Security researchers have discovered new security flaws affecting Apple devices with M2 or A15 chips and onwards. This includes iPhones, iPads, Mac laptops, and Mac desktops. The vulnerabilities, dubbed SLAP and FLOP and first reported by Bleeping Computer, could allow attackers to read information from a user’s open web tabs. Depending on the tabs you have open, this could put sensitive data like passwords and banking information at risk.
This isn’t a software problem, but rather a hardware flaw that affects CPUs and leaves them vulnerable to side channel attacks. This kind of exploit measures CPU activity and uses factors like power consumption, timing, and sound to infer information about the user’s behavior. The Spectre and Meltdown flaws from 2018 worked in a similar way.
It’s pretty complicated stuff, but the important part is that it makes it possible for attackers to get their hands on sensitive information even when it’s properly protected by the software your PC is running. The cause of these weaknesses isn’t purely an Apple problem, it’s a performance optimization that’s used on most modern CPUs.
Computer programs are just a long series of instructions that the CPU executes, but because there are so many different outcomes to cover, those instructions expand into all sorts of different branches. “If A then do X, if B then do Y,” or “If A happens, return to point X” — in a large program, millions of decisions like these happen in order to progress.
To speed things up, it’s now standard practice to predict which path the CPU should take and start executing instructions further down the line. This way, more work can be done at the same time, rather than every instruction waiting for its turn in the proper order.
This optimization is called speculative execution or branch prediction, and because it’s based on predictions, it doesn’t always go well. It’s when the predictions backfire that we get these hardware vulnerabilities that attackers can take advantage of.
The full names of the new flaws are “Data Speculation Attacks via Load Address Prediction on Apple Silicon (SLAP)” and “Breaking the Apple M3 CPU via False Load Output Predictions (FLOP).” They both cause essentially the same problem, but while SLAP is limited to the Safari browser, FLOP works with Chrome as well.
The research proves with demos that attacks based on these flaws are possible, but there’s no evidence of any cybercriminals using them at the moment. The researchers shared their findings with Apple last year and said that the company responded, stating that it plans to address the issues. However, months have passed and since the papers have been published, the only official comment from Apple (to BleepingComputer) is this:
“We want to thank the researchers for their collaboration as this proof of concept advances our understanding of these types of threats. Based on our analysis, we do not believe this issue poses an immediate risk to our users.”
Although these attacks don’t involve malware, they still begin with a visit to a malicious website. As always, the best way to protect yourself until we get security updates is to be careful of suspicious links and URLs while browsing.
Mozilla is giving Firefox’s Smart Window two new tricks. If you haven’t tried it yet, Smart Window is an optional AI mode in Firefox with a built-in chat that helps you get things done while you browse. With this update, it can fill out online forms using details from your tabs and keep an eye on websites for you.
Tired of typing the same details into every form?
The absolutely absurd idea of putting a touchscreen display on a mouse isn't exactly new. Turtle Beach already did it with its Command Series MC7, which features a 2.25-inch control screen. But apparently, even that wasn't ridiculous enough for Arctic Fox Technologies. Its new Super Mouse looks like someone took the chunky old Atari ST mouse, slapped a touchscreen and scroll wheel on it, and called it an upgrade.
The result is a rather unusual-looking mouse that is now on Kickstarter, starting at $199. And as ridiculous as it looks, some of its features are genuinely intriguing.
Apple is less than a day away from launching its highly anticipated OLED MacBook Pro with a touch-sensitive screen. But it appears that the upgrade is going to cost a pretty penny. According to a report by Bloomberg, Apple is reportedly eyeing a starting price of $2,899 for the 14-inch MacBook Pro, while the 16-inch version could start at $3,399 in the US.
"At $2,899, the 14-inch model would mark the highest starting price for a new MacBook Pro model, surpassing the $2,799 Apple charged for a 17-inch version introduced in 2006," says the report. The report claims that Apple is targeting a minimum price hike of $400 for its upcoming redesigned 14-inch and 16-inch MacBook Pro models.