Will Apple chip vulnerability steal Crypto assets? What you need to know

The M1 processor was launched on MacBook Air, MacBook Pro, and Mac Mini in late 2020, and was later expanded to Mac desktops and even iPad tablets.

M2 processors and the current M3 processors are also susceptible in computers and tablets, and the M2 chip is even used in Apple's Vision Pro headphones.

But according to Ars Technica, in the M3 chip, the data memory prefetcher affected by the vulnerability adds a "special bit" that developers can call to disable it. Data saving function, although there will be a certain performance impactas a result.

If users are equipped with older Macs with Intel processors, they will not be affected. Apple used Intel processors for years before developing its own chips.

Similarly, if the user's iPad (whether old or new) uses Apple's A-series chip (the same chip used in the iPhone), then there seems to be no risk. Only the M1, M2 and M3 chips are vulnerable due to the way they are designed.

The A14, A15 and A16 l chips in Apple’s recently launched iPhones and iPads are indeed variants of M-series chips, but research reports and media reports have not pointed out that they have vulnerabilities.

So what can users do to solve this problem? Unfortunately, nothing can be done.

Because this is a chip-level vulnerability, related to the unique architecture of Apple chips. This means Apple can't fix it with a patch. What app developers can do is implement fixes to avoid the vulnerability, but there's obviously a performance tradeoff in doing so, so such apps may feel more sluggish once updated.

Of course, to eliminate the risk, users can also remove their Crypto wallet from the vulnerable Apple device. Migrate them to other devices such as Windows PC, iPhone, Android phone, etc.

Errata Security CEO Robert Graham also said: "Take your Crypto asset wallet off the device, at least for now. I guess there are people who want to carry out this attack now. , and are working hard."

Although devices equipped with M1-M3 chips do have vulnerabilities, hackers do not just turn on a switch and take away your funds. Typically, the user needs to install malware on the device, and the attacker then needs to use the exploited software to extract the private keys and access the associated wallet.

Apple's macOS is also quite resistant to malware because you have to manually allow such apps to be installed on your device.

Mac blocks unsigned third-party software by default. Still, if you're adventurous and install apps from "unidentified" developers, you should still be careful when using a potentially vulnerable M-chip device.

According to Zero Day, this attack can also be carried out on a shared cloud server that holds user keys, so this is another potential attack vector.

Alternatively, it is also possible to carry out this attack on a website via Javascript code, which is much more effective for ordinary users because no software needs to be installed. Of course, this is only theoretically possible.

According to Zero Day reports, this vulnerability may also be used to decrypt the contents of web browser cookies, which may allow attackers to gain access to email accounts, etc., and log in to users' sensitive accounts. .

According to current reports about the vulnerability, hardware wallets from companies such as Ledger and Trezor are apparently not compromised, as the private keys need to be installed on an Apple device with an M1-M3 chip to be affected.

Still, it is a good countermeasure to avoid connecting your hardware wallet to a vulnerable device just in case.

Centralized exchanges such as Coinbase store users' funds in custodial wallets. Since users do not have private keys on their devices, they are not directly exposed to risks.

However, if users save their Coinbase account passwords in the Crypto Secure Password Manager on a vulnerable Apple device, they may need to change the password rather than update it in the manager.

As mentioned previously, an attacker could theoretically exploit this vulnerability to decrypt account passwords from browsing cookies.

There is no doubt that this is a serious vulnerability, but the likelihood of affecting ordinary Crypto users seems low. To crack passwords through this vulnerability, you must first gradually extract enough data from the cache to reconstruct the key. This process may take about 1-10 hours, or even longer.

This doesn’t mean it’s impossible or won’t happen to users, but it’s not a quick-fix attack.

Users should still take precautions to ensure they are not at risk, but if the reports are accurate, it doesn't sound like this is a widespread threat to the average user.