigate the risks associated with iLeakage.

In the face of these evolving threats, businesses must remain proactive in safeguarding their data and infrastructure. Ampcus Cyber, a trusted leader in cybersecurity, offers tailored solutions to protect against such vulnerabilities and emerging threats like iLeakage, BunnyLoader Malware, etc.

• Comprehensive Vulnerability Assessment: Ampcus Cyber conducts in-depth assessments to identify and address vulnerabilities within your organization’s security infrastructure.
• Customized Security Solutions: Ampcus Cyber provides tailored security compliance solutions that align with your unique business needs, ensuring the highest level of protection.

Our team of experts works tirelessly to stay ahead of emerging threats, allowing you to focus on what matters most, running your business securely and efficiently.

Enjoyed reading this article? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.