New speculative attacks on Apple CPUs

Aside: I feel like RUB has become kind of a global center for this kind of high-end offensive security work. Was I just not paying enough attention 10 years ago or is this a new-ish thing?

Re: New speculative attacks on Apple CPUs

#5

Post by remus » Tue, Jan 28, 2025, 6:48 PM UTC

Interesting that the researchers have gone public before a mitigation is in place from Apple. Seems in pretty stark contrast to the industry-wide coordination that went into patching and mitigating spectre.

Re: New speculative attacks on Apple CPUs

#6

Post by dartos » Tue, Jan 28, 2025, 6:49 PM UTC

remus wrote: post #5

Interesting that the researchers have gone public before a mitigation is in place from Apple. Seems in pretty stark contrast to the industry-wide coordination that went into patching and mitigating spectre.

Does Apple pay bug bounties?

Re: New speculative attacks on Apple CPUs

#7

Post by gjsman-1000 » Tue, Jan 28, 2025, 6:49 PM UTC

Bizarre the M1 is immune to both; I'm more secure by not upgrading. (Sure, there's still a few, but they are mostly minor by comparison, or newer chips are also affected.)

Re: New speculative attacks on Apple CPUs

#8

Post by phoe-krk » Tue, Jan 28, 2025, 6:50 PM UTC

remus wrote: post #5

Interesting that the researchers have gone public before a mitigation is in place from Apple. Seems in pretty stark contrast to the industry-wide coordination that went into patching and mitigating spectre.

> We disclosed our results to Apple on May 24, 2024. Apple’s Product Security Team have acknowledged our report and proof-of-concept code, requesting an extended embargo beyond the 90-day window. At the time of writing, Apple did not share any schedule regarding mitigation plans concerning the results presented in this paper.

The vulnerability is over half a year old and over a quarter over the embargo window.

Re: New speculative attacks on Apple CPUs

#9

Post by InTheArena » Tue, Jan 28, 2025, 6:50 PM UTC

dartos wrote: post #6

remus wrote: post #5

Interesting that the researchers have gone public before a mitigation is in place from Apple. Seems in pretty stark contrast to the industry-wide coordination that went into patching and mitigating spectre.

Does Apple pay bug bounties?

Yes, they do.

Re: New speculative attacks on Apple CPUs

#10

Post by jf » Tue, Jan 28, 2025, 6:50 PM UTC

tptacek wrote: post #4

Aside: I feel like RUB has become kind of a global center for this kind of high-end offensive security work. Was I just not paying enough attention 10 years ago or is this a new-ish thing?

What is RUB?