Very. It’s unpatchable. It’s taking advantage of a speculative execution flaw, which is baked into the CPU microcode. This is the Apple M-chip version of Spectre/Meltdown that happened on x86 CPUs a few years ago.
The best Apple can do is attempt to add some code to the OS to help prevent this issue, but if Spectre was any example, it’ll cause a hit to the CPU performance.
The researchers published a list of mitigations they believe will address the vulnerabilities allowing both the FLOP and SLAP attacks. They said that Apple officials have indicated privately to them that they plan to release patches.
So this’ll likely be mitigated soon, and while you’re probably right about the performance hit (which will likely be minor), I don’t think (most) Apple users need to be very worried about this.
This is a real problem, and Apple can’t patch it out of the hardware. The only thing they can do is write software to run in advance of hardware execution to “randomize” when and where memory is written to and read from. That will slightly decrease the performance of these chips. The “older” chips from 2021 would see the worst performance reduction. M3 users probably won’t even be able to tell.
The attack vector is a web browser. Even a completely updated safari is vulnerable, but Chrome is seemingly easier to exploit (the way browsers store website data in memory is the key). An encrypted browser won’t change anything because the attack is reading the unencrypted data being displayed to the user.
It takes several minutes for a compromised website to perform the attack. So basic sense practices apply. If you think a website is unsafe, don’t open it. If you think something is happening, closing the suspicious sites immediately might stop the attack before any damage is done. I don’t know how easy it would be to compromise a trusted site, but it’s been done in the past.
Apple could potentially patch Safari to do things that make it harder for the attack to work correctly, and you can bet they’re already retooling the next generation of processors to get rid of this exploit. They did the same thing when an unpatchable exploit was found in the M1 series, M2s have a stopgap measure, and M3s were redrawn to make it an nonissue.
You can’t compete without doing it. Do you think Intel and AMD stopped doing it? Hell nah, people will find new exploits in a few years, I’m certain.
If you don’t do speculative execution, you’ll be left in the dust unfortunately.
If anything, this shows that there should be separate lines of CPUs for handling classified data and such, that don’t do it. But it would likely be prohibitively expensive to implement a separate product line.
I need a bigger nerd than me to explain how much Apple users need to worry about this.
Very. It’s unpatchable. It’s taking advantage of a speculative execution flaw, which is baked into the CPU microcode. This is the Apple M-chip version of Spectre/Meltdown that happened on x86 CPUs a few years ago.
The best Apple can do is attempt to add some code to the OS to help prevent this issue, but if Spectre was any example, it’ll cause a hit to the CPU performance.
So this’ll likely be mitigated soon, and while you’re probably right about the performance hit (which will likely be minor), I don’t think (most) Apple users need to be very worried about this.
Oh, yet another speculative execution flaw…
The main issue with these vulnerabilities is a loss in performance when the microcode patch gets applied.
On a more philosophical note, it’s also a trend to release insecure products to tout performance metrics. Intel did it. Now it’s apple’s turn.
Don’t trust corporations, ever.
This is a real problem, and Apple can’t patch it out of the hardware. The only thing they can do is write software to run in advance of hardware execution to “randomize” when and where memory is written to and read from. That will slightly decrease the performance of these chips. The “older” chips from 2021 would see the worst performance reduction. M3 users probably won’t even be able to tell.
The attack vector is a web browser. Even a completely updated safari is vulnerable, but Chrome is seemingly easier to exploit (the way browsers store website data in memory is the key). An encrypted browser won’t change anything because the attack is reading the unencrypted data being displayed to the user.
It takes several minutes for a compromised website to perform the attack. So basic sense practices apply. If you think a website is unsafe, don’t open it. If you think something is happening, closing the suspicious sites immediately might stop the attack before any damage is done. I don’t know how easy it would be to compromise a trusted site, but it’s been done in the past.
Apple could potentially patch Safari to do things that make it harder for the attack to work correctly, and you can bet they’re already retooling the next generation of processors to get rid of this exploit. They did the same thing when an unpatchable exploit was found in the M1 series, M2s have a stopgap measure, and M3s were redrawn to make it an nonissue.
Ahh yes, back to the dark ages of the internet where just clicking the wrong link can completely compromise your system.
Thanks crapple and its useful idiots.
I mean, Intel did it first and I do believe AMD and Qualcomm also followed suit.
Yes, and Apple decided to do the same thing knowing the risks.
“Intel did it!” is not a panacea for apple; it makes things worse for them.
You can’t compete without doing it. Do you think Intel and AMD stopped doing it? Hell nah, people will find new exploits in a few years, I’m certain.
If you don’t do speculative execution, you’ll be left in the dust unfortunately.
If anything, this shows that there should be separate lines of CPUs for handling classified data and such, that don’t do it. But it would likely be prohibitively expensive to implement a separate product line.
You do realize this kind of attack first appeared on x86 hardware, right?
https://thehackernews.com/2024/10/new-research-reveals-spectre.html?m=1
Yes, I realize that.
You do realize that this kind of attack happened after spectre and meltdown? Apple knew of the risks, but decided to ignore them.
Well yes, but newer CPU models such as 13th and 14th gen Intel CPUs are also susceptible to these attacks, my points is that Apple is no exception to this vulnerability and should not be singled out for it