Shulou(Shulou.com)11/24 Report--

CTOnews.com, October 26 (Xinhua)-- Apple has released several patches to ease the "Spectre" vulnerability, but according to the latest security company report, the vulnerability still can not be completely closed, found a derivative vulnerability called iLeakage, you can use speculative execution to extract passwords and website data.

The "Spectre" chip vulnerability, along with "Meltdown", dates back to 2018. It is a hardware flaw and security vulnerability in the implementation of branch prediction, which affects modern microprocessors with predictive execution functions. The exploit is a time-based bypass attack that allows malicious processes to obtain the data content of other programs in mapped memory.

After Apple transitioned to the self-developed Apple Silicon, the latest evidence suggests that with PACMAN and Meltdown vulnerabilities, "Spectre" chip vulnerabilities can still be targeted at M1 / M2 series chip devices.

The researchers say there is no evidence that hackers have exploited iLeakage vulnerabilities. The attack is basically undetectable and takes up less resources after the intrusion, but it requires in-depth understanding of browser-based side channel attacks and the implementation of Safari.

ILeakage is important because it can induce Safari to render any web page and restore the information displayed in it. Researchers demonstrated the use of this vulnerability to steal Instagram credentials, Gmail inbox data, and YouTube viewing history.

The vulnerability is a transient execution side channel for Safari and its technology stack. It affects iPhone, iPad, and Mac users.

More information about the iLeakage vulnerability is attached to CTOnews.com. Interested users can click here to read it.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.