A team of academic researchers has published a paper and website warning users about a security threat that exploits weaknesses in recent Apple Inc. devices that can be used to extract sensitive information from Apple’s Safar web browser.

Dubbed “iLeakage,” the vulnerability exploits a “speculative execution” vulnerability in Safari installed on recent model Macs, iPads and iPhones with Apple A and M series CPUs. Speculative execution is a technique that modern processors use to improve performance by executing instructions before it is known whether they are actually necessary. Doing so can lead to security vulnerabilities if the speculative execution is not properly controlled.

To induce the vulnerability, an attacker does need to trick a potential victim into visiting a malicious website. The attack path could include phishing links sent through email asking potential victims to reset passwords or something similar.

Once attackers have induced a victim to visit the malicious site, they can then use JavaScript or WebAssembly to read the content of other web pages that the user has opened in Safari. The content can include personal information, passwords or credit card information.

The researchers, from the University of Michigan, Georgia Institute of Technology and Ruhr University Bochum, warn that iLeakage is a serious security vulnerability that can be exploited by attackers to steal sensitive information from Safari users.

Apple has implemented a mitigation for iLeakage in Safari. However, it’s not enabled by default and enabling it is possible only on macOS. Added to the mix is that the mitigation is currently marked as unstable.

“This attack illustrates how, for both attackers and defenders, the browser is the new OS, with web primitives such as origins and web workers that parallel OS primitives, such as applications and threads,” Lionel Litty, chief security architect at browser security company Menlo Security Inc., told SiliconANGLE. “Security practitioners must educate themselves on this attack surface.”

John Gallagher, vice president of Viakoo Labs at enterprise internet of things security platform company Viakoo Inc., noted that “the significance is not necessarily in this as an attack method, but more in how threats are evolving based on the tradeoff between speed and security.”

“Prefetching of information to speed up CPU execution has been around for a while and equally has been exploited for a while,” Gallagher explained. “This is just a further ‘tit for tat’ and will be remediated in future CPU development.”

Image: DALL-E 3