New iLeakage attack steals emails, passwords from Apple Safari
26-Oct-23
Academic researchers developed iLeakage, a speculative side-channel attack that can collect sensitive information from the Safari web browser and works on all modern Apple iPhones. The first demonstration of a speculative execution attack on Apple Silicon CPUs and the Safari browser is iLeakage. It can get data with “near perfect accuracy” from Safari, Firefox, Tor, and Edge on iOS.
It is essentially a timerless Spectre attack that avoids all browser vendors’ normal side-channel safeguards. iLeakage was created by a group of academics from Georgia Tech, the University of Michigan, and Ruhr University Bochum that investigated Safari’s side-channel resilience and managed to circumvent known countermeasures by inventing a timerless and architecture-independent technique based on race.
