iLeakage: Browser-Based Timerless Speculative Execution Attacks on Apple Devices (ileakage.com)

Article summary

Researchers have discovered a new vulnerability, called iLeakage, that affects Apple devices and allows attackers to steal sensitive information, such as passwords and emails, through a speculative execution side channel attack on the Safari web browser. The attack exploits the CPU's microarchitecture and can be used to recover secrets from popular high-value targets. The vulnerability has been mitigated in Safari 17.2, which ships with iOS 17.2 and macOS 14.2. Enabling Lockdown Mode or disabling JavaScript can also mitigate the attack, but may have other effects on device behavior.

Main themes

• iLeakage vulnerability
• speculative execution side channel attacks
• Safari browser security
• browser engine diversity
• iOS security policy
• side channel mitigations
• security through compartmentalization

What commenters say

• Allowing different browser engines on iOS could decrease the attack surface by giving users a choice and reducing the number of vulnerable devices.
• Having multiple browser engines would increase the attack surface, as each engine would have its own set of vulnerabilities.
• The current policy of forcing all browser apps to use Safari's JavaScript engine is a reason for the widespread vulnerability to iLeakage.
• Security through compartmentalization can be achieved by allowing different browser engines, which would limit the damage of a vulnerability to only the users of the affected engine.
• The argument that having multiple browser engines increases the attack surface is not convincing, as it would also give users the option to choose a more secure engine.
• The vulnerability highlights the need for better side channel mitigations, as current measures are not sufficient to prevent such attacks.
• Enabling Lockdown Mode or disabling JavaScript can mitigate the attack, but may have other effects on device behavior and may not be suitable for all users.