A group of academic researchers has exposed a subtle yet potent vulnerability in Apple's Safari browser through a side-channel attack dubbed "iLeakage."
This exploit targets Apple's silicon CPUs, paving the way for seasoned attackers to steal sensitive user data, such as email contents, YouTube history, Instagram passwords, and much more.
This revelation shines a light on the often-underestimated side-channel attacks, which diverge from mainstream attack vectors but can inflict just as much devastation.
The iLeakage attack capitalizes on the speculative execution feature inherent in Apple's A- and M-series CPUs to facilitate unauthorized data access.
A specially crafted malicious webpage plays a critical role in this attack, enabling a data security breach once a victim interacts with it.
Upon discovering the exploit, the research team promptly informed Apple on Sept. 12, 2022, leading to the release of a mitigation measure.
However, the fix is not yet stable and is limited to Mac systems, leaving mobile devices still exposed. More so, the company's mitigation is not enabled by default, reflecting the ongoing challenge of adequately addressing the vulnerability.
The iLeakage exploit mirrors the notorious Spectre and Meltdown attacks. The stealthy nature of iLeakage, which leaves no traces in system logs, exemplifies the sophisticated threat landscape where such attacks can go undetected, causing significant harm before remedial action can be taken.
This action can impair Safari's ability to render certain web pages and features accurately, potentially hindering online payments and some other functionalities.
For those seeking more advanced mitigation steps and technical insights into the iLeakage attack, the official website of the attack provides a wealth of information.