New Attack Offers Hackers Access to Apple User’s Crypto Keys

“GoFetch” is a side-channel attack that targets state-of-the-art Apple CPUs, which puts at risk cryptographic keys in Apple’s M1, M2, and M3 chipsets.

This technique does the math using data memory-dependent prefetchers (DMPs) found in modern Apple CPUs. By attacking constant-time cryptographic implementations, it creates algorithms like OpenSSL Diffie-Hellman, Go RSA, CRYSTALS Kyber, and Dilithium.

Apple is Unable to Fix the Vulnerability

A team of researchers reported to Apple on December 6, 2023, that they had created GoFetch. However, the firm is unable to fix the vulnerability that makes this attack possible. This is because it is a hardware-based vulnerability and there is no way to effect changes across thousands of devices with customers already.

Additionally, a software fix may affect the performance of CPUs’ cryptographic functions.

GoFetch attacks target data memory-dependent prefetchers of CPUs. Due to the prefetcher trait of learning through previous accesses to memory when retrieving data, it’s able to predict what data the computer needs.

The new attack goes after cryptographic implementations that execute at the same time regardless of input, which is a security measure to prevent sensitive data leaks.

The researcher said: “We reverse-engineered DMPs on Apple m-series CPUs and found that the DMP activates (and attempts to dereference) data loaded from memory that “looks like” a pointer.”

By doing this, they were able to create special inputs that caused the prefetcher to malfunction, dereferencing data. This will provide hints at the secret key if the attackers correctly guess a bit of it. Nonetheless, the process is repeated over and over to get the complete secret cryptographic key.

M1 loops are exquisitely susceptible, whereas there is a chance that M2 and M3 are as well, because of the same structural vise behind it.

Mitigation Strategies

The protection mechanisms include blocking prefetchers of vulnerable CPUs and application of input blundering and dynamic masking techniques at the DSP level. Then, these actions can perhaps make macOS a little sluggish.

Users must update their systems frequently, apply official application packages, and employ vigilance in order to protect against virus infestations.

The attack provides remote triggering ability to the intruder who may be running malicious code on the target machine.