Apple’s Custom Chips Contain Newly Discovered Vulnerabilities
A New Direction
Apple-designed chips powering Macs, iPhones, and iPads contain two newly discovered vulnerabilities that leak credit card information, locations, and other sensitive data from the Chrome and Safari browsers as they visit sites such as iCloud Calendar, Google Maps, and Proton Mail.
The Problem: Speculative Execution
The vulnerabilities, affecting the CPUs in later generations of Apple A- and M-series chip sets, open them to side channel attacks, a class of exploit that infers secrets by measuring manifestations such as timing, sound, and power consumption. Both side channels are the result of the chips’ use of speculative execution, a performance optimization that improves speed by predicting the control flow the CPUs should take and following that path, rather than the instruction order in the program.
How it Works
The Apple silicon affected takes speculative execution in new directions. Besides predicting control flow CPUs should take, it also predicts the data flow, such as which memory address to load from and what value will be returned from memory.
FLOP: A Powerful Attack
The most powerful of the two side-channel attacks is named FLOP. It exploits a form of speculative execution implemented in the chips’ load value predictor (LVP), which predicts the contents of memory when they’re not immediately available. By inducing the LVP to forward values from malformed data, an attacker can read memory contents that would normally be off-limits. The attack can be leveraged to steal a target’s location history from Google Maps, inbox content from Proton Mail, and events stored in iCloud Calendar.
SLAP: Another Attack
SLAP, meanwhile, abuses the load address predictor (LAP). Whereas LVP predicts the values of memory content, LAP predicts the memory locations where instruction data can be accessed. SLAP forces the LAP to predict the wrong memory addresses. Specifically, the value at an older load instruction’s predicted address is forwarded to younger arbitrary instructions. When Safari has one tab open on a targeted website such as Gmail, and another open tab on an attacker site, the latter can access sensitive strings of JavaScript code of the former, making it possible to read email contents.
Conclusion
These newly discovered vulnerabilities highlight the importance of security in the design of Apple’s custom chips. Apple must take immediate action to address these issues and ensure the security of its customers’ sensitive data.
Frequently Asked Questions
Q: What are the vulnerabilities in Apple’s custom chips?
A: The vulnerabilities are side-channel attacks that exploit the speculative execution feature of the chips, allowing attackers to infer sensitive information such as credit card numbers, locations, and other data.
Q: What are the two types of side-channel attacks?
A: The two attacks are FLOP and SLAP. FLOP exploits the load value predictor (LVP), while SLAP abuses the load address predictor (LAP).
Q: What is the potential impact of these vulnerabilities?
A: The attacks can be used to steal sensitive data, such as location history from Google Maps, inbox content from Proton Mail, and events stored in iCloud Calendar.
Q: How can users protect themselves from these vulnerabilities?
A: Apple should provide patches and updates to address these issues, and users should ensure their devices are running with the latest software and security updates.
