Introduction
Do you use Apple services?
If you’re like more than 1B people around the world, then you probably do! Whether it’s your iPhone or a Safari browser, Apple products are extremely common no matter where you live!
Unfortunately, nothing is attack-proof in the digital age.
What Happened to Apple?
On October 26, 2023, a group of academic researchers published a study titled “iLeakage: Exploiting Speculative Execution in Apple CPUs via Safari” that describes a new side-channel attack that can be used to extract sensitive information from the Safari web browser on Apple devices with A- and M-series CPUs.
In layman’s terms? Safari will render a malicious web page that contains code made by threat actors. Instead of following the instructions that you, the user, inputted, the web browser will instead begin processes established by the threat actor.
Essentially, this works by exploiting a weakness in the way that Apple’s CPUs implement speculative execution. Speculative execution is a technique that allows CPUs to execute instructions ahead of time, in anticipation of what they think the next instruction will be.
This can improve performance, but it can also open up security vulnerabilities. In this case, the so-called iLeakage vulnerability exploits the speculative execution to leak sensitive information from the Safari process, such as Gmail inbox content, passwords and credit card data.
What Does iLeakage Mean for Users?
In the meantime, you aren’t helpless!
- Update to the latest version of iOS, iPadOS, or macOS.
- Avoid visiting untrustworthy websites, especially those that don’t begin with HTTPS://
- Keep your web browser up to date
- Disable JavaScript and cookies when you don’t need them
- Use an open-source password manager, capable of generating strong passwords and maximizing security
- Continuously monitor your systems and accounts for unusual or suspicious activity
If you are concerned that you may have been affected by the iLeakage attack, you should change your passwords and enable two-factor authentication on all of your online accounts. This is the best way to ensure your Apple accounts, and all your other devices, are safe and secure.
Conclusion
Although this blog has focused on the iLeakage vulnerability recently discovered by security experts, it reflects the bigger picture: As popular as software may be, or as robust and well-funded the organization that produced it, there is no such thing as 100% cybercriminal-proof technology. That’s why there are such things as zero-day vulnerabilities and incident response plans!
None of this is to worry you, nor make you feel completely defenseless against any and all cyber-threats. Rather, educating yourself on important, relevant news about cybersecurity and threat actors is crucial to protecting yourself more effectively. How can you recognize, report and avoid what you don’t understand?
You can protect yourself from vulnerabilities like iLeakage by proactively researching new software and applications before using them. End-to-end encryption is extremely important for confidential communications, for example. Websites and browsers with a history of breaches and questionable security standards may also not be a great place to input personal or financial information—but how would you know which ones are unsafe, unless you delved more into it?
Remember: You can never know too much about what you’re facing on the World Wide Web, but it can be DISASTROUS to know too little. Fortunately, reading this blog has been a great step in that direction.
References
