I MIT researchers they found a vulnerability in Apple’s M1 chipwhich define “unpatchable“. According to MIT, this is a problem al PAC system for authentication, a measure to protect the chip. But there seems to be a way to attack it.
MIT finds vulnerability in Apple M1 chips
The PAC system should make it much more difficult to insert malware code into a device’s memory, protecting it from hackers. But the researchers of the Computer Science and Artificial Intelligence Laboratory del MIT they have created a hardware attack that combines memory corruption with speculative execution attacks, which can bypass the security measure.
MIT research reveals how it’s possible to get around the PAC defense system without a trace. It also uses a hardware system to do this, so no patches can fix it.
The attack is called “PACman”And it works by ‘guessing’ i Pointer Authentication Code (PAC), a cryptographic signature that proves the app is not malicious. It works by using speculative execution, a technique used to increase the performance of a computer by trying to predict lines of code. Meanwhile, one alternative hardware channel reveals whether the speculation turns out to be correct.
Since the number of combinations for the PAC is limited, all possible combinations can be attempted. And MIT researchers have shown that it can even work at the kernel levelthe software behind the operating system, with very dangerous implications.
Apple has implemented i PAC in all its ARM chips, but MIT explained that it had not had the opportunity to test the M2 chips just announced by Apple.
Apple responded by thanking the researchers for finding this flaw. But he explained that at the moment the security team Apple does not believe it poses an immediate risk to customers and that it is not enough to overcome the protection system alone.