While Apple’s M1 processors have helped the Mac reach new heights of performance, some reports have exposed possible security issues with the famous system on a chip. The latest such report comes from MIT CSAIL, where researchers have found a way to defeat what is called the “last line of security” in the M1 SoC.
MIT CSAIL found that the M1 implementation of pointer authentication can be overcome with a hardware attack developed by researchers. Pointer authentication is a security feature that helps protect the CPU against an attacker who has gained access to memory. Pointers store memory addresses, and the pointer authentication code (PAC) checks for unexpected changes to the pointer caused by an attack. In its research, MIT CSAIL created “PACMAN”, an attack that can find the right value to successfully pass pointer authentication, so that a hacker can continue to gain access to the computer.
Joseph Ravichandran of MIT CSAIL, who is the lead co-author of an article explaining PACMAN, said in an MIT article: “When pointer authentication was introduced, suddenly a whole category of errors became “With PACMAN making these errors more serious, the overall attack surface could be much larger.”
According to MIT CSAIL, because your PACMAN attack involves a hardware device, a software patch will not fix the problem. The problem is a larger issue with Arm processors that use pointer authentication, not just Apple’s M1. “Future CPU designers should be careful to take this attack into account when building the secure systems of tomorrow,” Ravichandran wrote. “Developers should be careful not to rely solely on pointer authentication to protect their software.”
Apple announced the M2 chip at its WWDC presentation last Monday, which is a new generation succeeding the M1 series. An MIT representative confirmed with Macworld that the M2 has not been tested for this defect.
Because PACMAN requires a hardware device, a hacker must have physical access to a Mac, which limits how a PACMAN can run. But as a technological demonstration, PACMAN shows that pointer authentication is not completely foolproof and developers should not rely on it completely.
MIT CSAIL is scheduled to present the report at the International Symposium on Computer Architecture on June 18. Apple has not made any public comments, but is aware of the findings of MIT CSAIL. (It is common for researchers to share their findings with the companies involved prior to public disclosure).
PACMAN is the latest security breach discovered with the M1. In May, researchers at the University of Illinois at Urbana Champaign, the University of Washington, and the University of Tel Aviv discovered the Augury defect. Last year, developer Hector Martin discovered the M1RACLES vulnerability. However, these defects have been considered harmless or are not a serious threat.