Researchers have revealed a flaw in Apple M1 chips that allows hackers to steal cryptographic keys via CPU manipulation.
Hackers have a new way to try and steal your crypto—and if you’re using an Apple device made in the last half decade, there’s not much you can do to mitigate the attack.
Security researchers have discovered a vulnerability in Apple’s latest computer chips—its M1, M2, and M3 series, which powers all of its latest devices—that could let hackers steal cryptographic keys designed to protect data from disclosure. That includes the keys to software crypto wallets installed on vulnerable Apple devices.
The likely target for a malicious exploit would be “high-end users, like someone who has a cryptocurrency wallet with a lot of money,” Matthew Green, a cryptographer and computer science professor at Johns Hopkins University, told author and journalist Kim Zetter. While not a “practical” attack, it could be aimed at web browser encryption—which would affect browser-based applications like MetaMask, iCloud backups, or email accounts.
Newly discovered vuln in Apple M-series chips lets attackers extract secret keys from Macs. "The flaw—a side channel allowing end-to-end key extractions when Apple chips run…widely used cryptographic protocols—can’t be patched" https://t.co/yjQTogcIzk
— Kim Zetter (@KimZetter) March 21, 2024
The potential hack has been dubbed the “GoFetch exploit” in an eponymous report released by a team of scientists from the University of Illinois Urbana-Champaign (UIUC), University of Texas, Austin, Georgia Tech, UC Berkeley, University of Washington, and Carnegie Mellon University. It works by gaining access to the computer’s CPU cache through Data Memory-Dependent Prefetchers (DMPs) built into the chips.
“In a cache side-channel attack, an attacker infers a victim program’s secret by observing the side effects of the victim program’s secret-dependent accesses to the processor cache,” the researchers said, adding that the experiment was validated using the Apple M1’s 4 Firestorm (performance) cores. “We assume that the attacker and the victim do not share memory, but that the attacker can monitor any microarchitectural side channels available to it, e.g., cache latency.”
Today’s disclosure is different from the so-called “Augury” pre-fetchers exploit announced in 2022, although it involves a similar mechanism.
The researchers said they notified Apple of their findings on December 5, 2023, and that more than 100 days had elapsed prior to the public release of the research paper and accompanying website.
