Latest Side-channel attack news

New GoFetch attack on Apple Silicon CPUs can steal crypto keys

A new side-channel attack called "GoFetch" impacts Apple M1, M2, and M3 processors and can be used to steal secret cryptographic keys from data in the CPU's cache.
- Bill Toulas
- March 22, 2024
- 11:01 AM
- 2
New acoustic attack determines keystrokes from typing patterns

Researchers have demonstrated a new acoustic side-channel attack on keyboards that can deduce user input based on their typing patterns, even in poor conditions, such as environments with noise.
- Bill Toulas
- March 17, 2024
- 10:22 AM
- 5
KyberSlash attacks put quantum encryption projects at risk

Multiple implementations of the Kyber key encapsulation mechanism for quantum-safe encryption, are vulnerable to a set of flaws collectively referred to as KyberSlash, which could allow the recovery of secret keys.
- Bill Toulas
- January 07, 2024
- 10:05 AM
- 0
New SLAM attack steals sensitive data from AMD, future Intel CPUs

Academic researchers developed a new side-channel attack called SLAM that exploits hardware features designed to improve security in upcoming CPUs from Intel, AMD, and Arm to obtain the root password hash from the kernel memory.
- Bill Toulas
- December 06, 2023
- 07:52 PM
- 0
Modern GPUs vulnerable to new GPU.zip side-channel attack

Researchers from four American universities have developed a new GPU side-channel attack that leverages data compression to leak sensitive visual data from modern graphics cards when visiting web pages.
- Bill Toulas
- September 27, 2023
- 10:06 AM
- 3
New Inception attack leaks sensitive data from all AMD Zen CPUs

Researchers have discovered a new and powerful transient execution attack called 'Inception' that can leak privileged secrets and data using unprivileged processes on all AMD Zen CPUs, including the latest models.
- Bill Toulas
- August 08, 2023
- 11:00 AM
- 5
New acoustic attack steals data from keystrokes with 95% accuracy

A team of researchers from British universities has trained a deep learning model that can steal data from keyboard keystrokes recorded using a microphone with an accuracy of 95%.
- Bill Toulas
- August 05, 2023
- 10:09 AM
- 9
New Collide+Power side-channel attack impacts almost all CPUs

A new software-based power side-channel attack called 'Collide+Power' was discovered, impacting almost all CPUs and potentially allowing data to leak. However, the researchers warn that the flaw is low-risk and will likely not be used in attacks on end users.
- Bill Toulas
- August 02, 2023
- 01:37 PM
- 1
Intel CPUs vulnerable to new transient execution side-channel attack

A new side-channel attack impacting multiple generations of Intel CPUs has been discovered, allowing data to be leaked through the EFLAGS register.
- Bill Toulas
- April 24, 2023
- 03:38 PM
- 0
EarSpy attack eavesdrops on Android phones via motion sensors

A team of researchers has developed an eavesdropping attack for Android devices that can, to various degrees, recognize the caller's gender and identity, and even discern private speech.
- Bill Toulas
- December 27, 2022
- 08:39 AM
- 0
Janet Jackson's music video is now a vulnerability for crashing hard disks

Janet Jackson's Rhythm Nation music video of 1989 has officially been declared a security vulnerability as it freezes some models of hard drives on older computers.
- Ax Sharma
- August 18, 2022
- 01:07 PM
- 2
New Hertzbleed side-channel attack affects Intel, AMD CPUs

A new side-channel attack known as Hertzbleed allows remote attackers to steal full cryptographic keys by observing variations in CPU frequency enabled by dynamic voltage and frequency scaling (DVFS).
- Sergiu Gatlan
- June 14, 2022
- 03:55 PM
- 1
Researchers discover 14 new data-stealing web browser attacks

IT security researchers from Ruhr-Universität Bochum (RUB) and the Niederrhein University of Applied Sciences have discovered 14 new types of 'XS-Leak' cross-site leak attacks against modern web browsers, including Google Chrome, Microsoft Edge, Safari, and Mozilla Firefox.
- Bill Toulas
- December 03, 2021
- 10:34 AM
- 0
Google shares Spectre PoC targeting browser JavaScript engines

Google has published JavaScript proof-of-concept (PoC) code to demonstrate the practicality of using Spectre exploits targeting web browsers to gain access to information from a browser's memory.
- Sergiu Gatlan
- March 12, 2021
- 02:30 PM
- 0
Microsoft issues guidance for DNS cache poisoning vulnerability

Microsoft issued guidance on how to mitigate a DNS cache poisoning vulnerability reported by security researchers from the University of California and Tsinghua University.
- Sergiu Gatlan
- December 08, 2020
- 01:58 PM
- 0
DNS cache poisoning attacks return due to Linux weakness

Researchers from Tsinghua University and the University of California have identified a new method that can be used to conduct DNS cache poisoning attacks. The findings reopen a vulnerability that had been discovered by Kaminsky in 2008 and thought to have been resolved.
- Ax Sharma
- November 12, 2020
- 03:55 PM
- 1
Windows 10 Intel microcode released to fix new CPU security bugs

Microsoft has released a new batch of Intel microcode updates for Windows 10 20H2, 2004, 1909, and older versions to fix new hardware vulnerabilities discovered in Intel CPUs.
- Lawrence Abrams
- November 10, 2020
- 03:20 PM
- 0
TPM-FAIL Security Flaws Impact Modern Devices With Intel CPUs

Researchers discovered two new vulnerabilities known as TPM-FAIL in Intel firmware-based TPM (fTPM) and STMicroelectronics' TPM chips that could be used by hackers to steal their targets' cryptographic keys.
- Sergiu Gatlan
- November 13, 2019
- 11:19 AM
- 0
Intel Patches Privilege Escalation Flaw in Easy Streaming Wizard

Intel issued two security updates for software and hardware products to patch vulnerabilities that may allow escalation of privilege and information disclosure.
- Sergiu Gatlan
- September 11, 2019
- 06:15 AM
- 0
New NetCAT Attack Can Leak Sensitive Data From Intel CPUs

A weakness named NetCAT (Network Cache ATtack) affects all Intel server-grade processors since 2012 and allows sniffing sensitive details by mounting a side-channel attack over the network.
- Ionut Ilascu
- September 11, 2019
- 03:33 AM
- 0