iLeakage Side-Channel Attack Allows Theft of Sensitive Data Through Apple Safari

A team of researchers has developed a speculative side-channel attack called iLeakage that targets Apple devices and can extract sensitive information from the Safari browser, including passwords and tab contents. Experts from the Georgia Institute of Technology, the University of Michigan, and Ruhr University Bochum report that iLeakage works against all modern Apple devices with A and M series processors. According to the researchers, this attack can extract data from Safari, as well as Firefox, Tor, and Edge for iOS, with nearly “perfect accuracy.”

The researchers emphasize that iLeakage is not just a proof of concept—the attack can be used in real-world scenarios. All it takes is luring a user to a malicious web page, after which data from their other open Safari tabs can be recovered.

Essentially, iLeakage is a timerless version of the well-known Spectre vulnerability and bypasses side-channel attack protections that have long been implemented by all major browser vendors. While testing Safari’s resistance to such attacks, the researchers managed to circumvent existing countermeasures and implement an architecture-independent, timerless attack method based on a race condition.

How the iLeakage Attack Works

The researchers focused primarily on reading sensitive information from Safari. They succeeded in stealing data by creating a primitive capable of speculatively reading and leaking any 64-bit pointer in the address space used by Apple’s browser rendering process.

To achieve this, they bypassed Safari’s side-channel protections, including low-resolution timers and compressed 35-bit addressing. They also overcame Safari’s site isolation policy, which separates sites into different address spaces based on top-level domains and subdomains.

The experts used a new technique involving the JavaScript window.open API, which allows a malicious page to share the same address space with arbitrary victim pages.

By using a speculative type confusion attack to bypass Apple’s security measures, the researchers were able to leak sensitive data from the target page, including passwords and emails of a hypothetical victim. The proof-of-concept exploit for this attack was implemented using JavaScript and WebAssembly.

In the video below, the researchers demonstrate how iLeakage is used to extract Gmail messages from Safari on an iPad. The main requirement for this attack is that the user interacts with the attacker’s web page.

Additional Demonstrations and Impact

The researchers also applied the same approach to obtain the password for a test Instagram account that was auto-filled in Safari using LastPass, though this demonstration video is currently unavailable. In another experiment, they showed how iLeakage works against Chrome for iOS and were able to extract the victim’s YouTube browsing history.

The experts explain that Apple’s rules require all third-party browsers for iOS to be overlays for Safari and to use Apple’s own JavaScript engine.

iLeakage affects all Apple devices released after 2020 that run on Apple’s ARM-based A and M series processors. The attack is nearly undetectable and leaves no traces on the victim’s system, except for a record of visiting the attacker’s web page in the browser cache. However, the researchers note that the attack is complex to implement and “requires deep knowledge of browser side-channel attacks and Safari’s implementation.”

Test Results and Apple’s Response

The research paper highlights that the team reported the issue to Apple on September 12, 2022, but the company decided not to release a fix. Instead, the following mitigation method was suggested for macOS:

1. Open Terminal and run the command defaults write com.apple.Safari IncludeInternalDebugMenu 1 to enable Safari’s hidden debug menu.
2. Open Safari and go to the new Debug menu.
3. Select “WebKit Internal Features.”
4. Enable the “Swap Processes on Cross-Site Window Open” feature.

However, the researchers stress that this method works only for macOS, is not enabled by default, and is currently considered unstable.