Severe Vulnerability Found in Apple’s M-Series Chips

Academics have uncovered a significant vulnerability in Apple's M-series chips that could potentially allow malicious actors to access confidential encryption keys from Mac devices. The vulnerability, identified as a side-channel exploit, enables hackers to illicitly obtain end-to-end encryption keys when Apple chips execute commonly used cryptographic protocols.

Published on March 21 by researchers from several United States-based universities, the report indicates that this issue is deeply rooted in the microarchitectural design of the silicon itself, making it "unpatchable." Addressing the flaw would require the use of third-party cryptographic software, which could severely impact the performance of Apple M-series chips, particularly earlier iterations like the M1 and M2.

This vulnerability poses a significant challenge for Apple's hardware security infrastructure. If exploited, hackers could intercept and exploit memory access patterns to extract sensitive information, such as encryption keys utilized by cryptographic applications.

The researchers have labeled this type of exploit as "GoFetch." It operates seamlessly within the user environment and requires only standard user privileges, similar to those needed by regular applications.

Following the research, users in online Mac forums have begun to question whether there is cause for major concern or necessary action regarding password keychains. One user expressed belief that Apple will directly mitigate the problem within their OS; if not, they will be "more worried."

Another user mentioned that this flaw has been known to Apple for a while, noting that it could be why Apple's M3 has "an added instruction to disable DMP." The user referred to previous research on the topic called an "augury," dating back to 2022.

This discovery comes as Apple faces an extensive antitrust lawsuit with the U.S. Department of Justice (DOJ), which alleges that its app store rules and "monopoly" illegally throttled competition and stifled innovation. The DOJ also claims that Apple blocked access to competing digital wallets offering "a wide variety of enhanced features," while preventing developers from providing their payment services to users.