Eden

Apple

Zero

<p class="is-style-lead">Apple has found itself under the microscope of the crypto community twice recently. What are the implications of these events?</p> 
<p>In a recent turn of events, <a href="https://crypto.news/tag/apple/">Apple</a>, the tech giant, finds itself in the crosshairs of the crypto community, not once but at least twice.</p> 
<p>The first blow comes in the form of a sophisticated side-channel attack called “<a href="https://gofetch.fail/" target="_blank" rel="noopener">GoFetch</a>,” which has exposed a vulnerability in Apple’s M1, M2, and M3 processors.&nbsp;This exploit can pilfer secret cryptographic keys residing in the CPU’s cache, leaving sensitive data susceptible to compromise.</p> 
<p>A group of seven researchers from various universities in the <a href="https://crypto.news/tag/united-states/">U.S.</a> developed GoFetch and reported their findings to Apple.&nbsp;However, the nature of this hardware-based vulnerability means that impacted CPUs cannot be fixed.&nbsp;While software fixes could mitigate the issue, they would come at the cost of performance, particularly affecting cryptographic functions.</p> 
<p>Adding fuel to the fire, the second blow lands courtesy of the United States Department of Justice (<a href="https://crypto.news/tag/doj/">DOJ</a>), which has <a href="https://www.courtlistener.com/docket/68362334/1/united-states-v-apple-inc/" target="_blank" rel="noopener">leveled</a> a hefty antitrust lawsuit against Apple.&nbsp;</p> 
<p>The lawsuit claims that Apple’s App Store rules and developer agreements stifle competition and innovation, creating barriers for developers and users across diverse sectors, including finance and crypto.</p> 
<p>Let’s delve deeper into the implications of these events and dissect what really is happening and how it impacts crypto.</p> 
<h2 class="wp-block-heading" id="strong-understanding-the-gofetch-attack-strong"><strong>Understanding the GoFetch attack</strong></h2> 
<p>The GoFetch attack <a href="https://gofetch.fail/files/gofetch.pdf" target="_blank" rel="noopener">zeroes</a> in on a sophisticated vulnerability within modern Apple CPUs, putting users at risk of having their private cryptographic keys compromised.&nbsp;</p> 
<p>At the heart of the GoFetch assault lies a feature known as the data memory-dependent prefetcher (DMP), a component designed to enhance the speed of computing operations by predicting and fetching data ahead of time into the CPU cache.&nbsp;</p> 
<p>Think of it as a forward-thinking assistant, preemptively retrieving information it believes the computer will need based on past memory access patterns. However, the DMP’s predictive prowess becomes its Achilles’ heel in the context of the GoFetch attack.&nbsp;</p> 
<p>This exploit targets cryptographic processes that maintain a constant execution time, regardless of the input—a security measure aimed at thwarting data leaks.</p> 
<p>By delving into the intricacies of Apple’s DMP implementation, the attackers uncovered a critical flaw that violates this fundamental principle of constant-time programming.</p> 
<p>The crux of the attack lies in the prefetcher’s propensity to activate and dereference data loaded from memory, particularly data resembling pointers—an action strictly prohibited under constant-time programming guidelines.&nbsp;</p> 
<p>Exploiting this flaw, attackers can craft specialized inputs designed to trigger the prefetcher, gradually revealing bits of the secret cryptographic key.&nbsp;</p> 
<p>With persistence and repetition, the attackers can reconstruct the entire key, exposing sensitive information to potential compromise.</p> 
<p>Apple’s M1 processors, and likely their successors M2 and M3, are susceptible to this vulnerability due to similar prefetching behavior.&nbsp;</p> 
<p>Unfortunately, as this weakness is deeply ingrained in the hardware design of Apple CPUs, there’s no straightforward fix available.&nbsp;</p> 
<h2 class="wp-block-heading" id="strong-who-s-at-risk-and-apple-s-response-strong"><strong>Who’s at risk and Apple’s response</strong></h2> 
<p>The discovery of this critical security flaw in Apple’s M-series chips has put users of Mac and iPad devices at potential risk.&nbsp;</p> 
<p>What’s concerning is that users cannot address this vulnerability directly. Cryptographic application developers must implement mitigations for the problem and issue updates to their applications.&nbsp;</p> 
<p>However, this process may not be straightforward, and users may find themselves in a vulnerable position until these updates are rolled out.</p> 
<p>Security experts like Robert Graham, CEO of security consultancy Errata Security, <a href="https://www.zetter-zeroday.com/apple-chips/" target="_blank" rel="noopener">advise</a> caution, suggesting that individuals with substantial holdings in crypto wallets on Apple devices should consider temporarily removing them as a precautionary measure.&nbsp;</p> 
<p>In response to Zero Day’s inquiry, Apple acknowledged the research findings but hasn’t provided concrete steps to address the problem.&nbsp;</p> 
<p>Apple’s developer page <a href="https://developer.apple.com/documentation/xcode/writing-arm64-code-for-apple-platforms?ref=zetter-zeroday.com#Enable-DIT-for-constant-time-cryptographic-operations" target="_blank" rel="noopener">offers</a> guidance to application developers, suggesting the implementation of data-independent timing (DIT) to disable the prefetcher during cryptographic functions.&nbsp;</p> 
<p>However, this solution comes with its own set of challenges. Disabling the prefetcher could result in decreased processor performance during cryptographic operations, raising concerns about usability and efficiency.&nbsp;</p> 
<p>Furthermore, the DIT fix is only applicable to Apple’s latest M3 chips, leaving users with M1 and M2 devices vulnerable to exploitation.</p> 
<h2 class="wp-block-heading" id="strong-apple-s-antitrust-woes-and-crypto-s-future-strong"><strong>Apple’s antitrust woes and crypto’s future</strong></h2> 
<p>The DOJ’s lawsuit contends that Apple’s tight grip on its App Store has led to anti-competitive behavior, stifling innovation and imposing hefty fees on developers.</p> 
<p>Central to the debate is Apple’s infamous 30% “Apple tax,” a commission charged on in-app purchases, including crypto transactions.&nbsp;</p> 
<p>This fee model, deemed “grotesquely overpriced” by <a href="https://crypto.news/metamask-cofounder-calls-apple-purchase-tax-abuse-supports-coinbase-decision/">critics</a>, became a significant obstacle for crypto developers seeking to offer their services on iOS devices in the past.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Now Apple is killing all NFT app businesses it can’t tax, crushing another nascent technology that could rival its grotesquely overpriced in-app payment service. Apple must be stopped. <a href="https://t.co/4KChp6jtFZ" target="_blank">https://t.co/4KChp6jtFZ</a></p>— Tim Sweeney (@TimSweeneyEpic) <a href="https://twitter.com/TimSweeneyEpic/status/1573377990100238338?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">September 23, 2022</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>The repercussions of Apple’s fee structure are evident in the <a href="https://crypto.news/learn/a-complete-guide-to-nfts/">NFT</a> marketplaces. Companies like Magic Eden, faced with the prospect of paying substantial commissions, opted to withdraw their services from the App Store in 2022 and are still holding onto their guns.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">There is a fake Magic Eden wallet app on the IOS App Store. <br><br>Do not download this, it is NOT from us. We are working to get it removed.<br><br>We are currently developing a mobile app but any announcements will come from our official channels. Please be careful and assume any Magic… <a href="https://t.co/WGF08lCMPZ" target="_blank">pic.twitter.com/WGF08lCMPZ</a></p>— Magic Eden 🪄 (@MagicEden) <a href="https://twitter.com/MagicEden/status/1765741748569993524?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">March 7, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Others, like OpenSea, have had to scale back functionality to just viewing and browsing NFTs, limiting user experience and access to NFT trading.</p> 
<p>The <a href="https://crypto.news/price/bitcoin/">Bitcoin</a>-friendly social app Damus <a href="https://crypto.news/damus-crypto-tipping-app-reports-guideline-abuse-after-clarifying-no-content-is-sold/">also</a> had to remove its BTC tipping feature. Apple delisted the app because it didn’t use Apple’s in-app payments, which Apple uses to take a cut.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Damus will be removed from the app store in 14 days, apple says zaps are not allowed on their platform because they *could* be used by content creators to sell digital content. This is right before we’re about to give our talk at the oslo freedom forum on how decentralized social… <a href="https://t.co/uAK1U0UBet" target="_blank">pic.twitter.com/uAK1U0UBet</a></p>— Damus⚡️ (@damusapp) <a href="https://twitter.com/damusapp/status/1668529709867495424?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">June 13, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Additionally, Apple’s guidelines go beyond mere fee structures, encompassing restrictions on payment systems and app distribution.&nbsp;</p> 
<p>These guidelines prevent developers from offering alternative payment methods, hindering the integration of crypto into iOS apps.</p> 
<p>For instance, Apple is facing a class-action lawsuit <a href="https://crypto.news/apple-hit-with-lawsuit-for-blocking-crypto-in-p2p-payments/">initiated</a> last year, filed in Nov. 2023 in a California District Court.&nbsp;</p> 
<p>The lawsuit alleges that Apple collaborated with payment platforms such as PayPal’s Venmo and Block’s Cash App to restrict peer-to-peer (<a href="https://crypto.news/glossary/peer-to-peer-p2p/">P2P</a>) payments within iOS applications.</p> 
<p>Meanwhile, in response to the DOJ’s allegations, Apple has <a href="https://www.theverge.com/24107581/doj-v-apple-antitrust-monoply-news-updates" target="_blank" rel="noopener">defended</a> its practices, citing concerns about user privacy and security.&nbsp;</p> 
<p>However, critics argue that these policies disproportionately favor Apple’s bottom line at the expense of developer freedom and consumer choice.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">It is nice when the DOJ gets it right and calls a spade a spade. The Apple pro-privacy and security 'spin' has been one of the smarter and well executed cynical marketing plans in history. Glad folks are starting to see through it and say something beyond tech echo chambers. <a href="https://t.co/tLr2cJz2WQ" target="_blank">pic.twitter.com/tLr2cJz2WQ</a></p>— sam lessin 🏴‍☠️ (@lessin) <a href="https://twitter.com/lessin/status/1771281029556244552?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">March 22, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Experts <a href="https://techcrunch.com/2024/03/22/apple-vs-us-antitrust-lawsuit-everything-we-know-so-far-on-the-dojs-iphone-case/" target="_blank" rel="noopener">estimate</a> a three-to-five-year timeline for any resolution to Apple vs. DOJ case.&nbsp;However, app makers and the Coalition for App Fairness have <a href="https://techcrunch.com/2024/03/21/coalition-including-epic-spotify-deezer-match-group-and-others-applaud-dojs-apple-suit-in-statement/" target="_blank" rel="noopener">voiced</a> strong support for the DOJ’s regulatory action, citing Apple’s long history of unfairly increasing prices, degrading user experiences, and choking off competition.</p> 
<p> Read more: <a href="https://crypto.news/certik-reports-a-critical-security-vulnerability-in-solanas-saga-phone/"> CertiK reports a critical security vulnerability in Solana’s Saga phone </a> </p>

Apple draws crypto criticism again: what you need to know

Table of Contents

crypto.news

Other articles published on Mar 27, 2024

Surge Alert: The Top 4 Altcoins You Should Grab Now!

Bitcoin Recovers as Solana Gains Shine in Crypto Market

Ethereum ETF Focus Rises as Bitcoin ETF Makes Waves

Shiba Inu Team Member Has Crucial Warning for SHIB Community: Details

Kelexo (KLXO) Sets a New Paradigm in P2P Lending, Gaining Attention from Polkadot (DOT) & Solana ...

High Demand for AI Talent Squeezes Smaller Firms

Join our free newsletter for daily crypto updates!