Apple MAC Vulnerability Cryptocurrency Vulnerability: If you are using an Apple computer made in the last half decade with a cryptocurrency wallet installed, be careful because hackers could be trying to steal your assets.
Researchers have found a vulnerability in Apple’s M series of chips that allows attackers to extract secret keys from Macs when carrying out cryptocurrency transactions, Arstechnica and other news outlets reported, citing an article published by a group of academics in the United States. United on Thursday.
The vulnerability in question functions as a side channel, thus allowing end-to-end key extraction when Apple chips run implementations of commonly used cryptographic protocols, one of the reports explains.
The flaw is present in the M1, M2 and M3 series, which power all of Apple’s latest devices, and could allow hackers to steal cryptographic keys from cryptocurrency software wallets installed on the devices.
Serious vulnerability in Apple M series
The way malicious actors could exploit the vulnerability is through an attack that has been dubbed “GoFetch exploit.” It works by gaining access to the computer’s CPU cache through data memory-dependent prefetchers (DMPs) built into the chips, as detailed in a Zero Day note.
While the cryptographic key itself is not cached, fragments of material derived from the key are placed in the cache, and an attacker can piece them together in a way that allows him to reconstruct the key, after causing the processor to do it several times, add that post.
Apple iOS vulnerability
“In a cache side-channel attack, an attacker infers the secret of a victim program by observing the side effects of secret-dependent accesses of the victim program to the processor cache,” the researchers said, as quoted by Decrypt. “We assume that the attacker and victim do not share memory, but that the attacker can monitor any available microarchitectural side channels, for example, cache latency.”
The researchers created a malicious program, which they called “GoFetch,” to perform the trick. The experiment was validated using the Apple M1 4 Core Firestorm (performance). They demonstrated the feasibility in a video this week after having reported the problem to Apple in December without getting a response.
No patch and no optimal solution
Asked about the likely targets of this type of attack, Matthew Green, a cryptographer and computer science professor at Johns Hopkins University, told Zero Day that hackers will likely go after wealthy cryptocurrency investors.
“We’re talking about high-level users, like someone who has a cryptocurrency wallet with a lot of money,” he said. However, he notes that, in theory, this attack could be used more broadly “to break the TLS cryptography that a computer’s browser uses to encrypt communication between your computer and websites,” which could allow attackers access email accounts such as Gmail. It also affects browser-based applications like MetaMask.
Cryptocurrency Vulnerabilities Apple MAC
“I’m not saying it’s a practical attack, I’m just saying that’s the kind of threat you might be worried about,” he added, “it can obtain [other] potentially very valuable keys,” including iCloud keys to access backed up data.
The vulnerability, being a chip flaw, has no direct resolution and Apple cannot simply release a patch as it would for operating system flaws. Instead, the company could fix the problem in its next chip designs.
Researchers have found a way for cryptocurrency users to protect themselves from the vulnerability, although this means their device’s performance may be drastically reduced.
Beyond this, the general recommendation for those who have a cryptocurrency wallet installed on an Apple device with an M-series chip—that is, an Apple desktop, laptop, or tablet manufactured after 2020—is to remove that system wallet to play it safe. Those with older Apple devices are safe.
Read: Samsung Galaxy A55 and Galaxy A35 launched, 50MP camera and 5000mAh battery, price is this much
