Apple's M1 chips have an unpatchable hardware vulnerability that could allow attackers to bypass its last line of security defense, said the MIT researchers who discovered the vulnerability.
See also: WhatsApp warning: Change this setting immediately
The vulnerability lies in a hardware-level security mechanism used in Apple's M1 chips called pointer authentication codes, or PACs. This feature makes it much harder for an attacker to inject malicious code into a device's memory and provides a layer of defense against buffer overflow exploits, a type of attack that forces memory to spill to other locations on the chip.
Researchers from MIT's Computer Science and Artificial Intelligence Laboratory, however, have created a new hardware attack that combines memory corruption and speculative execution attacks to bypass the security feature. The attack shows that pointer authentication can be invalidated without leaving a trace, and since it uses a hardware mechanism, no software patch can fix it.
The attack, dubbed “Pacman,” works by “guessing” a pointer authentication code (PAC), a cryptographic signature that confirms that an application has not been maliciously altered. It does this by using speculative execution – a technique used by modern computer processors to speed up performance by guessing at various lines of computation – to leak PAC verification results, while a “hardware side-channel” reveals whether the guess was correct or not.
Furthermore, since there are so many possible values for PAC, the researchers found that it is possible to try them all to find the right one.
See also: Is the Vice Society ransomware gang behind the Palermo attack?
In a proof of concept, the researchers demonstrated that the attack even works against the kernel – the software core of operating system – which has “huge implications for future security work on all ARM systems with enabled ,” says Joseph Ravichandran, co-lead author of the research paper.
Apple has so far implemented pointer authentication across all of its custom ARM- based silicon , including the M1, M1 Pro, and M1 Max, and several other chipmakers, including Qualcomm and Samsung , have either announced or are expected to release new processors that support the hardware-level security feature. MIT said it has not yet tested the attack on Apple's (yet-to-be-released) M2 chip, which also supports pointer authentication.
The researchers – who presented their findings to Apple – noted that the Pacman attack is not a “magical bypass” for all security in the M1 chip and can address an existing flaw that is protected by pointer authentication.
See also: Microsoft Defender: Now isolates compromised Windows devices
In May of last year, a developer discovered a flaw in Apple's M1 chip that creates a backdoor channel that two or more already installed malicious apps could use to transmit information to each other. However, the flaw was ultimately deemed "harmless" as malware cannot use it to steal or tamper with data on a Mac.
Information source: techcrunch.com
