Hackers can force iOS and macOS browsers to divulge passwords and much more

3 years ago by L4sBot to c/technology

Hackers can force iOS and macOS browsers to divulge passwords and much more::iLeakage is practical and requires minimal resources. A patch isn't (yet) available.

fuggadihere 55 points 3 years ago

While iLeakage works against Macs only when running Safari, iPhones and iPads can be attacked when running any browser because they’re all based on Apple’s WebKit browser engine.

This is one of the things with iOS , iPadOS that I really don’t like.

save

path: 0 4823867, hotness: undefined, score: 55, children: 2

OrgunDonor 7 points 3 years ago

It is the single biggest reason why I havent thought about getting an iphone. I have an ipad and it is alright, but I have gone back to using the significantly worse specced Fire tablet, so I don't have to use Safari.

save

path: 0 4823867 4827704, hotness: undefined, score: 7, children: 1

kboy101222 3 points 3 years ago

If they'd just allow other browsers, I'd love to get an iPad for creative work and to watch movies and shows in bed. My laptop does the job right now, but it gets too hot on my lap

save

path: 0 4823867 4827704 4835937, hotness: undefined, score: 3, children: 0

Tetsuo 16 points 3 years ago

I would never store any passwords in any browser to be honest. It cannot be safe anyway.

save

path: 0 4825383, hotness: undefined, score: 16, children: 1

lemmyvore 11 points 3 years ago

It's a hardware exploit. It can recover stuff in other tabs, a password was just one example they happened to catch. It's not targeted.

save

path: 0 4825383 4833066, hotness: undefined, score: 11, children: 0

ilega_dh 13 points 3 years ago

It’s feels like the article is intentionally vague about it but this does not seem to affect iCloud password keychain, as that requires user intervention (using your fingerprint) to fill your password, right?

save

path: 0 4823603, hotness: undefined, score: 13, children: 6

Vub 9 points 3 years ago

Seems to affect Keychain yes. And there are even examples in the article with an external password manager (Lastpass) so it doesn’t seem to matter how. But to be fair the vulnerability is quite complicated to abuse and I guess we can expect a fix very soon.

save

path: 0 4823603 4825785, hotness: undefined, score: 9, children: 1

ilega_dh 1 point 3 years ago

The vulnerability seems to be that it can read content filled into a page, and since lastpass will autofill your password (usually, if enabled) it’s easy to read.

iCloud Keychain requires user intervention by default (using your fingerprint) so it can’t be autofilled in the background.

Still, many people would be vulnerable because 3rd party password managers are so popular.

save

path: 0 4823603 4825785 4856640, hotness: undefined, score: 1, children: 0

Zeth0s 6 points 3 years ago

It looks to me pretty clear that they are talking about all the passwords stored in the browser.

save

path: 0 4823603 4824454, hotness: undefined, score: 6, children: 3

b3an 3 points 3 years ago

Why people trust browsers for this? Also why browsers don’t beef of that security? I rely on third party, BitWarden, to store my stuff securely.

save

path: 0 4823603 4824454 4825466, hotness: undefined, score: 3, children: 1

Zeth0s 1 point 3 years ago

I haven't read in details, but I believe this is an hardware issue, more than a strictly browser issue. They'll probably mitigate it on the browser side though

save

path: 0 4823603 4824454 4825466 4825538, hotness: undefined, score: 1, children: 0

ilega_dh 1 point 3 years ago

I was talking about the iCloud Keychain, they are specifically not stored in the browser so malware can’t access it.

save

path: 0 4823603 4824454 4856588, hotness: undefined, score: 1, children: 0

autotldr 6 points 3 years ago

This is the best summary I could come up with:

Researchers have devised an attack that forces Apple’s Safari browser to divulge passwords, Gmail message content, and other secrets by exploiting a side channel vulnerability in the A- and M-series CPUs running modern iOS and macOS devices.

The researchers have successfully leveraged iLeakage to recover YouTube viewing history, the content of a Gmail inbox—when a target is logged in—and a password as it’s being autofilled by a credential manager.

Once visited, the iLeakage site requires about five minutes to profile the target machine and, on average, roughly another 30 seconds to extract a 512-bit secret, such as a 64-character string.

“In particular, we demonstrate how Safari allows a malicious webpage to recover secrets from popular high-value targets, such as Gmail inbox content.

Finally, we demonstrate the recovery of passwords, in case these are autofilled by credential managers.”

The design of A-series and M-series silicon—the first generation of Apple-designed CPUs for iOS and macOS devices respectively—is the other.

The original article contains 327 words, the summary contains 157 words. Saved 52%. I'm a bot and I'm open source!

save

path: 0 4823192, hotness: undefined, score: 6, children: 0

fuggadihere 6 points 3 years ago

iGot

save

path: 0 4823839, hotness: undefined, score: 6, children: 1

Companion1666 3 points 3 years ago

iHaveUrPass

save

path: 0 4823839 4825597, hotness: undefined, score: 3, children: 0

arrr 4 points 3 years ago

Why is the content in this screenshot slightly off: https://cdn.arstechnica.net/... ? In the demo videos the retrieved content is always 100% accurate.

save

path: 0 4823399, hotness: undefined, score: 4, children: 0

This is a most excellent place for technology news and articles.

Our Rules

Approved Bots

This is a most excellent place for technology news and articles.

Our Rules

Approved Bots