#ileakage — Public Fediverse posts

#iLeakage Attack: Theft of Sensitive Data from #Apple’s #Safari #Browser
What happens in iLeakage attacks is that the #CPU is tricked into #speculativeexecution of code that reads sensitive data from memory. https://www.hackread.com/ileakage-attack-sensitive-data-theft-apple-safari-browser/ #sidechannel attack

Great, just great 😠:

“iLeakage: Browser-Based Timerless Speculative Execution Attacks On Apple Devices” (https://ileakage.com/).

On HN: https://news.ycombinator.com/item?id=38015277

On Lobsters: https://lobste.rs/s/4hvwum/ileakage_browser_based_timerless

#Apple #Security #Safari #MacOS #iOS #Vulnerability #ZeroDay #iLeakage

#iLeakage, la faille qui exploite Safari et les puces Apple pour faire fuiter des informations
https://www.nextinpact.com/article/72770/ileakage-faille-qui-exploite-safari-et-puces-apple-pour-faire-fuiter-informations
Sur #iOS et #macOS, il est possible de forcer le navigateur Safari à révéler des informations sensibles, jusqu’aux mots de passe. Pour fonctionner, la méthode exploite également les puces #Apple. Elle demande cependant quelques conditions, dont… du temps.

By me at Forbes: Running Apple silicon?

Researchers demo iLeakage side-channel exploit that can steal passwords and read your Gmail.

#infosec #Apple #iphone #Gmail #iLeakage

https://www.forbes.com/sites/daveywinder/2023/10/28/ileakage-hackers-can-read-gmail-on-all-2020-or-later-iphones-and-macs/

Exploiting WebKit on Apple silicon

"The researchers implement iLeakage as a website. When visited by a vulnerable macOS or iOS device, the website uses JavaScript to surreptitiously open a separate website of the attacker’s choice and recover site content rendered in a pop-up window. The researchers have successfully leveraged iLeakage to recover YouTube viewing history, the content of a Gmail inbox—when a target is logged in—and a password as it’s being autofilled by a credential manager. Once visited, the iLeakage site requires about five minutes to profile the target machine and, on average, roughly another 30 seconds to extract a 512-bit secret, such as a 64-character string..."

"For the attack to work, a vulnerable computer must first visit the iLeakage website. For attacks involving YouTube, Gmail, or any other specific Web property, a user should be logged into their account at the same time the attack site is open. And as noted earlier, the attacker website needs to spend about five minutes probing the visiting device. Then, using the window.open JavaScript method, iLeakage can cause the browser to open any other site and begin siphoning certain data at anywhere from 24 to 34 bits per second."

https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/

#opsec #infosec #security #tech #Apple #exploit #webkit #MacOS #iLeakage

#iLeakage: #Safari unzureichend vor #Spectre-Seitenkanalangriff geschützt | Security https://www.heise.de/news/iLeakage-Schutz-vor-Spectre-Seitenkanalangriff-in-Safari-unzureichend-9344659.html #SafariBrowser #Apple #iOS #iPadOS #macOS

Monoculture by fiat produces predictable result:

"As Apple requires all browsers on its App Store to be based on WebKit, third-party browsers on Apple devices, like Chrome and Firefox, are essentially just Safari with proprietary wrappers on them that add functionality, and are therefore vulnerable to the attack."

Ready for a conflagration, just as in nature!

#iLeakage
#AppleMonoculture

https://www.theregister.com/2023/10/26/ileakage_apple_exploit/

iLeakage × Safari: Spectre nun auch bei Apple-CPUs ein Thema https://www.computerbase.de/2023-10/ileakage-x-safari-spectre-nun-auch-bei-apple-cpus-ein-thema/ #iLeakage #Safari #Apple #iOS #macOS #Sicherheitslücke

Schwere Sicherheitslücke bei Apple: iPhones, iPads und Macs betroffen

Apple sieht sich mit einer schwerwiegenden Sicherheitslücke konfrontiert. Noch scheint keine Lösung für das Problem in Sicht zu sein.

https://t3n.de/news/sicherheit-apple-iphone-ipad-mac-1584842/?utm_source=mastodon&utm_medium=referral
#Apple #iPhone #iPad #Mac #Safari #iLeakage

#iLeakage: Browser-based Timerless Speculative Execution Attacks on #Apple Devices :apple_inc:

https://ileakage.com/

"🚨 iLeakage: Safari's Side Channel Vulnerability Exposed! 🍎🔓"

Researchers have unveiled a new attack, dubbed "iLeakage", that exploits a side channel vulnerability in Apple's A- and M-series CPUs. This attack forces Apple’s Safari browser on iOS and macOS devices to reveal passwords, Gmail content, and more. The exploit is practical and doesn't require vast resources but demands in-depth reverse-engineering of Apple hardware. The side channel exploited is speculative execution, a feature in modern CPUs that has been the foundation for numerous attacks recently. The iLeakage attack, when executed, can recover YouTube viewing history, Gmail inbox content, and even passwords autofilled by credential managers. Apple is aware and plans to address this in an upcoming software release. 🚀🔍

Source: Ars Technica

Author: Dan Goodin - Senior Security Editor at Ars Technica. Profile

Tags: #iLeakage #Apple #Safari #SideChannel #Vulnerability #CyberSecurity #iOS #macOS #SpeculativeExecution 🌐🔐🍏

Über eine manipuliserte Webseite lassens ich Passwörter und andere sensible Daten von #Apple-Systemen stehlen. Ausgangspunkt auch hier: Ein Seitenkanal-Angriff auf den Prozessor. #iLeakage https://winfuture.de/news,139205.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

#Hackers can force #iOS and #macOS #browsers to divulge #passwords and much more | Ars Technica

#iLeakage is practical and requires minimal resources. A patch isn't (yet) available.
#privacy #security

https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/

#ileakage is a fine example of why browser diversity is important for a healthy web ecosystem.

Hackers can force #iOS and #macOS browsers to divulge passwords and much more
Researchers devised an attack that forces #Apple’s #Safari browser to divulge #passwords, Gmail message content, and other secrets by exploiting a side channel #vulnerability in A- and M-series CPU running modern iOS and macOS devices dubbed #iLeakage. The side channel in this case is #speculativeexecution, a performance enhancement feature in modern #CPU that formed the basis of many attacks https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/

So glad #Apple only allows WebKit on the iPhone.... oh wait.

"While #iLeakage works against Macs only when running Safari, iPhones and iPads can be attacked when running any browser because they’re all based on Apple’s WebKit browser engine."

iLeakage can force Apple's Safari browser to reveal passwords and sensitive data

https://stackdiary.com/ileakage/

#ileakage #apple #security #infosec