“Apple Chip Flaw Uncovers Gmail, iCloud, and Various Confidential Information to Possible Attacks”
# New Side-Channel Vulnerabilities in Apple Silicon: Unveiling FLOP and SLAP Exploits
Apple’s bespoke A-series and M-series processors, used in its iPhones, iPads, and Macs, have received extensive acclaim for their efficiency and performance. Nevertheless, researchers have recently identified two notable side-channel vulnerabilities—referred to as **FLOP** and **SLAP**—that exploit speculative execution features inherent in these processors. These vulnerabilities could empower unauthorized remote attackers to capture sensitive data, including credit card information, location logs, and email contents, from widely-used browsers such as Safari and Chrome.
This revelation brings forth critical concerns regarding the security of Apple’s hardware and the use of speculative execution as a method for enhancing performance. Below is a comprehensive examination of the vulnerabilities, their ramifications, and possible countermeasures.
—
## **What Are Side-Channel Attacks?**
Side-channel attacks take advantage of indirect information leaks from a system—like timing, power usage, or electromagnetic emissions—to deduce confidential information. Unlike conventional exploits that exploit software weaknesses, side-channel attacks are aimed at the hardware itself, rendering them more challenging to detect and alleviate.
The newly identified vulnerabilities in Apple silicon relate to **speculative execution**, a performance-enhancing technique that anticipates the next actions a CPU should undertake for improved speed. While speculative execution has significantly advanced modern computing, it has simultaneously created new attack vectors, as evidenced by previous vulnerabilities like Spectre and Meltdown.
—
## **The FLOP and SLAP Vulnerabilities**
### **1. FLOP (Load Value Predictor Exploit)**
FLOP targets the **Load Value Predictor (LVP)**, a speculative execution function introduced in Apple’s M3 and A17 chipsets. The LVP anticipates memory contents that are not readily accessible, enabling the CPU to continue with calculations. However, researchers discovered that the LVP could be deceived into returning incorrect values from memory, allowing attackers to access sensitive data.
#### **Key Features of FLOP:**
– **Extensive Data Access:** FLOP can read any memory address within the browser’s process space, making it more formidable than comparable attacks.
– **Cross-Browser Effect:** FLOP compromises both Safari and Chrome, putting users of either browser at risk of data breaches.
– **Sensitive Data Exposure:** FLOP can retrieve location history from Google Maps, inbox information from Proton Mail, and calendar entries from iCloud Calendar.
#### **Attack Overview:**
To carry out a FLOP attack, the victim must have a legitimate site (e.g., Gmail or iCloud) open in one browser tab while the attacker’s malicious site is open in another. Over a span of 5–10 minutes, the attacker can deploy JavaScript to manipulate the LVP and extract sensitive information.
—
### **2. SLAP (Load Address Predictor Exploit)**
SLAP exploits the **Load Address Predictor (LAP)**, another speculative execution feature that anticipates memory locations for quicker data retrieval. By coercing the LAP to predict erroneous memory addresses, SLAP enables attackers to execute unauthorized operations on sensitive data preserved in distinct Safari processes.
#### **Key Features of SLAP:**
– **Safari-Centric:** SLAP is restricted to Safari and does not target Chrome or other browsers.
– **Restricted Data Access:** SLAP can only read strings located adjacent to the attacker’s data, making it less impactful than FLOP.
– **Focused Data Recovery:** SLAP can extract sensitive details from Gmail, Amazon, and Reddit when the victim is logged in.
#### **Attack Overview:**
SLAP necessitates that the victim open a malicious site in Safari while logged into another site, like Gmail or Amazon. The attacker can then retrieve sensitive strings, such as email subject lines, sender identities, and product specifications.
—
## **Affected Devices**
The vulnerabilities affect a variety of Apple devices based on the generation of their chipsets:
– **FLOP (A17/M3 and newer):**
– All Mac laptops (MacBook Air, MacBook Pro) from 2022 onwards.
– All Mac desktops (Mac Mini, iMac, Mac Studio, Mac Pro) from 2023 onwards.
– All iPad Pro, Air, and Mini models from September 2021 onward.
– All iPhones from September 2021 onward (iPhone 13, 14, 15, 16, and SE 3rd Gen).
– **SLAP (A15/M2 and newer):**
– Similar range of devices but includes slightly older models.
Devices with **A14/M1 and older chips** are not vulnerable to either issue.
—
## **Technical Insights**
### **How FLOP Functions:**
1. The LVP forecasts memory values based on historical patterns.
2. FLOP manipulates the LVP by supplying it with malformed data, prompting it to pass through incorrect values.
3. This enables the attacker to circumvent memory safety checks and access arbitrary