Tech
Exclusive: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#MIT #researchers #uncover #unpatchable #flaw #Apple #chips
Apple’s M1 chips have an “unpatchable” hardware vulnerability that could allow attackers to break through its last line of security defenses, MIT researchers have discovered.
The vulnerability lies in a hardware-level security mechanism utilized in Apple M1 chips called pointer authentication codes, or PAC. This feature makes it much harder for an attacker to inject malicious code into a device’s memory and provides a level of defense against buffer overflow exploits, a type of attack that forces memory to spill out to other locations on the chip.
Researchers from MIT’s Computer Science and Artificial Intelligence Laboratory, however, have created a novel hardware attack, which combines memory corruption and speculative execution attacks to sidestep the security feature. The attack shows that pointer authentication can be defeated without leaving a trace, and as it utilizes a hardware mechanism, no software patch can fix it.
The attack, appropriately called “Pacman,” works by “guessing” a pointer authentication code (PAC), a cryptographic signature that confirms that an app hasn’t been maliciously altered. This is done using speculative execution — a technique used by modern computer processors to speed up performance by speculatively guessing various lines of computation — to leak PAC verification results, while a hardware side-channel reveals whether or not the guess was correct.
What’s more, since there are only so many possible values for the PAC, the researchers found that it’s possible to try them all to find the right one.
In a proof of concept, the researchers demonstrated that the attack even works against the kernel — the software core of a device’s operating system — which has “massive implications for future security work on all ARM systems with pointer authentication enabled,” says Joseph Ravichandran, a Ph.D. student at MIT CSAIL and co-lead author of the research paper.
“The idea behind pointer authentication is that if all else has failed, you still can rely on it to prevent attackers from gaining control of your system,” Ravichandran added. “We’ve shown that pointer authentication as a last line of defense isn’t as absolute as we once thought it was.”
Apple has implemented pointer authentication on all of its custom ARM-based silicon so far including the M1, M1 Pro, and M1 Max, and a number of other chip manufacturers including Qualcomm and Samsung have either announced or are expected to ship new processors supporting the hardware-level security feature. MIT said it has not yet tested the attack on Apple’s unreleased M2 chip, which also supports pointer authentication.
“If not mitigated, our attack will affect the majority of mobile devices, and likely even desktop devices in the coming years,” MIT said in the research paper.
The researchers — which presented their findings to Apple — noted that the Pacman attack isn’t a “magic bypass” for all security on the M1 chip, and can only take an existing bug that pointer authentication protects against. When reached, Apple did not comment on the record.
In May last year, a developer discovered an unfixable flaw in Apple’s M1 chip that creates a covert channel that two or more already-installed malicious apps could use to transmit information to each other. But the bug was ultimately deemed “harmless” as malware can’t use it to steal or interfere with data that’s on a Mac.
Tech
Exclusive: Xiaomi 12S Ultra uses a 1-inch Sony camera sensor. Here’s why it is a massive moment for smartphone photography – TalkOfNews.com
Tech
Exclusive: Crypto hedge fund Three Arrows files for bankruptcy – TalkOfNews.com
Tech
Exclusive: 'Doctor Strange 2': Post-Credits Scenes' Cameo and Classic Sam Raimi Nod Explained – CNET – TalkOfNews.com
-
Cinema & Celebrities3 weeks ago
Exclusive: “Elsa Pataky is awesomeness personified”: ‘Interceptor’ Director and Pataky Herself Takes Us Behind the Scenes of the #1 Netflix Movie
-
Entertainment1 week ago
Exclusive: "The Black Phone" Review: A New Horror Film Starring Ethan Hawke As A Serial Child Killer – TalkOfNews.com
-
Politics3 weeks ago
Exclusive: Oops! Patriot Front Member Was Arrested in Idaho Carrying Megaphone Marked “FBI”
-
Fashion2 weeks ago
Exclusive: The Best Fashion Moments From Sitcom "Martin"'s 30-Year Reunion Special
-
Cinema & Celebrities3 weeks ago
Exclusive: Joseph Quinn Calls Stranger Things’ Eddie Munson “a real lottery ticket”, Reveals Why He “stopped eating pizza and drinking beer”
-
Cinema & Celebrities3 weeks ago
Exclusive: Netflix Going ‘Harry Potter’ With ‘The School for Good and Evil’? First Teaser Transports Sophie and Agatha to School
-
Cinema & Celebrities2 weeks ago
Exclusive: ‘The Umbrella Academy’ Season 3 Release Date and Time in Your Country and Region
-
Politics3 weeks ago
Exclusive: Another Blow to the US Food Market: Fire Breaks Out at a Food Processing Plant West of Waupaca County in Wisconsin