Apple prides itself on the security of its devices, but that doesn’t mean they’re immune to malicious attacks. That point has just been proven by researchers who say they’ve discovered a major new vulnerability in any Mac that runs on an Apple silicon chip, according to a report from Ars Technica. Worst of all, it looks like the problem is completely unpatchable.
So, what’s the flaw? According to the researchers, it all comes down to components called data memory-dependent prefetchers (DMPs). Essentially, these predict what data is going to be needed next and preemptively retrieve it. The idea is that this saves on computing resources, but they leave a potential window open to attack.
If that opportunity is exploited, and attacker could steal a Mac’s encryption keys, even when they’re protected by cryptographic apps designed to keep them safe. That could potentially give a malicious actor wide-ranging access to what’s stored on your Mac.
But unlike most modern vulnerabilities, the researchers say this one cannot be patched because it is inherent to the “microarchitectural” design of Apple silicon chips. There are steps that can be taken to mitigate it, but they might have a serious impact on the performance of the affected chips.
This is an issue affecting Apple silicon chips and, unfortunately, it seems that that means every Apple silicon chip generation. So, it’s not something you can avoid if you have the latest M3 MacBook Pro, for example.
The researchers dubbed the exploit GoFetch, and it’s not known if it has been used in the wild yet. Using the attack, the team was apparently able to extract a 2048-bit RSA key in under an hour, which is pretty fast.
According to the researchers, they first brought the flaw to Apple’s attention on December 5, 2023, and waited 107 days before making it public.
The only bright side is that this attack is unlikely to be used on regular Apple users. But that’s not much comfort when we know there’s very little Apple can do to banish the issue once and for all. We’ll have to see what — if anything — Apple is able to do to fix it and keep your Mac safe.
Related Posts
Your Claude chats just got more powerful with interactive app support
Instead of offering text-only responses, Claude can now act as a full-on workspace, letting you draft Slack messages, build project boards, design mockups, and more. Built on top of the Model Context Protocol (MCP), which Anthropic introduced in 2024 as a standard for how AI and apps talk to each other, the feature is designed to scale over time, with support for additional tools and platforms expected soon.
Microsoft has released an emergency Windows 11 update to fix crashing apps
Some of the problems were serious enough that Microsoft even advised certain users to uninstall the update altogether. Now, Microsoft has stepped in again with a second out-of-band update, aiming to finally steady the ship.
The rise of adaptive displays: How Lenovo is redefining productivity & play
"If you look at the history of displays, they have always been passive surfaces that simply rendered whatever the device sent to them," says George Toh, Vice President and General Manager of Lenovo’s Visual Business Unit. "What is changing now is that screens are becoming adaptive interfaces that react to what the user is doing in real time.”