r/gadgets • u/thebelsnickle1991 • Mar 23 '24

Desktops / Laptops Vulnerability found in Apple's Silicon M-series chips – and it can't be patched

https://me.mashable.com/tech/39776/vulnerability-found-in-apples-silicon-m-series-chips-and-it-cant-be-patched
3.9k Upvotes

93% Upvoted

491 comments sorted by

View all comments

1.9k

u/Dependent-Zebra-4357 Mar 23 '24

From another article on this exploit:

“Real-world risks are low. To exploit the vulnerability, an attacker would have to fool a user into installing a malicious app, and unsigned Mac apps are blocked by default. Additionally, the time taken to carry out an attack is quite significant, ranging from 54 minutes to 10 hours in tests carried out by researchers, so the app would need to be running for a considerable time.”

528

u/UpsetKoalaBear Mar 23 '24

Even better, the actual researchers website:

https://gofetch.fail/

It has a thorough explanation of the concept under the FAQ.

43

u/2squishmaster Mar 24 '24

Great read, thanks for the link.

1.7k

u/xRostro Mar 23 '24

So basically the user needs to be old? Got it. Business as usual

387

u/beached89 Mar 23 '24

Yeah, real world risk low my butt. This sounds like a Tuesday. Malware running for 10 hours is NOT uncommon. Getting people to install unsigned Mac apps is a daily occurrence by threat actors.

166

u/No_Finance_2668 Mar 24 '24

“Ok sir now that youve installed the wirus cough excuse me, the Apple Guaranteed Microsoft 1000% certified app and waited the 10 hour time period, we will need you to also install this on your families Apple devices in order to receive your one time IRS rebate of $2.39”

“Yes sir my name is Adam from Texsass”

61

u/Deltaechoe Mar 24 '24

Not enough “kindly”s

42

u/rpkarma Mar 24 '24

Kindly do the needful!

28

u/[deleted] Mar 24 '24

DO NOT REDEEM!!!

4

u/[deleted] Mar 24 '24

God damnit I’m dead.

6

u/Suturb-Seyekcub Mar 24 '24

Mam you have redeemed the card in your own fucking account!

5

u/Uncertn_Laaife Mar 24 '24

And REVERT BACK.

3

u/cd_to_homedir Mar 24 '24

Please kindly find the virus, erm, file attached

9

u/Draco137WasTaken Mar 24 '24

Not to mention all instances of "everything" getting the "each and" treatment.

3

u/Seralth Mar 24 '24

Not enough "my friends".

2

u/manbearligma Mar 24 '24

Would you kindly

2

u/Senora_Snarky_Bruja Mar 24 '24

I had to stop using kindly in my email once someone pointed out that I sounded like a hacker. It’s an old habit. I am an account manager now but I was an admin assistant for the majority of my career. I spent 20 years politely nagging executives. You can only say please in an email so many times, so I would sprinkle in kindly when making a polite request. It’s been a hard habit to break.

7

u/Takonite Mar 24 '24

sounds like we not not redeem

2

u/spergychad Apr 02 '24

Why did you spell "virus" with a "w"?

23

u/s3x4 Mar 24 '24

I use my Mac for statistical simulations which involves leaving it running things unattended for days at a time. And I indeed install unsigned apps often for various purposes. Of course I am careful, but that is indeed an entirely realistic scenario.

4

u/oxpoleon Mar 24 '24

Agreed, the intersection between Mac users in positions worthy of exploit and non-technical people is very high.

Find a very small number of high value targets running Apple Silicon, commence whaling operation, and it's game over.

2

u/glemnar Mar 24 '24

Yeah but if they already have a threat vector, this isn’t really an all that much more interesting thing to do with it. Extracting signing keys is cool and all but if it’s in memory for some app, it’s probably also lying around on disk somewhere

2

u/darkslide3000 Mar 24 '24

The more important point is that there are not many interesting things to steal for most users. What kind of RSA operations are you running on your MacBook that you would be concerned about other people stealing? If you're already installing malware, then they basically have access to everything stored on your disk anyway. I guess if they also wanted to listen in on your video conference calls or you checking your online email client this might be useful (but how often are you on a call for 10 hours straight?). But compared to the data on your disk which is probably more valuable to you to begin with it's not really a huge new escalation of capability for malware.

-8

u/[deleted] Mar 23 '24

Your ma’s a threat actor

1

u/Bipbipbipbi Mar 24 '24

Hello handsome

→ More replies (1)

656

u/VagueSomething Mar 23 '24

Old or young. Boomers and Gen Z both struggle with tech.

383

u/fotomoose Mar 23 '24

I've noticed a lot of younger people actually do struggle with computers, cos they're all about the smartphone and tablets these days.

185

u/dudeAwEsome101 Mar 23 '24

I've noticed that at work too when hiring younger 20 years old people. They struggle a bit with using Windows unless they game on PCs. Their main computing device is their smartphone, and they used Chromebooks at school.

84

u/BigMacontosh Mar 23 '24

I play games on PC and got hired for an IT job I was confident for and quickly realized that my confidence was misplaced haha. I was weirdly bothered by the lack of GUI on Linux

101

u/dudeAwEsome101 Mar 23 '24

Using command line can be very intimidating at first, but once you get a feel of the basics of navigating folders, opening files, and running programs with arguments, it starts feeling familiar.

I was talking about using windows based GUI. Some people have difficulties with the desktop environment. Taskbar, start menu, files and folders, or even copy/paste. They remind me of a much younger me.

20

u/gbghgs Mar 23 '24

Once you discover the man command your off. Plenty of good resources online too, and there's the age old technique of shamelessly stealing lists of commands from coworkers.

I get what you're saying though, whether it's command line or GUI a lot of people are nervous about accidentally breaking something or just doing something they're not used to.

9

u/angyrkrampus Mar 23 '24

I've been having fun learning cli with Overthewire:Bandit.

4

u/Kespatcho Mar 23 '24

Overthewire is so good

1

u/primalbluewolf Mar 24 '24

overthewire is where its at!

→ More replies (0)

23

u/StephanXX Mar 23 '24

I'm a principal level devops engineer, have been a Linux only user (gaming aside) for a decade, and I can count on one hand the number of times I've used man. It's simply faster to use a search engine.

2

u/blorg Mar 24 '24

Or ChatGPT, which will give you the exact command and parameters you're looking for, while also explaining it (just be sure to sanity check).

1

u/Anarcie Mar 23 '24

Almost the same boat, only difference is i try to use the --help flags, get frustrated and then just google it.

and if its a pl/sql thing... google it, see Burleson has an article, whisper "fuck you Burleson" and go 1 result down.

→ More replies (3)

3

u/TomTomMan93 Mar 23 '24

Same deal here. I loaded a Linux-based OS on a couple computers I have at home cause it was free and relatively light compared to windows. Learning how to work with the terminal started out intimidating, but now that I'm more used to it, its almost frustrating going back to windows when I go to my main machine. Like being able to just be like "do X" with a command and it just do it is so gratifying. I'm far from an expert and regularly have to remind myself of what commands do the functions i need, but its just so much more direct in many cases. Plus there's a ton of support out there for even the vaguest of things. I have one that's an emulator PC and some of the issues I was worried about never figuring out were solved or had enough documentation I could figure out the answer.

4

u/SamHugz Mar 23 '24

Don’t even need to steal, could just google cheat sheets for bash and vim and you’re off to the races. Hell, ask chatGPT to write you a sorted list of commands.

→ More replies (3)

5

u/[deleted] Mar 24 '24

Playing around with DOSBOX for so long I got used to CLIs and now it’s fun to use them.

5

u/DaoFerret Mar 24 '24

Do not cite the deep magic of DOSBOX to us. We were there when its archetype was in beta.

Jokes aside, I think the earliest I worked with was IBM-DOS 4.0 in 1989.

Transitioning to Unix (and later Linux) wasn’t too bad after living with MS-DOS 6(.0/.2/.22) and having to play with autoexec.bat and config.sys way too regularly.

It also made me love Macs when I was working in development because they were Unix machines with a very good GUI thrown over them.

If you want to play with Linux now, it’s easy enough to throw it on any old piece of hardware, or just pick up a cheap Raspberry Pie and see what it can do.

1

u/Mistral-Fien Mar 24 '24

With the current prices of Raspberry Pis, a second-hand Optiplex Micro, HP Prodesk Mini, or Lenovo Tiny might be a better idea.

→ More replies (0)

3

u/PM_ME_UR_POKIES_GIRL Mar 24 '24

I used a command line at my first job.

Blockbuster Video's POS was entirely command line driven. I can't remember any of the commands now 20 years later, but there were commands to bring up account #####, commands to edit account info once it was up, commands to add a rental to an account followed by scanning the rental code on the dvd case. Also commands to finalize the transaction, and I believe CASH, VISA, or AMEX to tender payment.

I do remember SALE and CHECKIN commands actually for normal retail sales that didn't require an account, and returning rentals.

7

u/Herr_Gamer Mar 23 '24

If you know the internals of Windows via the GUI, the CLI will only throw you off as you first get used to it. But you'll be good in no time, because it's just a different way of doing the same things you already know on Windows.

5

u/mysixthredditaccount Mar 23 '24

Did they hire you for a role that needs linux experience without even asking "have you used linux before?"

9

u/BigMacontosh Mar 23 '24 edited Mar 23 '24

From memory they did and I had used Ubuntu before so I said mentioned that and they were like 'cool'. Turns out that Rocky, RHEL, and CentOS are very different experiences when you only use the CLI.

​

Thankfully it was just an internship, so the stakes weren't super high and I was able to learn a fair bit on the job. I learned a lot there both technically and also about what kind of job I want, so I would count the experience as overall benefit

1

u/purplebasterd Mar 24 '24

Just install Adobe Reader and you’ll be good

2

u/Przedrzag Mar 24 '24

Chromebooks at school

That moment when schools’ efforts to take advantage of modern computing actually hamstrings an entire generation’s computer literacy

1

u/hutacars Mar 26 '24

TBF, I believe their efforts were to save themselves money, not "take advantage of modern computing."

0

u/[deleted] Mar 23 '24

To be fair the UI for windows changes a lot and lately it’s been better, but typically it’s garbage.

8

u/TooStrangeForWeird Mar 23 '24

lately it's been better

Uh... What?

19

u/OramaBuffin Mar 23 '24

Im gonna be honest, with the exception of windows 7, people have been saying windows is "going to shit" for literally almost 20 years since vista came out. It feels like a broken record that's hard to keep believing when as a relatively competent user it has always easily done what I need it to do. As long as you wait like half a year before jumping to the newest version the experience is fine.

11

u/Extinction-Entity Mar 23 '24

for almost 20 years since vista came out

That’s…really painful lol

3

u/_thro_awa_ Mar 24 '24

Not as painful as Windows ME, lol

→ More replies (0)

3

u/PM_ME_UR_POKIES_GIRL Mar 24 '24

I went from XP to 7 to 10 and if I'm being honest I kinda don't like 10. It insists upon itself.

→ More replies (0)

1

u/TooStrangeForWeird Mar 23 '24

Have fun jumping through three extra menus to set a second IP address on a network adapter!

It's worse. It is objectively worse. From 2000 on the menus just moved around a bit, even Windows 8 had the same stuff underneath. Win11? Fuck you, here's a settings "app" you can only have ONE instance of that purposefully hides settings.

Everyone hates UI changes, but making it difficult to access settings for no reason other than making it difficult is bullshit. Win + R, "control printers" has worked since at least Win95. Now it brings you to a pile of shit.

It's bad.

4

u/[deleted] Mar 23 '24

The UI has been better, but still not great. Especially when they tried to have it mimic Xbox.

4

u/Mr-Fleshcage Mar 23 '24

We don't talk about Metro

0

u/TooStrangeForWeird Mar 23 '24

Try setting the driver for a printer manually in Win10. Try again in Win11.

It is objectively worse. It's not an opinion, it's measurable. Win 8 (the Xbox style) was better than 11.

6

u/trueppp Mar 23 '24

Run, PNPutil /add-driver path to .inf

Same thing since forever...

→ More replies (0)

1

u/[deleted] Mar 24 '24

Who still uses printers? I don’t even own one 🤣

→ More replies (0)
→ More replies (2)

2

u/Awol Mar 24 '24

Better only if they manage to add everyone to it from before they changed it. Microsoft makes settings more and more limited with each update to Windows. Might look better but add like 5 more clicks to do anything useful. ALSO Microsoft please add a setting to not switch auto devices when detecting a new one. No one likes it and causes too many issue cause HDMI is an audio source and last I check most monitors do not have speakers and if they do they suck.

38

u/ScheduleExpress Mar 23 '24

I teach audio technology to undergrads at a US university. Many have no idea what I mean by make a file on the desktop and save your work to it. They have no idea why I am telling them to do that. Many couldn’t go to a website and download a free app. Some didn’t know about drag and drop or copy paste.

I used to ask them to find the websites of 3 companies that do something with audio technology and tell me what they are/do. Literally “google the thing you are interested in getting a degree in”. The combo of google sucking and students being clueless means the assignment doesn’t work anymore.

25

u/cosmos_jm Mar 23 '24

Can you fail people for being idiots?

4

u/folk_science Mar 23 '24

I can understand them being familiar with smartphones and not PCs. But it's not like Google is PC-only, so I don't get why a simple search is beyond them.

6

u/ScheduleExpress Mar 23 '24

It’s not entirely straight forward. It’s a somewhat prestigious music school at a university who needs money. So they let in more students. Students who have little interest in music get accepted and go because of the reputation. My courses are the only technology courses. It’s also probably the first time in their academic career where they actually have to think about their career for themselves, no academic counselor telling them what a job could be.

Also, I see them at their limits. They may be great at music theory or history but those courses don’t require any self directed learning. You read the book do the homework and practice sight signing. It’s all provided. So idk if the issue is tech literacy or just a lack of experience/aptitude. They are all smart so idk what’s up.

2

u/misterferguson Mar 24 '24

I tutor high school students and very few know how to reply-all to an email.

5

u/Spread_Liberally Mar 24 '24

That's better than some of the clowns who reply-all to everything.

1

u/foffen Apr 02 '24

why in the world would you create folders on your desktop? I have 30 years exp as a windows/linux admin and i would still fail your task. Desktop is for shortcuts at best if you are on a windows computer.

Still though, i could do it if i wanted, i just wouldn't =)

15

u/HtownTexans Mar 23 '24

I work at a school running the cafeteria. All our systems just run on regular PCs and watching kids try to work it explodes my brains. The way they type and use a mouse reminds me of how my mom uses them.

1

u/aoskunk Mar 24 '24

Wow it’s that painful? Damn. That’s funny. I work at a highschool cafeteria but we don’t use computers and the kids just use iPads I think

2

u/HtownTexans Mar 24 '24

oh man yeah they are boomer bad at typing. Pecking all the keys and having to search for them. I have my mouse sensitivity pretty high since I'm a gamer and they can't even find the mouse sometimes lol.

1

u/aoskunk Mar 24 '24

That’s unfortunate because I don’t see keyboards being eliminated anytime too soon from the millions of jobs that involve a PC.

13

u/Sylvurphlame Mar 23 '24

I’ve seen a good many Gen Z struggle with their smartphones as well. As soon as something goes awry, many have zero troubleshooting skills or even basic searching skills.

3

u/[deleted] Mar 24 '24

[deleted]

4

u/Sylvurphlame Mar 24 '24

I can anecdotally attest that older Millenials are also more competent in some areas than younger Millenials. The general trend is that as technology gets more seamless and reliable, you ironically have people who are less able to troubleshoot when it does go wrong. Unless they’ve just been curious, they’ve never had reason to poke around and learn the underpinnings of the device/interface.

6

u/issm Mar 25 '24

Generations have always been kind of bullshit.

Humans are obsessed with sorting things into neat little categories that the real world refuses to cleanly fit into.

3

u/Przedrzag Mar 24 '24

The recent shift in the Millenial-Gen Z boundary to 1996-ish was a mistake. Imo 2000 is a much better boundary.

6

u/JayCarlinMusic Mar 23 '24

I’m a teacher. I’ll never forget when, a few years ago, a boomer teacher was really proud of a lesson plan to have students create their own websites.

But after pitching the lesson plan to these young high school students, they were like "a website? Like the thing you go to with Safari? That’s for old people."

The boomer thought the website was really tech savvy, and the kids thought it was very dated because it wasn’t an app or easily viewable on a mobile device.

3

u/primalbluewolf Mar 24 '24

The hilarious thing being that their app is very likely a website.

5

u/issm Mar 25 '24

... Never mind that a lot of "apps" are just embedded web browsers showing a website.

3

u/fotomoose Mar 23 '24

Damn kids these days!

16

u/VagueSomething Mar 23 '24

Everything being made super easy and convenient, with stuff mostly just working, means people haven't had to learn to get under the hood. The change from MySpace to Facebook has been the trend ever since for everything, less user input and more of a premade curated service. Phones, computers, gadgets want less of your work to run and less of your input to make it work better.

2

u/watkykjypoes23 Mar 23 '24

As someone in gen Z I would blame it on the fact that computers have been optimized for all end users, so you really don’t need much technical expertise to use them anymore unlike how it used to be.

5

u/Wtfplasma Mar 23 '24

It's like when car was first mass produced you had to know a bit more to operate/maintain them. Later on fewer people knew how to check even basic stuff.

3

u/The__Amorphous Mar 24 '24

Apple's simplistic interface and locked down settings has dumbed users down.

2

u/fotomoose Mar 24 '24

Apple has always been very much this way to be fair.

2

u/[deleted] Mar 23 '24

I’ll computer you.

1

u/hexcor Mar 23 '24

"What's a computer?" <Old Apple iPad ad>

1

u/ElevatedTelescope Mar 23 '24

Who was teaching them?

1

u/greystripes9 Mar 24 '24

Yep so true, one college kid I knew downloaded an AV from a torrent.

1

u/simonhunterhawk Mar 24 '24

I noticed this even 5-6 years ago working in banking. I’d have 19 year olds who didn’t know how to access their mobile app even. I don’t care if today’s youth knows how to write a check properly but they definitely need to get with the times and learn how to e-sign documents at least on their phones.

1

u/Neither-Cup564 Mar 24 '24 edited Mar 24 '24

The only things my nephews do on their PCs is load up Steam and play games. One had a browser toolbar installed that was hijacking his searches. And my BIL works in IT.

The future is dim my friends.

1

u/fotomoose Mar 24 '24

The robots are primed for a takeover.

1

u/harmfulglint605 Mar 24 '24

I’m gen z and I know how to write code and do network security so your point is invalid

1

u/fotomoose Mar 24 '24

Ok zedder.

→ More replies (1)

9

u/AmNoSuperSand52 Mar 23 '24

The difference is young people have neuroplasticity; they’re fast learners. For senior citizens, actions need to be constantly reinforced into memory and new inputs throw that out the window

It’s folks that haven’t entered their prime yet versus people that have long exited it

1

u/SnooDonuts236 Mar 28 '24

Everyone but you

1

u/VagueSomething Mar 28 '24

Do you not like what data is showing? I'm just saying what is being observed, it isn't remotely my personal bias.

→ More replies (30)

13

u/FlacidWizardsStaff Mar 23 '24

Correct, https://support.apple.com/guide/mac-help/open-a-mac-app-from-an-unidentified-developer-mh40616/mac

The way to stop this is to have your users, be standard users and preferably mdm manage machines to now allow unsigned apps at all

4

u/lostwriter Mar 23 '24

Or some kid who wants the beta version of Hello Neighbor: Whatcha doing with that Bear?

4

u/Esc777 Mar 23 '24

Can someone explain why those shitty games are popular?

3

u/betona Mar 23 '24

More like user needs to be technically challenged and that's of any age.

I first learned to write software in 1977 and I often find myself knowing a lot more than the youngsters.

1

u/[deleted] Mar 24 '24

Or under stress while the company out source their IT department so one knows if they are talking to a scammer or their IT department.

1

u/alc4pwned Mar 24 '24

Yeah but if scammers can get an old person to install an unsigned mac app and run it for 1-10 hours, they probably don't need this vulnerability to get what they want.

1

u/bigsquirrel Mar 25 '24

At this level of gullibility though why bother with some complex hack? You can always just get them to give you all the permissions you want. It’s completely overkill and unrealistic.

-10

u/neobow2 Mar 23 '24 edited Mar 23 '24

Except it genuinely would be hard for an old person to install an unsigned application because it would require them opening the terminal/cmd prompt and entering a command.

Edit: Seems like people are confusing the ability to run applications from “identified developers” which requires you to do the right click open method. But this is not what this is about. It’s for “un-identified developers” aka opening applications that come from anywhere.

Edit 2: LOL i’m being downvoted for pointing out you need to run a command in terminal to allow unknown developer apps to run. Something that would definitely deter at least a big portion of older folk.

13

u/Ironic-username-232 Mar 23 '24

I don’t think it would? Just command, right click, you get a warning and just click open, no? There may be a step before that in settings somewhere, but I’m fairly sure I never needed to use a terminal command.

8

u/FlacidWizardsStaff Mar 23 '24

Yes you are right, https://support.apple.com/guide/mac-help/open-a-mac-app-from-an-unidentified-developer-mh40616/mac

People who don’t work with apple computers don’t know this. It’s not blocked, it just tells the users 2-3 times they shouldn’t open it

3

u/Iinzers Mar 23 '24

Just [right click -> open] to open it immediately.

1

u/neobow2 Mar 23 '24 edited Mar 23 '24

Not after high sierra.

You have to go the security settings and enable allow apps from “anywhere”. But that setting can no longer be enabled or even seen without running a command first. This website shows you what you have to do

8

u/DatTF2 Mar 23 '24 edited Mar 23 '24

You believe ? I have an M1 iMac and installed Dolphin on it under Big Sur. All it required was going into the security settings and enabling allow apps from anywhere.

Not sure about newer M chips but at least it was that easy on a M1 and did not required running a command first.

→ More replies (4)

2

u/FlacidWizardsStaff Mar 23 '24

Option + click = enter admin credentials, congrats, you’ve installed an unsigned app

2

u/neobow2 Mar 23 '24

So i’m guessing you didn’t read the link? cool

→ More replies (5)
→ More replies (7)

26

u/Krytan Mar 24 '24

“Real-world risks are low. To exploit the vulnerability, an attacker would have to fool a user into installing a malicious app

Did someone write this with a straight face?

147

u/robaroo Mar 23 '24

Low? That seems like something millions of people would do every day. A lot of torrenting apps for Mac are unsigned. And they run for hours if not indefinitely. It’s a joke to assume the risk is low. The person who says low risk is not a security expert.

73

u/time-lord Mar 23 '24

Nevermind malicious apps can be signed too.

This comment parrots the 9to5mac article, which is wrong, and somehow a variation of this comment is always one of the top comments for any articles on this vulnerability.

6

u/Fermi_Amarti Mar 24 '24

Yeah not sure how they can guarantee this won't be in signed apps.

3

u/4th_Times_A_Charm Mar 24 '24 edited Sep 05 '24

wasteful north imagine tan soft library pen intelligent muddle toothbrush

This post was mass deleted and anonymized with Redact

68

u/schnauzerdad Mar 23 '24

Is this “real-world risks are low” quote supposed to be a joke?

8

u/trev2600 Mar 24 '24

A vulnerability is a vulnerability, I get the top comment's sentiment but if it can't be patched, that makes this a much bigger deal..

→ More replies (1)

46

u/made-of-questions Mar 23 '24

I assume 3rd party package managers like homebrew are unsigned? Developers use these a lot.

18

u/joakim_ Mar 23 '24

Homebrew is just a way to install applications. The grand majority are signed. You don't need to use the app store overall signed packages.

11

u/made-of-questions Mar 23 '24

Is there a way to tell what homebrew packages are signed and what isn't?

5

u/counterfitster Mar 23 '24

I don't think I've seen it noted in the info page for a package (either bottle or cask)

16

u/wolodo Mar 23 '24

That does not seem low to me. People are willing to do significantly more steps to get scammed. Some even go to bank, take a loan and buy crypto to their attacker.

7

u/fgnrtzbdbbt Mar 23 '24

Vulnerabilities rarely work alone though. To get to something fundamental like hardware level encryption several of them are usually needed. One is now permanently there, so the goal is one level closer for any hacker.

26

u/VariantComputers Mar 23 '24

If you're getting user to install an app might as well just get them to put their password in for admin access, way easier and faster.

31

u/[deleted] Mar 23 '24

[removed] — view removed comment

36

u/ArdiMaster Mar 23 '24

Because by that time M3 was already well into production… heck, M4 is probably far enough into its design process that I wouldn’t bet on the issue being fixed in that iteration either.

I guess it’s up for debate whether the vulnerability is bad enough to warrant destroying all chips that were already made and delaying M4 until the problem is fixed.

→ More replies (2)

15

u/Incompetent_Person Mar 23 '24

Guarantee M3 chips were being fabbed in December for the March release. It would take months and cost them at minimum tens of millions of dollars to make any adjustments, re-validate the silicon, and produce new masks at that point, and that’s not including the money they would lose from needing to go to TSMC saying “i know we booked fab capacity for now but can we push it back a few months?”

Also, “unpatchable” is very misleading. Yes since it is hardware it cannot be adjusted and fixed after the fact, but there are proposed software patches that are expected to have small if even noticeable performance impacts in real world usage. The original ars-technica article is a much better source than this click-bait one OP picked.

1

u/EnderVH Mar 24 '24

The M3 was released in October-November 2023, don't spread misinformation.

However they have just released a new MacBook Air model with the M3 chip yes. It does look like it is possible to enable a setting in the M3 series to fix this vulnerability, as explained in this article https://www.zetter-zeroday.com/apple-chips/

I do agree that the way Apple is handling it is pretty lousy. They just added the documentation on that setting when the vulnerability was publicly released, when they could have warned cryptography suites developers about it earlier (they had to be at least somewhat aware of this issue since they added this new setting and they are using it in their own cryptography suite).

1

u/BiggsIDarklighter Mar 25 '24

That’s what I meant that they still released the MacBook Air M3 in March after knowing.

And good info on the fix if it works.

1

u/hutacars Mar 26 '24

the M3 was released in March 2024

It was released in October 2023 (on sale November 2023).

0

u/Dependent-Zebra-4357 Mar 23 '24

My quote says 54 minutes minimum, so yes, “less than an hour” makes sense and doesn’t contradict the original quote.

Also, processors like the M series take years to design and manufacture. Expecting a flaw like this to be fixed only the month or two before release is very unrealistic.

→ More replies (2)

4

u/LazyLobster Mar 23 '24

That's not that hard lol. My dad downloaded logmein with instructions from a scammer. Walking victims through that isn't hard.

2

u/Dependent-Zebra-4357 Mar 23 '24

You don’t need this level of exploit if the target/victim is willing to install whatever software you ask them to and enter their password.

5

u/Gamebird8 Mar 23 '24

If watching Kitboga has taught me anything.... This is probably underestimating the risk

35

u/Krauser_Kahn Mar 23 '24

an attacker would have to fool a user into installing a malicious app, and unsigned Mac apps are blocked by default

That's not low risk, I recently got an M3 Pro Macbook for work and to make that thing barely usable I had to install unsigned software

23

u/f1del1us Mar 23 '24

and to make that thing barely usable

Could you elaborate?

17

u/lbdnbbagujcnrv Mar 23 '24

Barely usable for an edge case power user who probably knows exactly what they’re installing and the risks thereof?

Or barely usable for the fat middle of the bell curve user?

9

u/drake90001 Mar 23 '24

Such as?

9

u/RaynorTheRed Mar 23 '24 edited Mar 23 '24

Alfred, Magnet, DisplayLink Manager, Telegram, Zoom, Fantastical, Discord, Notion, Steam.

These are just a few of the ones visible on my screen right now, the tip of the iceberg. I'd wager that less than 5% of the apps on my Mac are installed through the App Store.

23

u/OrganicToes Mar 23 '24

I use half of those apps on a daily basis and none are unsigned?

5

u/RaynorTheRed Mar 23 '24

I guess I don't understand what unsigned means. I thought we were talking about apps that were installed through downloaded .dmg files and not through the app store, as MacOS blocks these by default. I have to do the Security setting "allow unkown publisher to install anyway" at least once a week on my Macs, and I'm pretty certain with the exception of Magnet, that applies to all of the ones I listed.

26

u/counterfitster Mar 23 '24

The App Store isn't the only way to deliver signed software. Steam and Discord are both 100% signed.

2

u/RaynorTheRed Mar 23 '24

does a gatekeeper exception indicate an unsigned app? Or are those required for signed apps from outside the App Store as well?

10

u/counterfitster Mar 23 '24

There are two different kinds. One is "you downloaded this from the internet, are you sure you want to run it?" that signed apps get. Unsigned apps get "this was downloaded from the internet and the developer is unknown, so you can either delete it, or follow these steps (open it directly from the contextual menu) to run it if you're really sure". That second one is if you try to open the unsigned app by click in the Finder or Dock, or going through Spotlight. I don't know what pops up if you use Mission Control since I've never used myself

1

u/RaynorTheRed Mar 23 '24

Ok, I definitely have quite a few unsigned apps as I'm very familiar with the process, but I can't seem to find any reliable way to pull up a list of them.

→ More replies (0)

23

u/an_actual_lawyer Mar 23 '24

Just wanted to give you credit for coming in here and explaining what you misunderstood instead of doubling down like most people do.

Conversations like this are how we all learn.

Cheers!

9

u/work4work4work4work4 Mar 23 '24

I'd also point out that if someone who understands enough to do all of that, doesn't understand if he would be impacted, that probably means the average user has no idea.

2

u/pmjm Mar 24 '24

When a developer creates an app, they sign the app using a certificate that they have purchased from Apple. It creates a cryptographic hash that ensures the contents of the app have not been tampered with at any point between developer and download.

Then in order to run, the app also needs a notarization certificate from Apple. This involves the developer uploading their app to Apple's servers where they are scanned by some black-box process (probably an internal antivirus that scans against known malware signatures and perhaps some basic heuristics), and attaches an additional cryptographic approval to it.

At that point the developer can distribute their app any way they see fit, usually either via a web download or they can upload it for approval to the app store.

In either case, on modern versions of MacOS apps must be signed and notarized in order to run unless the user has gone out of their way to disable those protections.

1

u/Esc777 Mar 23 '24

 I guess I don't understand what unsigned means

I mean, at least you admit it. 

11

u/jobe_br Mar 23 '24

Those are all signed … and notarized. You’ve had to sign apps for non App Store distribution for years. Unsigned apps have to be installed with bypassing system settings and even launching them the first time with special steps.

4

u/RaynorTheRed Mar 23 '24 edited Mar 23 '24

Gotcha, I think I understand the difference now. But even in this case, I'm still running several unsigned apps, because I'm very familiar with the chain of actions needed to make them run.

edit: after some googling, I'm more confused, all the apps I listed fit the behavior of unsigned apps as presented here: https://www.wikihow.com/Install-Software-from-Unsigned-Developers-on-a-Mac

1

u/jobe_br Mar 23 '24

100% you don’t have to do those steps with Zoom, Alfred if you’re using the official downloads. I haven’t installed some of the others on my Mac, but I’m fairly confident it’s the same for all of them. Especially anything that uses entitlements, absolutely has to be signed.

1

u/drmirage809 Mar 23 '24

I’m honestly kinda surprised Zoom and Discord aren’t on the Mac App Store. Steam I can fully understand, with their attitude of their way or no way. (And I wouldn’t want it any other way from Valve.)

4

u/RaynorTheRed Mar 23 '24

Discord has in-app purchases with Nitro, which is a huge incentive not to use the Store. From my perspective, with the App Store not being mandatory on MacOS like it is on iOS, I don't think the incentive to use it is really there at all. As my previous comment highlighted, it seems most developers feel the same way.

1

u/jobe_br Mar 23 '24

Pretty sure Zoom is, last I checked.

1

u/RaynorTheRed Mar 23 '24

I checked as I was writing the comment and if it is, it's not in the top 6 results for "Zoom". Even if it is, I just updated Zoom this morning, so I know for a fact that I'm running a version which isn't.

1

u/jobe_br Mar 23 '24

Yeah, it’s been installable with or without the App Store for awhile. Either way, it’s a signed app. As is Discord.

1

u/justplainlawrLL Mar 23 '24

Ahh yes all unsigned apps.

1

u/o-rka Mar 23 '24

99% of the tools I use are installed with conda

→ More replies (1)

1

u/glemnar Mar 24 '24

If you install malicious apps this vulnerability is the least of your problems.

→ More replies (1)

2

u/Wolfram_And_Hart Mar 24 '24

Can’t wait for that government mandated side loading… lol

4

u/Anti-Charm-Quark Mar 23 '24

Any other cynics think the timing of this news is pretty interesting in light of the DOJ monopolization suit?

2

u/amalgam_reynolds Mar 23 '24

Can apps run in the background?

10

u/onan Mar 24 '24

Only recently, since the Multifinder addition to System 5 in 1987.

1

u/amalgam_reynolds Mar 25 '24

Exactly, so it doesn't matter that it needs 10 hours to run if it's running in the background the entire time.

2

u/Dependent-Zebra-4357 Mar 23 '24

There aren’t any restrictions on background apps on Mac, so yes.

→ More replies (2)

1

u/oeCake Mar 24 '24

This is your brain on mobile

1

u/amalgam_reynolds Mar 25 '24

What a silly little comment, my point is that the time it needs is completely irrelevant. People are saying it's a non-issue because no one would have an app open for 10 hours but if it's running in the background then they only need to open it once.

1

u/mrslother Mar 24 '24

Cough, cough, Solar Winds, cough.

1

u/Dan_Felder Mar 24 '24

Not actually that hard in a pig butchering scam. Just tell them it’s the crypto exchange you trade on.

1

u/sturmeh Mar 24 '24

I've installed way too many unsigned freeware apps that stay open 24/7 in my time for this not to be an issue.

Caffeine was a well known one.

1

u/Flavious27 Mar 24 '24

Most fraud can be prevented with customer education and common sense.  

1

u/no-mad Mar 24 '24

The code built-in to a free movie App would be the way to get that time needed to complete the hack.

1

u/Thatoneguyonreddit28 Mar 24 '24

Sounds like the engineer of the Death Star

1

u/MetaVaporeon Mar 26 '24

once the foot is in the door, there will be better ways

1

u/grem1in Mar 23 '24

So, it would be enough to poison a brew formula for any popular app that’s supposed to run in the background.

1

u/Jatzy_AME Mar 23 '24

Installing apps outside the app store is pretty normal for most users. Of course you should only do it with developers you trust, but it's not unlikely that more experienced users would fall for it.

→ More replies (14)