Apple M1 Macs and Windows PCs Are Vulnerable to New HTML/CSS Hack

IDropNews ^ | March 16th 2021 | Kelly Hodgkins

[Swordmaker]

Security researchers from Cornell University have found a web browser attack that affects both macOS and Windows computers. Unlike other browser-based attacks, this one does not use JavaScript.

The hack is the first JavaScript-free browser side-channel attack ever discovered. Rather than using the popular scripting language, the exploit was built entirely with CSS and HTML.

Though new, Apple’s M1 chipset is not protected from this attack and maybe more vulnerable to this exploit, claim the researchers in a recently published paper (via AppleInsider).

It is described as being “architecturally agnostic” attacking Samsung, AMD, and even Apple’s new silicon, says The 8-Bit blog.

In fact, Apple’s M1 chipset may even be more vulnerable to this attack.

“Ironically, we show that our attacks are sometimes more effective on these novel CPUs by Apple and Samsung compared to their well-explored Intel counterparts, presumably due to their simpler cache replacement policies.”

Cornell University Researchers

This exploit is particularly effective as it will work even when a user locks down their browser by blocking JavaScript. It also ignores privacy technologies like Tor or a VPN that are meant to keep your browsing information safe.

The vulnerability potentially could spy on a user’s web activity and share that information without the user’s consent or knowledge.

Most users believe they are always safe after blocking JavaScript and using a VPN, however, this attack shows that even these measures are not foolproof and may provide a false sense of security in some instances.

[bitt]

p

(even a VPN...)

[linMcHlp]

Suggestions

Go to https://www.ccleaner.com/

Download the FREE CCleaner.

When installing CCleaner, DO NOT ALLOW any extras - included package such as Google Chrome or some anti-virus application, to also install.

You only want CCleaner.

So, when installing CCleaner, read each window (that you can) that presents info re the installing process.

You do not need CCleaner Pro, nor a “cloud” feature/connection.

CCleaner is valuable for one objective: cleaning cache files and removing run-of-the-mill cookies.

CCleaner documentation: https://www.ccleaner.com/docs

CCleaner settings: https://www.ccleaner.com/docs/ccleaner/ccleaner-settings

Run CCleaner at least once, every day that you use your Lenovo ThinkPad. Then restart your computer.

[Swordmaker]

I don’t want to dismiss or diminish the problems of malware in technology today. But, aren’t most - or at least many - of these kinds of exploit warnings largely theoretical in nature?

That’s what I think this is. . . an obscure vulnerability that could possibly be a risk. They say nothing about "exploits."

[Swordmaker]

This is once again some hacks getting their masters thesis by writing papers on stating the obvious.

Kinda what I figured. It’s also FUD Season, especially that part about Apple’s M1 chips perhaps being more vulnerable. Apple is soon to announce new iMac and other hardware which is always preceded by a FUD Season.

[Swordmaker]

In before the “Buy a ?” squad....LoL

What are they going to tell us to buy... they seem to say this will attack everything that uses a browser including probably a Commodore Vic 20...

[Swordmaker]

Hmmm, which browser?

Uh... ones that render HTML? They aren’t too keen on providing little niggling details such as what it does, how, on what browsers, etc. that’s why I’m not too worried... I think it’s a vulnerability without much specificity...

[Sir_Ed]

Well this is spooky!

Thanks, Swordmaker!