160
submitted 1 year ago by L4s@lemmy.world to c/technology@lemmy.world

Hackers can force iOS and macOS browsers to divulge passwords and much more::iLeakage is practical and requires minimal resources. A patch isn't (yet) available.

you are viewing a single comment's thread
view the rest of the comments
[-] autotldr@lemmings.world 6 points 1 year ago

This is the best summary I could come up with:


Researchers have devised an attack that forces Apple’s Safari browser to divulge passwords, Gmail message content, and other secrets by exploiting a side channel vulnerability in the A- and M-series CPUs running modern iOS and macOS devices.

The researchers have successfully leveraged iLeakage to recover YouTube viewing history, the content of a Gmail inbox—when a target is logged in—and a password as it’s being autofilled by a credential manager.

Once visited, the iLeakage site requires about five minutes to profile the target machine and, on average, roughly another 30 seconds to extract a 512-bit secret, such as a 64-character string.

“In particular, we demonstrate how Safari allows a malicious webpage to recover secrets from popular high-value targets, such as Gmail inbox content.

Finally, we demonstrate the recovery of passwords, in case these are autofilled by credential managers.”

The design of A-series and M-series silicon—the first generation of Apple-designed CPUs for iOS and macOS devices respectively—is the other.


The original article contains 327 words, the summary contains 157 words. Saved 52%. I'm a bot and I'm open source!

this post was submitted on 26 Oct 2023
160 points (94.9% liked)

Technology

59623 readers
1423 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS