NEWS  Security  March 22, 2024  Reading time: 2 Minute(s)

Max (RS editor)

A team of researchers has unearthed a significant security loophole in Apple's highly praised M-series silicon, ominously named "GoFetch". This vulnerability poses a serious threat to the security landscape, particularly concerning the M1 and M2-based chips, by exploiting a crucial side-channel in the chips' execution of end-to-end key extraction processes.

The researchers have ingeniously crafted an application, also christened GoFetch, capable of extracting keys for various cryptography methods, including 2048-bit RSA keys, DH-2048, Kyber-512, and Dilithium-2. Astonishingly, this extraction can be accomplished within timeframes ranging from under an hour to approximately 10 hours, raising alarms about the integrity of sensitive data protected by these cryptographic keys.

Despite Apple's proactive measures with tools like CryptoKit to facilitate developers in implementing robust security controls, the crux of the issue lies within the microarchitecture of the chips themselves. Consequently, malevolent actors can exploit this vulnerability to clandestinely retrieve secret keys, thereby compromising data encryption and authentication mechanisms.

Addressing this pervasive flaw mandates a strategic software patch from Apple, given its inherent nature at the chip level. However, such a solution comes with its own set of challenges, notably a substantial performance degradation. As observed in past instances like Meltdown and Spectre, patching silicon-level vulnerabilities often leads to notable performance setbacks. For instance, following the mitigation of Spectre-V2, Intel's Core i9-12900K chip witnessed performance declines ranging from 14.5% to 26.7%.

The resemblance of this chip-level vulnerability to notorious security breaches such as Meltdown and Spectre, which plagued various chip architectures including Intel, AMD, IBM, and Arm-based designs, underscores the gravity of the situation. While Apple is yet to officially respond to these revelations, the researchers have dutifully notified the company, anticipating a swift remedial action in the form of a software patch.

 IMAGES CREDITS: FREEPIK