New 'ZombieLoad' Vulnerability Affects Intel Chips Dating Back to 2011, Apple Released Patch in macOS 10.14.5 [Updated]

MacRumors

macrumors bot
Original poster
Apr 12, 2001
7,446
8,512



Security researchers have discovered a new set of vulnerabilities that affect Intel chips dating back to 2011, including the chips that have been used in Apple devices.

As outlined by TechCrunch, "ZombieLoad," as it's being called, consists of four bugs that can allow hackers to exploit the design flaws in the chips to steal sensitive information directly from the processor.


These vulnerabilities are as serious as the Meltdown and Spectre vulnerabilities that were discovered in early 2018 and take advantage of the same speculative execution process, which is designed to speed up data processing and performance.

A white paper shared by notable security researchers (including some who worked on Spectre and Meltdown) offers details on how ZombieLoad functions. [PDF]
While programs normally only see their own data, a malicious program can exploit the fill buffers to get hold of secrets currently processed by other running programs. These secrets can be user-level secrets, such as browser history, website content, user keys, and passwords, or system-level secrets, such as disk encryption keys.

The attack does not only work on personal computers but can also be exploited in the cloud.
ZombieLoad impacts almost every Intel computer dating back to 2011, but AMD and ARM chips are not affected. A demonstration of ZombieLoad was shared on YouTube, displaying how it works to see what you're doing on your computer. While spying on web browsing is demoed, it can also be used for other purposes like stealing passwords.


There have been no reports of hackers taking advantage of the ZombieLoad vulnerabilities at this time, and Intel has released microcode for vulnerable processors. Apple addressed the vulnerability in the macOS Mojave 10.14.5 update that was released yesterday and in security patches for older versions of macOS that were also released yesterday.
Apple has released security updates in macOS Mojave 10.14.5 to protect against speculative execution vulnerabilities in Intel CPUs.
The issues addressed by these security updates do not affect Apple iOS devices or Apple Watch.
Apple previously released security updates to defend against Spectre--a series of speculative execution vulnerabilities affecting devices with ARM-based and Intel CPUs. Intel has disclosed additional Spectre vulnerabilities, called Microarchitectural Data Sampling (MDS), that apply to desktop and notebook computers with Intel CPUs, including all modern Mac computers.
An Apple support document on the ZombieLoad vulnerability provides details for "full mitigation" protection that can be enabled for customers with computers at heightened risk or that run untrusted software on their Macs.

Full mitigation requires using the Terminal app to enable additional CPU instructions and disable hyper-threading processing technology, which is available for macOS Mojave, High Sierra, and Sierra, but not on certain older machines. Apple says full mitigation could reduce performance by up to 40 percent, so most users will not want to enable it.

According to Intel, its microcode updates will have an impact on processor performance, but for the patch that Apple released in macOS Mojave 10.14.5, there was no measurable performance impact. Apple's fix prevents the exploitation of ZombieLoad vulnerabilities via JavaScript in Safari.
An Intel spokesperson told TechCrunch that most patched consumer devices could take a 3 percent performance hit at worst, and as much as 9 percent in a datacenter environment. But, the spokesperson said, it was unlikely to be noticeable in most scenarios.
As mentioned above, customers who enable Apple's full mitigation option will indeed see processor slowdowns because of the need to disable hyper-threading.

One of the researchers who discovered ZombieLoad, Daniel Gruss, told TechCrunch that ZombieLoad is easier to exploit than Spectre, but more difficult than Meltdown, and that it requires a specific set of skills, which means the average person doesn't need to worry.

Update: This article previously said that Apple would release a patch, but it has been updated to clarify that Apple addressed the issue in security updates made available to Mac owners yesterday. Customers running Mojave should update to macOS 10.14.5, while customers running older versions of macOS should install any available security updates.

Article Link: New 'ZombieLoad' Vulnerability Affects Intel Chips Dating Back to 2011, Apple Released Patch in macOS 10.14.5 [Updated]
 
  • Like
Reactions: goldrain

jclardy

macrumors 68040
Oct 6, 2008
3,398
1,944
With all these speculative execution patches, the iPad Pro is soon to take the lead from the top end MBPs.
 
  • Like
Reactions: Solomani

Larsvonhier

macrumors 6502a
Aug 21, 2016
532
849
Germany, Black Forest
Some people have either totally forgotten about what Snowden taught us all or are just feeding the propaganda machine.
Otherwise, quote "and that it requires a specific set of skills, which means the average person doesn't need to worry" cannot be explained.
 

BGarza

macrumors member
May 11, 2016
48
71
San Francisco
I wonder if extreme, unusual, and public punishments could help deter these types of hacks. Imagine how people would feel if every other year a new nefarious portal appeared in people’s homes allowing criminals to do as they please. Would it make sense to hire a portal security guard for every home, replace your home each time with a newer model, or just slice off all prized appendages of those found guilty?
 

Larsvonhier

macrumors 6502a
Aug 21, 2016
532
849
Germany, Black Forest
I wonder if extreme, unusual, and public punishments could help deter these types of hacks. Imagine how people would feel if every other year a new nefarious portal appeared in people’s homes allowing criminals to do as they please. Would it make sense to hire a portal security guard for every home, replace your home each time with a newer model, or just slice off all prized appendages of those found guilty?
You are aware that most of that would apply to your (or my) government "hackers" (so called security agencies) ?
[doublepost=1557857034][/doublepost]
Damn we just updated to macOS 10.14.5 today.:eek:
And the correlation to the intel processor "situation" is exactly what?
 
  • Like
Reactions: Val-kyrie

GeoStructural

macrumors regular
Oct 8, 2016
169
490
Colombia
Between all these issues and the delays, I’m just hanging out for A-Series Macs at this point.

Intel to the curb; Windows be damned.
A-series chips are also prone to vulnerabilities, Mac OS is in a yearly increase of malware attacks too. No one is safe nowadays, it is not even about “being careful where you click” anymore, now companies specialize in exploiting every single vulnerability or hole to track, read data or manipulate.

I don’t think it is Apple’s, Intel’s or Window’s fault anymore, they actually do a good job of trying to be ahead.

And the believe that iOS is the most secure system is total BS, restrictive yes, but it is just as bit as vulnerable as any other. I hate that apps go through such lengthy “review” process that is just garbage, but there are many in the AppStore tracking us without consent and stealing our information without the geniuses at Apple stopping them.

Many years ago my app was rejected “because it made no use of iPhone’s features”... and it was approved just after I added a shaking feature, total stupidity, meanwhile apps go through the process with malicious intentions hidden and these guys don’t even know until news go viral and they “act swiftly to remove them”.
 

cmaier

macrumors G5
Jul 25, 2007
14,049
8,522
California
As a CPU designer who formerly had to compete with Intel and it’s hyperthreading microarchitectures, I am retroactively glad we didn’t go that way. It always seemed like sharing buffers between threads opened up way too many opportunities for mischief unless you put in a lot of extra hardware to zero-out every memory structure between context switches, and that would probably eliminate any speed benefit anyway.
 

ksec

macrumors 6502a
Dec 23, 2015
946
899
This is a **** show.

We got Meltdown, Spectre, ForeShadow and now this. I still remember there were lots of warning and questions over Intel's SMT ( Hyperthreading ) when it arrive and they promised everything were FUD.

By 2019 Xmas, when 10nm arrive on shelf we would be 5 years since Intel launched their 14nm, which was already a year / 6-8 months late depending on how you view it. That is assuming they haven't lie again with 10nm as they have been all the way along.

They purchased Infineon in 2010 and completed the deal in early 2011, for 5 - 8 years all they had was the pile of crap to show in iPhone 7, iPhone 8 and now iPhone XR...

Right now I really wish I have nothing to do with Intel. I don't want an iPhone or any Apple products to have a single dollar worth of material going to Intel.

For backward compatibility reason I still wish Mac would stick to x86, and would be nice if they use Ryzen or EPYC for Mac.
 

maverick28

macrumors regular
Mar 14, 2014
230
211




There have been no reports of hackers taking advantage of the ZombieLoad vulnerabilities at this time, and Intel has released microcode for vulnerable processors. Apple is expected to release a patch for ZombieLoad "in the coming hours," with Google and Microsoft also planning patches.

...... the average person doesn't need to worry.
Sure, don't worry. Really, no hacker attacks are known to target this "vulnerability". It's just big daddies want you to move on to new tech sooner than you do. The average person doesn't have to worry, indeed. Except when his devices are made "incompatible".

P.S. YouTube today started crashing my Safari, released in the late 2016. Certain videos on Vimeo stopped playing despite their minimal requirements which my browser meets. Old, you say? But every other site opens and loads perfectly, and more so it does in more obsolete versions of Chrome which, quite unsurprisingly, is a Google product. Yeah, let's talk about "vulnerabilities".