Interestingly, attackers do not need to install any programs on your computer or force you to open infected files. just necessary luring the victim to a site where a special script is activated. It opens another page containing malicious code in the background. Hackers demonstrated the work of “iLeakage” using the example of hacking passwords automatically saved in Safari, as well as Gmail accounts. In iOS, it was possible to achieve data leakage not only through the standard browser, but also through browsers of third-party companies.

Detail

The threat reportedly affects all iPhones and Macs equipped with A12Z, M1 and newer processors. Protective measures against vulnerabilities in the processor Specter and Meltdown do not help in this case.

Features of “iLeakage” include:

• Security bypass in Safari on A and M chips using data type misinterpretation vulnerability.
• A timeless attack technique.
• A unique feature of WebKit to group sites from different domains into a single process using the “window.open” JavaScript method.

Experts say that due to the high technical complexity of the attack method and the need for in-depth knowledge to implement it, the risk of actual use in the near future remains low.

Apple is expected to take action and release security updates before the vulnerability becomes a real threat.