All Apple Products are Vulnerable to New Password Stealing Hack

[@collectorguy3919]

In 2023, advertisements are STILL a vector for malware. An ad-blocker is essential for security.

[@Seytonic]

The FBI approves this message

[@kenosabi]

Google knocking your door in ..in 5 ..4...3... GIVE US THE AD REVENUE

[@UKsystems]

Reader has the one you use as some can contain malware

[@benchy5769]

Google did things like this and they ask why people use ad blockers

[@OcteractSG]

It’s close to a full year since the first news broke about malware in Google ads, and it’s for Free software again! At what point do we call this lack of action to fix the problem malicious on its own? I think now is a good time.

[@SpaceshipOperations]

>At what point do we call this lack of action to fix the problem malicious on its own It has been the case for decades. There are many verified leaked documents about how the NSA stalks, harasses and threatens software engineers (including, for example, those in committees responsible for shaping networking standards) in order to force them to make their software/standards vulnerable, so that governments can hack you whenever they want.

[@notaplic8158]

Malware ads have been around since pretty much the invention of Internet advertising

[@ILoveTinfoilHats]

Frauds and scams are the bread and butter of advertising. Ad pay is directly correlated to gullibility. Why do you think "adult content" pays so much...

[@c1ph3rpunk]

It’s been close to 2 decades since this concept has existed, deal with it.

[@RadikAlice]

Man, I feel bad for you. Pretty much all replies are missing your point or dismissing it outright

[@velociraptor5962]

Great... Just after I get my first iPhone in 10 years. 😂

[@pootispiker2866]

What happens on your iPhone, stays on my iPhone

[@jimmypatton4982]

Just don’t visit malicious websites and don’t hang out with prankers. Though I would give the same advice to android users, so nothing new just annoying.

[@jhonwickmex]

Should have stayed with what you had

[@NeoNyaa]

Your fault for going apple

[@mayorplayz]

@@jhonwickmex Even androids have exploits lol

[@matteovalentino4890]

To be fair, I read the paper, the practical application of such an exploit is incredibly difficult, it takes forever to steal strings, and it took years to a research team to obtain something, I'd say we good, majority of threat actors nowadays are kids that make DDos attacks or RaaS to make a quick buck

[@inthefade]

Even if it is incredibly difficult, that is barely a hindrance to state actors; They have the best talent and infinite resources.

[@prcvl]

perfect for country funded hacking teams

[@varram3488]

hahahhaha so true about the majority of the threat actors part

[@MVPMTKING]

​@@inthefadeno such resource on earth is infinite, water, time, food, electricity, people. But they do have a helluva lot in terms of CySec.

[@matteovalentino4890]

@@inthefade I mean on that level let's be honest, state level threat actors probably have a huge supply of zero days and surely they don't need a year old exploit, let's remember that counties are the main customers of the NSO group

[@khoanguyen0001]

Good news: Lockdown Mode can mitigated this kind of Safari attack. 🎉

[@tech1238]

Apple have been battered with CVE’s in the last 1-2 months. Time have changed

[@jimmypatton4982]

iOS is probably the most common operating system if you look at single code stack. Android while having more phones has more code stacks and hardware stacks, so exploits can be limited in scope.

[@redbakery8943]

That's nothing new, they have been for years now. Look at the iOS security patch notes.

[@tech1238]

@@redbakery8943 Whilst that is true, If you look specifically at macOS, there has been a large amount of patch releases for macOS Monterey and Ventura, plus the additional Safari patches.

[@somnia3423]

@@jimmypatton4982yeah android phones are much safer

[@camelotenglishtuition6394]

1-2 years

[@klaudyw3]

With regards to the keepass thing, the reason why that special K would get around that domain check might be quite simple - it boils down to how you deal with string comparisons. Different languages function differently, and I'm not going to pretend that i know what Google is doing, but here's what I think is going on. In a lot of cases you don't want to consider all the weird ways in which people might mess with text, so you get the option to ignore certain things when doing a string comparison. As a quick example, here's some Romanian letters: Aa Ăă Ââ. The first pair is just a normal A, but the other ones are slightly different. When you do a string comparison, you don't really want a strict comparison. Keyboards don't come with those letters out of the box, and most people will never even bother knowing how to type them (i copied them from Wikipedia). To deal with situations like this, you get a not so strict comparison going. In this case, my guess is that Google is using that not-so-string comparison when checking the domain name, leading to that issue. There's a lot of conference talks about text encoding, and they go into a bit of detail on how things work, how things are broken, and depending on what you look at how it can break things further. A lot of them are fun to watch, so if anyone's interested give it a search.

[@SaHaRaSquad]

Not to mention there are many letters/symbols which even look exactly identical but are actually different. For example A and А are not the same letter: the second one is from the cyrillic alphabet and looks different in binary.

[@ivanv754]

So it’s like the tilde in Spanish. It’s supposed to be there but people don’t type it a lot of the time. You don’t want to tell Simón that Simon is not his name. Simon will be the name in his ID in fact, but his school diploma will say Simón.

[@mastermach50]

Like matching Pokémon and Pokemon for easier searchability?

[@williamchamberlain2263]

Is this the unicode thing again? That the visible glyph isn't the same as the encoding

[@gershommaes902]

A nice word you might be looking for is "homoglyph"

[@free4fire]

Bu...but Apple products can't be hacked or get viruses, the cool hip guy in the commercial said so, only those PC nerds can get those! XD

[@everyhandletaken]

😂

[@shadyheadstash]

I spent all morning learning about WGPU and WASM and then immediately learn WASM is being used for hacking, because of course it is.

[@Oliver_Atkinson]

Tbf AFAIK all code gets used for hacking at some point

[@mythicXD]

I wonder if anyone with an amplified Bluetooth signal would sit near Apple HQ till they fix the bug?

[@chri-k]

it's not really fixable

[@MelaninMagdalene]

@@chri-k What’s the reason for that?

[@chri-k]

@@MelaninMagdalene This exploit via WebKit may possibly be fixed, but the underlying bug is in the hardware.

[@stayblueee]

@@SpookySkeleton738 the original comment was not about the speculative execution part of the video

[@SpookySkeleton738]

@@stayblueee 💀

[@twistedsaltypretzel7727]

To be fair, a router with "Free Apple WiFi" would allegedly net a shitload of apple ID creds :/

[@NeuroNinjaX]

Let's wait until ChatGPT reads the paper... lol

[@UKsystems]

It refuses harmful tasks

[@coolhandle572]

The media is already blowing this out of proportion. I am already imagining all of the tiktoks people will make.

[@mo4503]

This hack is not new. This has been around since 2017 or 2018. It was found on Intel CPU’s. It is the same method though. The CPU does what it think you’re about to do before you do it by your habits. It memorizes your habits over time and try’s to save small amounts of time for you.

[@GrishTech]

Another good reason to never allow auto password fill by password manager s. On my ios device, I specifically have to press a login for it to be autofilled.

[@schwingedeshaehers]

Does that solve the problem?

[@auto117666]

3:19 I can hear people in the reversing community say, “challenge accepted”

[@edsmith3052]

Awesome video, I like that you’ve gone back to the multiple topic videos. It’s great to be able to watch one video and get an overview of important cybersecurity issues. As always, keep up the great work.

[@Seytonic]

Thanks :)

[@cwaldrip]

It's been a year without a patch, doesn't mean Apple isn't working on a fix. As pointed out it's a CPU issue so they're probably working on a balanced solution that doesn't completely eliminate the benefits of speculative execution but still try and mitigate the exploit. 🤔

[@Jaxx7594]

Techryptic isn't the guy who found the bluetooth DoS. He stole the work of the Flipper Zero Xtreme dev team. Please, credit the right people. If you wan't, I could link you a blog post from the Xtreme team proving it all

[@dil736]

Google owns KZbin? KZbin doesn't want me to use an ad blocker lol.

[@bsdims]

Shoutouts to cars where their stereo/speaker system only accepts Bluetooth pairing, no headphone cable for you, pisses me off. I can't wait for modern-day manufacturers to regret that choice due to Flipper0 nonsense & general security holes. Never liked Bluetooth, both as a consumer (pairing annoyances, battery-life to deal with, etc.) & as a security-minded fella. The only way you can disrupt wires is by wear & tear, and/or the chord being cut in two. AUX4Life, & oh yeah, same goes for modern smartphones too, courage my ass.

[@skywizard3319]

finally... i really need these videos to be more frequent, even if you're covering dumb things

[@Chuck8541]

The more apple works with governments, the more hacks seem to be getting through. Funny how that works.

[@programateiro]

1:23 - I didn't knew `speculative execution` was a thing and CPUs jumped into the if statement just to later evaluate it's value: this is massive security issue imho

[@Aizemiyo]

Just another name for prefetching, it is originally employed to improve cpu performance, security wasnt really a big thing back then.

[@ifur]

Bye bye iCloud Keychain?

[@jimmypatton4982]

It doesn’t matter if keychain or manually typing. As far as I could tell they are putting in long to execute statement to have as much data pre-gussed generated. Grabbing the data and then repeating if possible or just giving up. I think what matters is adding code to prevent the exploit from leaking one source of data to previous site.

[@bazzeil]

We tried the ddos bluetooth attach at work, it doesnt seem to work against samsung devices, and only the HP laptop in the office got the notifications. The Apple branded devices were hosed by this.

[@AWriterWandering]

This is why we can’t have nice things

[@FellowGEEK-mi4tw]

Looks like there is a fix inplace for iLeakage at least on my MacOS the feature flag for "Swap Processes on Cross-Site Window Open" was enabled for me. now checking if iOS Safari has this

[@FellowGEEK-mi4tw]

Yep enabled in iOS too, so they fixed this when?

[@ardwetha]

Why does this exploit with apple kinda sounds like specter. Both exploit the specular execution and then read data from memory, even though the languages normally don't have features for this.

[@QuantariousBitsoniTalvanen]

Finally, I can tell everyone who swears by the security of apple's products that they can suck it. At least till they find a patch.

[@atirutwattanamongkol8806]

How on Earth can JS access something that low-level?????

[@LetrixAR]

It doesn't. WASM was used.

[@atirutwattanamongkol8806]

@@LetrixAR WASM is a simulated stack machine in a nutshell, so there should still be no way for it to access something so low-level.

[@GizziXZ]

​@@atirutwattanamongkol8806What's WASM?

[@TMinusRecords]

It's a timing based attack

[@samando524]

@@atirutwattanamongkol8806 If you watch the video it includes an explanation. Hope this helps :)

[@johanlugthart7782]

Looks like I am save with my iPhone 8.😅

[@ZoombalaGC]

Thanks, I needed another dose of doom to cure my happiness 😮

[@Krzys_D]

My work only uses Apple cause the owner and IT guy says that Apple has no vulnerabilities 😅 glad I'm the only one on PC

[@brainstem2023]

Duh, don't use a tab that YOU didn't open YOURSELF - either by using a saved bookmark or typing the URL. The only exception is if your browser is set up to open previously open tabs or certain tabs at startup. Popups are NEVER to be trusted unless it's spawned by the website you are using; for example, you click sign-in on your bank's page and a popup opens. That's pretty much internet safety 101. The weak link in internet security is almost ALWAYS the loose nut behind the keyboard.

[@mgord9518]

The pop up is spawned by the website you're using... the attack looks exactly like OAuth, which is required to sign into tons of legitimate websites and your password is never supposed to be readable from it, which is the security vulnerability that's being talked about.

[@SirFancy]

I cannot believe Apple is being defended already. It is not "internet safety 101" to not trust a website that has the green lock icon, is HTTPS, you've verified certs for, and has the correct URL. It is not uncommon for a site to open a popup to complete OAuth. This is Apple's fault, plain and simple. Under no circumstances should another tab have access to the contents of another when the site is completely different and not under their control. By design, this is supposed to be impossible with how the WWW operates, and it should be fixed by Apple, and not just be a "well now this is how it is so be more cafeful". If this is how it is now, then literally nothing can be trusted. So yeah. Apple needs to fix, end of story. Source: CASP+ certified

[@DanielQwerty]

Ever used sign in with google?

[@OGNord]

@@DanielQwertynot even remotely the same thing

[@samando524]

@@OGNord To the average person who has no idea about internet security it would sure seem like it.

[@luketurner314]

9:34 I find hilarious combined with KZbin's war on Ad Blockers

[@Hasblock]

Amazing video as always, Mr. Hedgehog

[@warehousing2953]

Speculative execution introduced in 1:40 is bat shxt crazy and shocking! Who invented this crap? A backdoor for govt?

[@urbanws1234]

lol @ anyone who thinks any computer system is secure.

[@Sound_.-Safari]

Pegasus like 🤤

[@aliabdallah102]

Didn't intel have to deal w this stuff back i 15?

[@Andreasepicgamingr]

Wait so intel based macs are safe?

[@btarg1]

That annoying flipper zero packet looks like it would be hilarious to use against people in public

[@PartlyXenon]

I guess I'm never getting berated again for disabling JavaScript..

[@JustBadMeAndI]

Scaremongering There’s potential but the point is, there is no hacking software using this, so storm in a glass of water.

[@MorningStarChrist]

I find it baffling that apple has its own specter vulnerability.

[@martinlutherkingjr.5582]

Can’t Chat GPT just read that paper and tell a script kiddy what’s going on?

[@iluvpandas2755]

It can

[@iluvpandas2755]

But it will most likely not tell the script kiddy how to do it

[@WiluckGD]

@@iluvpandas2755 (thankfully)

[@whtiequillBj]

every single CPU out there does speculative execution. This is not special to Apple.

[@rimilien]

Yes as explicitly stated in the video

[@prophoenix212]

Isnt it similar to spectre attack on intel cpus? Also for android fans, you can steal data much easier from android and you don’t need those exploits.. 2:05

[@lbgstzockt8493]

Sure sounds like it, which is probably why there is no fix for it yet. Didn’t the spectre fix cause a performance drop in some cases?

[@dealloc]

Yes. In fact I think it would fall under Spectre (also noted by the iLeakage paper) which affected all major CPUs; Intel, AMD and ARM. However, it also seems Safari is a big piece in this in how it apparently shares some memory between tabs when it shouldn't-both Chrome and Safari employs tab isolation, where each tab is assigned its own process-but it seems Safari may still leak some memory, or it could be the OS as well, given that processes should never be able to share resources as they should be in their own memory space.

[@mgord9518]

If it's so easy then how do you do it?

[@LetrixAR]

​@dealloc but this seems to be tied to webkit. How does a rendering technology affects a policy of tab isolation?

[@dealloc]

​@@LetrixAR Was it exploited on other WebKit-based browsers that didn't use tab isolation? So far I've only seen reports on Safari specifically (on macOS). On iOS you can't use WebKit directly,. You use a wrapper API like UIWebView (or rather, the newer WKWebView). It's also not possible for browsers on iOS to spin up additional processes So these restrictions could make it possible for browsers on iOS to be affected by this too due to these limitations.

[@skkskk]

Dude I love your video.its amazing

[@iamagi]

The need to reverse the decision to allow other characters than a-z

[@reoccurcat]

Someone literally used that Bluetooth attack on me today and crashed my phone too

[@alejandroalzatesanchez]

kinda ironic that the example password is: thinkdifferent

[@ong1]

0:13 I misheard Malaysia's😅

[@robeagleR]

Okay so I’ll just blacklist it from my router. 🎉

[@stevengill1736]

Is it detected on the Android OS? ;*[} Oh well, probably will be soon enough...

[@Bobby_0_]

indian aadhar card leaked in dark web tell about that??

[@rocstar3000]

Classic Apple L

[@trthambi1857]

... The percentage of people that can understand the hack, is very small. The actual number of people is in the tens of thousands if not more. So it is likely this hack is being exploited in the wild. Just not on a scale that is a threat to the average person.

[@BPTtech]

Linode got bought by Akamai?

[@Get_yotted]

You didn’t know, it’s been a while already

[@Biggerman159]

YESSS THE WEEK WEB IS BACK

[@mendodsoregonbackroads6632]

So the I leakage hack is just a nothing burger so far. A hacker could get a few bits of information, maybe put together a couple of letters or numbers. Got it.

[@kenosabi]

If all the NK money is sent back for missiles...shouldn't they have a way larger arms program by now..?

[@JuniorSantiago3x]

you lost me at “it uses Javascript” 😂😂😂 under that same context, all devices are always vulnerable when a dumb user click a link

[@InsideOfMyOwnMind]

Interesting that the FBI recommends using an ad blocker while youtube is at all out war with ad blockers.

[@CZghost]

Speaking of "understanding research papers" - most people will simply discard it as too long to read. But don't underestimate those who are determined. Determination is a powerful drive, and while it may take a longer time (a bit risky as it may be patched during this time), somebody might as well be able to piece it all together and start exploiting it.

[@schwingedeshaehers]

It looks like Apple doesn't want to fix it.

[@Kingupon]

umm dont you know this is literally just some Social Engineering thing like it's nothing new that is soo old honestly and people dont fell in this scam often unless they are really really dumb

[@hung8969]

Any way you can do a video on KZbin/Google stimulus scam ads. I get 5-10 a day, using a Ai celebrity voice and stolen footage from random other things to create an ad about getting a stimulus or free healthcare card. They keep getting worse and worse, my grandfather didn’t know they were fake for months till I told him about it. He signed up multiple times, I had to spend a few days checking all of his stuff and changing his information

[@Sashazur]

All the ads I see on KZbin and Instagram are sleazy.

[@H0mework]

I remember the spectre and meltdown Intel 'bug'. I disabled the patch and my computer felt like I upgraded.

[@mollthecoder]

And now a script kiddie can have full access to your computer memory

[@fordprefect859]

that is a bad idea. Modern CPUs are actually optimized to run those patches, and the security implications of turning them off are.... apocalyptic.

[@tezcanaslan2877]

I would only recommend doing this in aging systems with no critical data as you have just left your probably critical computer open to pretty much all remote attacks Turn that on or refrain from angering anybody on the internet.

[@TheOfficialOriginalChad]

@@mollthecoderyou clearly haven’t read the PoCs for them 😂

[@mollthecoder]

@@TheOfficialOriginalChad I have, what are you referring to in particular?

[@Nas_Allie]

Ironic, cannot even open KZbin with ad blocker installed but ads turn on

[@mylesisshort]

the flipper zero thing sends a packet that is the same as the apple tv packet with the last few characters randomized

[@tsukipuppy]

I recently purchased a MacBook then saw this video 😂

[@asdprogram]

intel used to struggle with the same vulnerability, but they appearantly fixed it and it appearantly doesnt really cost measurable cpu performance. I tested it

[@aronm5329]

New cpu are built against meltdown so it's not an issue anymore. The update windows did in 2018 did lower CPUs vulnerable performance by a measurable amount however. Most people might not tell, but it wasn't insignificant

[@asdprogram]

@@aronm5329 I haven't seen any performance difference with my haswell cpu with or without spectre and meltdown mitigation.

[@Irwin.009]

Bowser is taking over

[@christopherg2347]

Speculative execution is starting to be a seriously challenger to buffer over- and underflows as "the most common security vulnerability".

[@Salt00]

Why is KZbin recommending me garbage like this

[@xpower7125]

freak I'm on iphone

[@ninjanerdstudent6937]

I'm glad I never use Safari.

[@WiluckGD]

Ok I’m screwed then

[@awesome_billy_bob]

is it wrong that I clicked on this video to steal my sisters password?

[@joshm3342]

@4:12 Who hires people who refuse to show their face for an interview?

[@John7No]

ugh, nice clickbait title? The problem is that although your video is quite good, and informative if I may say, the clickbait tittle is what puts a shadow to your credibility. All these titles of new exploit shares your passwords etc, do more damage than good

[@camelotenglishtuition6394]

and ppl STILL will say that iOS is safer than android lol

[@crimsonkarma13]

this means nothing to me because i dont use apple, isnt good enough to use

[@aussiemadlad]

DAMN. i gotta warn my mum

[@feuerherz007]

don't worry, i told her already

[@AlanTheBeast100]

A graduate of Clickbait Academy.

[@savagesarethebest7251]

Like how? This just so fucking basic and it is just now going into global conscious awareness? 😬👀😬 I literally discovered the same thing as iLeakage around 2003-2004... But in Firefox back then of course 😬🤪🤨

[@savagesarethebest7251]

Also, you can also see what other Web pages you have been using by Cascading Style Sheets.. I don't use Firefox at the moment of writing but they said that they would disable ":visited" entirely and I hated it. It is more important to me to know how deep into the Wikipedia rabbit hole I am than if someone knows that I've been watching porn. I am a fucking human and I can't fucking expect that my gf is here and awake when I feel like it. So ofc I have to suit myself sometimes.. 🤔 😆

[@everypizza]

All devices have an exploit for passwords bt design: Looking at someone typing.

[@FusionDeveloper]

Ad blockers, aka, scam blockers.

[@AleksLazar]

Yeah I always felt uneasy about Apple’s rendering engine forced use. The irony here does not escape. Also get real with posting NY Times headlines like they have anything to do with reality.

[@redslashed]

Yo I spotted the flipper zero thing in the wild😂

[@j.r.m.s.]

L iPhone users

[@slavakid5336]

bro

[@MiserablePizza]

as a ios user i am Killing myself,,,,,,,

[@mozzapple]

lol I'm glad to have android (and not use sketchy sites)

[@1.4142]

FBI recommending adblock? take that youtube.

[@xproot0]

Spectre for Apple wtf

[@dsfs17987]

Cyrillic lettering on the flipper case, why am I not surprised... 😂

[@iblackfeathers]

i find it strange you're crediting techryptic not furiousmac, salmq, ecto-1a, willyjl et al?

[@Australia_QLD]

so just turn off auto fill and watch for redirects?...

[@SaHaRaSquad]

Or just don't use Safari

[@Aviancorporation]

Wow. Never thought I’d be effected by malware but yup... I fell for it. 😢