Home

Podfeet Podcasts

Security Bits logo - a green padlock with the words Security Bits to the right and in tiny letters below ithat it says 10101010 indicating a digital lock

Security Bits — 2 February 2025

  • by Bart Busschots
  • 2 Comments

    • Feedback & Followups

    • Updated Advice from Bart: back in 2019 I recommended the anti-malware not-for-profit DNS provider QuadNine (9.9.9.9) on the NosillaCast, I had been using it on my router since then, but not anymore, their service has been degrading, and it got so bad this week I switched to CloudFlare’s 1.1.1.1, if you are using QuadNine and have been having slow internet unexpectedly, consider following suit!

    Deep Dive — New Speculative Execution Attacks against Apple Silicon (SLAP & FLOP)

    _TL;DR for now, the real-world risks appears to be low, and there is nothing users can do at the moment. Apple are monitoring the situation, so urgent patches may be forthcoming in the future.

    Since the infamous Spectre and Meltdown vulnerabilities first brought the concept of speculative execution to our attention way back in 2017 we’ve seen a parade of these kinds of CPU optimisations that can lead to inadvertent data leaks. Most of these bugs have affected Intel CPUs, but there have been some affecting AMD and Apple processors too.

    The majority of these vulnerabilities are only a real threat in shared hosting environments, where it’s normal for unrelated processes to share a CPU, and where any cross-process leaks are a really big deal. This has resulted in cloud providers being forced to implement fixes and workarounds that generally result in substantial performance losses per-CPU. For home users the performance trade-offs are generally not worth it because only our stuff should be running on our devices. These bugs hence usually fall into the “if you have malware on your machine …” category.

    But, a small subset of these bugs have required urgent patches for everyone, usually provided through OS and/or browser updates because they could be exploited via JavaScript, so just visiting a website could leak sensitive data from your device.

    That’s unfortunately the category a pair of newly detailed Apple-specific vulnerabilities fall into.

    Security researchers have now publicly disclosed a pair of speculative execution bugs affecting newer Apple Silicon chips which they’ve named SLAP and FLOP because they abuse CPU features named LAP and LOP which predict future memory access calls.

    To illustrate the danger the researchers have demonstrated the flaws being used in a browser, with a malicious web page successfully extracting secret information from other open tabs in 10 minutes.

    The flaws were responsibly disclosed to Apple last summer, but as of yet there are no patches. Apple have said they are monitoring the situation, and that it has observed no real-world attacks. We can only assume that if real-world attacks emerge Apple will act.

    For now, we regular folks just need to sit and wait, knowing we may need to patch urgently sometime in the future.

    For high-risk users there is one more concrete suggested action — enable lockdown mode to massively harden the OS in general and Safari in particular (at the cost of functionality!)

    Links

    ❗ Action Alerts

    Worthy Warnings

    Notable News

    Top Tips

    Palate Cleansers

    Legend

    When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    📊 A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
    💵 A link to an article behind a paywall.
    📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.
    🎦 A link to video content.

    2 thoughts on “Security Bits — 2 February 2025”

    1. Ferrers - February 3, 2025

      You went to CloudFlare’s 1.1.1.1 service — I would have thought you’d have gone to 1.1.1.3 or 1.1.1.2 for the malware protection…?

    2. Bart Busschots - February 4, 2025

      Good point @Ferrers — will do a quick follow up next time.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top