Side Channel Attacks: Lessons Learned Or Troubles Ahead?
summary
A new exploit called ey leakage reads secrets from Safari’s renderer on Apple M‑series chips by turning speculative type confusion into 64‑bit reads and hiding them in nested mispredicted branches. It bypasses timer restrictions with concurrency races, pulls credentials autofilled by the password manager from a federated‑login popup, and extracts data at about 10–20 bits per second. Verified on Safari 17 / iOS 17 / macOS Sonoma with all mitigations enabled, it uses speculative hiding and one‑process‑per‑tab quirks to exfiltrate passwords and OTPs.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:04History of side channels
- 3:57Hardware evolution and challenges
- 8:12Spectre attack explained
- 13:30Browser security model
- 17:30Side channel countermeasures
- 20:40Breaking timer assumptions
- 23:58Speculative type confusion
- 28:13EY leakage attack details
- 32:11Summary and future threats
- 32:54Q&A session
related talks
25mExtension Breakdown...
33mWebKit Everywhere: Secure or Not?
29mStealing All macOS Sensitive Info with a Single Vulnerability
27mNew Attack Surface in Safari: Using Just One Web Audio Vulnerability to Rule Safari
25mThe Memory of a Meltdown
52mBehind the Scenes of iOS Security
51mExploiting Hardware Glitches And Side Channels In Perfect Software
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”