Security News

iLeakage: New Safari Exploit Impacts Apple iPhones and Macs with A and M-Series CPUs
2023-10-26 16:49

A group of academics has devised a novel side-channel attack dubbed iLeakage that exploits a weakness in the A- and M-series CPUs running on Apple iOS, iPadOS, and macOS devices, enabling the...

Downfall Vulnerability Affects Millions of Intel CPUs With Strong Data Leak Impact
2023-08-11 16:58

Downfall Vulnerability Affects Millions of Intel CPUs With Strong Data Leak Impact Learn technical details about this newly disclosed security vulnerability, as well as mitigation recommendations from the Google researcher who discovered it. Google researcher Daniel Moghimi discovered a new vulnerability affecting millions of Intel chip models.

Nearly every AMD CPU since 2017 vulnerable to Inception data-leak attacks
2023-08-09 22:52

AMD processor users, you have another data-leaking vulnerability to deal with: like Zenbleed, this latest hole can be to steal sensitive data from a running vulnerable machine. Inception utilizes a previously disclosed vulnerability alongside a novel kind of transient execution attack, which the researchers refer to as training in transient execution, to leak information from an operating system kernel at a rate of 39 bytes per second on vulnerable hardware.

Collide+Power, Downfall, and Inception: New Side-Channel Attacks Affecting Modern CPUs
2023-08-09 15:39

Cybersecurity researchers have disclosed details of a trio of side-channel attacks that could be exploited to leak sensitive data from modern CPUs. "Downfall attacks target a critical weakness found in billions of modern processors used in personal and cloud computers," Daniel Moghimi, senior research scientist at Google, said.

New Downfall attacks on Intel CPUs steal encryption keys, data
2023-08-08 17:00

A senior research scientist at Google has devised new CPU attacks to exploit a vulnerability dubbed Downfall that affects multiple Intel microprocessor families and allows stealing passwords, encryption keys, and private data like emails, messages, or banking info from users that share the same computer. Moghimi developed two Downfall attack techniques, Gather Data Sampling - which is also the name Intel uses to refer to the issue and Gather Value Injection - which combines GDS with the Load Value Injection technique disclosed in 2020.

New Inception attack leaks sensitive data from all AMD Zen CPUs
2023-08-08 15:00

Researchers have discovered a new and powerful transient execution attack called 'Inception' that can leak privileged secrets and data using unprivileged processes on all AMD Zen CPUs, including the latest models. Researchers at ETH Zurich have now combined an older technique named 'Phantom speculation' with a new transient execution attack called 'Training in Transient Execution' to create an even more powerful 'Inception' attack.

New Collide+Power side-channel attack impacts almost all CPUs
2023-08-02 17:37

A new software-based power side-channel attack called 'Collide+Power' was discovered, impacting almost all CPUs and potentially allowing data to leak. The main concept of Collide+Power is to leak data from measured CPU power consumption values when a data "Collision" between the attacker's dataset and data sent by other applications to overwrite the former happens in CPU cache memory.

Bad news: Another data-leaking CPU flaw. Good news: It's utterly impractical
2023-08-01 17:00

Collide+Power vulnerability leaks secrets bit by bit - but could take months or years to learn a useful secret Boffins in Austria and Germany have devised a power-monitoring side-channel attack on...

Zenbleed: How the quest for CPU performance could put your passwords at risk
2023-07-26 19:01

In Ormandy's Zenbleed bug, now officially known as CVE-2023-20593, the problem arises when an AMD Zen 2 processor performs a special instruction that exists to set multiple so-called vector registers to zero at the same time. Vector registers are used to store data used by special high-performance numeric and data processing instructions, and in most modern Intel and AMD processors they are a chunky 256 bits wide, unlike the 64 bits of the CPU's general purpose registers used for traditional programming purposes.

Hot Pixels attack checks CPU temp, power changes to steal data
2023-05-27 14:08

A team of researchers at Georgia Tech, the University of Michigan, and Ruhr University Bochum have developed a novel attack called "Hot Pixels," which can retrieve pixels from the content displayed in the target's browser and infer the navigation history. Next, the team experimented with data-dependent leakage channels on discreet and integrated GPUs, including Apple's M1 and M2, AMD Radeon RX 6600, Nvidia GeForce RTX 3060, and Intel Iris Xe. The researchers performed a detailed investigation and characterization of how different processing behaviors could impact observable factors like power consumption, temperature, and frequency and used this data as a foundation to evaluate the "Hot Pixels" attack.