Apple’s legal woes mount as vulnerability threatening crypto security comes to light News ▸ US ▸ Technology
Apple’s legal woes mount as vulnerability threatening crypto security comes to light
The research revealed that the vulnerability in the Apple M-series chips was "unpatchable."
2 min read
Updated: Mar. 22, 2024 at 7:41 pm UTC
Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
Academic researchers have unearthed a significant vulnerability within Apple’s M-series computing chips, potentially jeopardizing the security of private crypto keys.
On the same day, the US Department of Justice (DOJ) filed an antitrust case against the iPhone maker, alleging monopoly practices detrimental to consumers, developers, and competitors.
The vulnerability
The research team identified the chips’ data memory-dependent prefetcher (DMP) vulnerability.
Crypto analyst George explained that DMP is a hardware optimization that anticipates and preloads data into the CPU cache ahead of demand. However, it faces an issue where it occasionally confuses sensitive data, such as encryption keys, for memory addresses.
This phenomenon, known as “dereferencing pointers,” creates a vulnerability known as “side-channel attacks.”
The researchers demonstrated the capability to extract various encryption keys — including RSA, Diffie-Hellman, Kyber, and Dilithium — within 1 to 10 hours using a GoFetch attack. However, this exploit needs malicious and targeted crypto apps to operate on the same CPU cluster.
For the attack to succeed, the malicious app must provide inputs to the crypto app and prompt it to execute operations, thereby gradually leaking the key. This exploit is interactive rather than passive and must bypass macOS security measures to perform on the system.
Unfortunately, rectifying this flaw is not straightforward as it originates from the microarchitectural design of the chips, rendering it unpatchable. However, implementing defensive measures within third-party encryption software can mitigate the risk.
Legal trouble
US authorities, supported by 16 state attorney generals, filed legal actions against Apple for its “walled garden” business model, which helped establish an allegedly illegal monopoly in the smartphone market.
The lawsuit alleged that Apple implemented “shapeshifting rules and restrictions in its App Store guidelines and developer agreements that would allow Apple to extract higher fees, thwart innovation, offer a less secure or degraded user experience, and throttle competitive alternatives.”
They added that these suppressive rules were implemented across varying products, including text messaging, smartwatches, and digital wallets, among many others.
Crypto community members have highlighted the importance of this lawsuit to the industry, with Hish Bouabdallah, the founder of Tribes Protocol, saying:
“If Apple loses this battle, it could pave the way for crypto payments in the U.S., enabling seamless transactions using services like Coinbase Wallet with just a double tap and FaceID.”
Mentioned in this article
Posted In: US, Technology
Author 
Oluwapelumi Adejumo
Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.
Latest US Stories
Featured Story
Advertise Here
In this article
Apple
Apple is a multinational American technology company with its main office in Cupertino, California.
OpenSea
OpenSea is a decentralized peer-to-peer marketplace for buying, selling, and trading NFTs.
Coinbase Wallet is a software product that gives you access to a wide spectrum of decentralized innovation – buy and store ERC-20 tokens, participate in airdrops and ICOs, collect rare digital art and other collectibles, browse decentralized apps (DApps), shop at stores that accept cryptocurrency, and send crypto to anyone around the world..
