Don’t Fear Apple’s Chip Hack - DTNS 4945  ## Metadata - Author: [[Daily Tech News Show]] - Full Title: Don’t Fear Apple’s Chip Hack - DTNS 4945 - Category: #podcasts - URL: https://share.snipd.com/episode/9fbb468d-6044-4225-a41a-841dcf0c6d16 ## Document Notes ## Highlights - **Apple Silicon Exploits** - Two new exploits, "Flop" and "Slap," target speculative execution in Apple Silicon processors (A15 and later, M2 and later). - These attacks can leak sensitive data like emails or order info by monitoring the processor's predictions. Transcript: Tom Merritt I'm Tom Merritt. I'm Jed Cutter. Let's start with what you need to know in the big story. Georgia Institute of Technology and Ruhr University, Bocum, security researchers, have presented two separate papers showing how speculative execution in Apple processors can Be manipulated to leak sensitive data. If you've run into speculative execution before, you might have an idea of what it is. It's what was exploited in the Spectre and Meltdown attacks. Those are on x86 processors. These new exploits affect Apple Silicon, but not all Apple Silicon, only the A15 and later and the M2 and later. So it's a method of speculative execution that was introduced in those versions of the processor and then carried forward in Apple's chip family. There are two papers. So there's two kinds of attacks. The flop attack takes advantage of the processor's load value predictor to guess what memory will load. The slap attack takes advantage of the chip's load address predictor, which forecasts what memory address will be accessed next. That might mean something to you. If it doesn't, don't worry. What you need to know is that in both cases, the timing of the caching of the data or some other kind of side channel attack is what's being used to deduce the value of the data. They break around some safeguards by monitoring these different ways of predicting what's going to happen. Predicting what's going to happen speeds up chip processes, but they can watch those predictions and start to deduce things. So we're talking ones and zeros that they're able to predict, but the attack can do this enough times to put together things like what's in your Gmail inbox tab or your Amazon order data. Two things have to happen for this to work, though. One, the data has to be open in a tab on a running browser, and the user of the browser has to visit a malicious website that can execute the attack. So if you're not running a browser at all, this isn't going to affect you. If you don't have a tab open, they can't get that data. This is, you've been to a malicious website designed specifically for this, and you have sensitive data open in another tab. Both attacks can read browser tabs, but they work a little different. The slap attack only works in Safari, and it's limited to things like Java strings. So it can't get everything, while the flop attack works in both Safari and Chrome and has access to anything in the browser's address space. So that one's a little more comprehensive. The researchers have notified Apple of the slap attack in May. They notified them of the flop attack in September. Neither has been seen in the wild. So sure, it's only a matter of time. But right now, there's no websites that anybody has noticed doing this. This is very much an academic thing. Apple is working on a fix, but did tell Bleeping Computer, we do not believe this issue poses an immediate risk to our users. So they are taking their time. They're not worried about this causing massive problems. And the details haven't been presented to the public yet. The flop attack will be presented at the 2025 USENIX Security Symposium. That happens August 13th in Seattle. And the SLAP research will be presented a little earlier at the 2025 IEEE Symposium on Security and Privacy. That takes place May 12th in San Francisco. ([Time 0:02:35](https://share.snipd.com/snip/56346d80-eb52-4f7b-9ab2-1b18c6bbd480)) - **DeepSeek's Potential Data Misuse** - DeepSeek, a Chinese AI company, might have used OpenAI's API data to train its models, violating OpenAI's terms of service. - This unauthorized access could explain DeepSeek's rapid model development, not just efficient training. Transcript: Tom Merritt Specifically, if you listen to the interview, he gives a couple of examples of what it said. It doesn't say that anymore, but it may not have just been hallucinating. Microsoft says it detected a large amount of data accessed through OpenAI's API this past autumn. Neither Microsoft nor OpenAI called out DeepSeek by name, but they do indicate it might be a company from mainland China. And we know which company from mainland China is doing a lot of cool things with AI that could have made use of all that data. The concern would be that DeepSeek accessed OpenAI data without authorization and then used it to train its models. That would be against OpenAI's terms of service. This could explain why it was able to create a competent model as quickly as it did, rather than some kind of advanced training on cheaper chips, as has been assumed. DeepSeek has published details of how it has created efficient inferencing. That's the use of the model, and that's valid. They've done some really cool things there, but we don't know exactly how it achieved efficient training. More fundamentally, DeepSeek does say it did distill models. Distilling data from other models to train your model is not a controversial thing if you have the rights to do it. DeepSeek says that it used open source models and open source model or open models from Meta. So it would have had the rights to distill those. It does admit to some amount of distillation. It just doesn't admit that it distilled OpenAI. So whether it distilled OpenAI's models or not would be the question. I know a lot of people are like, oh, OpenAI, you took everybody's copyrighted work and now you're mad somebody's taken yours. It's not exactly the same thing. I'm not begrudging you the joke, anyone. It is funny. But this is using an API versus getting copyrighted work. OpenAI is not saying it was copyrighted work. They're saying, you used our API in a way that we didn't allow. Jenn Cutter Yeah, all my creatives are feeling a particular way that there's a great German word for. Tom Merritt Yes, yes, I'm sure they are. And like I said, I don't begrudge that. But if you do want to understand this, you should understand that it's not exactly the same thing. At least if you want to really understand what's going on, it's violation of access of data, not copying. OpenAI wouldn't have a problem with this if you did it within the terms of service. Distillation and copying of the data is not a problem. Accessing it without authorization is the problem. And OpenAI doesn't want people doing this without them getting a cut of the action. So there is a little overlap. There is a little overlap there. I'm not going to lie. ([Time 0:10:22](https://share.snipd.com/snip/5ba43bf0-03cc-4884-9c47-70278e1463b5)) - **Copyright and AI** - AI assistance doesn't invalidate copyright, but human involvement is essential. - Don't just submit a prompt; add a personal touch for copyrightable work. Transcript: Tom Merritt U.S. Copyright Office plays an outsized role in copyright policy around the world. A lot of countries model their policy decisions on what the U.S. Does. And the U.S. Film industry sets standards for film around the world as well. So it is notable that the U.S. Copyright Office declared Wednesday that using AI systems to assist in the creative process does not undermine the copyright of the resulting work. So because you used, you know, OpenAI or Sora or something like that, doesn't mean you can't copyright the work. However, they did reiterate that a human must be present in the work. A human effect must be present in the work. You can't just enter a prompt and then claim authorship. In fact, the 41-page report used an image that the people at the copyright office made in Gemini of a cat smoking a pipe, an example of, you can't just make a cat smoking a pipe and call it Copyright. You got to rearrange it, do something to it, got to put a human touch on it. I love that there's a cat smoking a pipe in this report. ([Time 0:14:48](https://share.snipd.com/snip/b489370c-959c-4c30-bf9d-0c28dfe49ab5)) - **Dr. Nikki's Pixel 4a Battery Issue** - Dr. Nikki's Pixel 4a battery life plummeted after a Google update. - Google offered a free battery replacement, $50, or a $100 voucher for a new Pixel. Transcript: Tom Merritt Dr. Nikki, when did you first realize that you were a victim of the update that bricked people's phones? Dr. Nikki So at first I thought that my phone was just getting old. And then I actually got a pop up on my screen from Google that said, hey, we just made you do an I guess I could have rolled my phone back. But I did the update unknowingly. And then about a day later, they said, hey, we made you do this update that has affected your Pixel 4a phone battery. Here are your options. Option one, we can get you a free battery replacement. Option two, you get $50 cash. And option three, you get $100 voucher for a Pixel phone from the Google store. Tom Merritt And in the strictest sense, it wasn't bricked because it still worked, right? It's just that your battery would die super fast, right? Yeah. Dr. Nikki I had to charge my phone about six to seven times in a day until I got the replacement. So I had like a 30 to 35 minute phone life and I just was constantly plugged in all the time. So not completely bricked, but also not really usable, honestly. Tom Merritt Not the way of mobile. It took the mobile out of your mobile phone. Dr. Nikki Yeah, not in 2025. Yeah. Tom Merritt So 50 bucks to say, you know, sorry, good luck. Or a whole new phone kind of feels like the whole new phone is the better option there. Dr. Nikki Yeah. And I'll be honest with you. Literally, like two days before that happened, I had been considering getting a new phone anyway. I mean, the battery life was degrading. It's a four and a half year old phone. I personally, since I'm a biologist have dropped that phone in a swamp before. So it's, it was really starting to not work anymore. So that kind of worked out for me anyway. And I was going to get another pixel because they're cheap. So, but I'm still kind of mad about it because a hundred, like if hadn't dropped mine in a swamp, I probably could have kept using it for years if they had not kind of program obsolescenced It. And I'd like to not switch out phones because I'm a tech grandma, but also because of the impact on the environment. So that kind of rubbed me the wrong way. Tom Merritt One less phone and battery to send the world. Why wouldn't you have picked the battery replacement then? Dr. Nikki Because I was going to get a new phone anyway. My screen is cracked and my camera is broken. If I didn't have a cracked screen and a broken camera, I would have actually done the battery replacement. You would have done the battery replacement. Tom Merritt Gotcha. Okay. That makes sense. So how did it work? Once you picked your option, how did you tell them and when, what was the process? Dr. Nikki It was somewhat straightforward. I clicked by a hundred dollars on the Google store option. They sent me an email with a code. The code didn't work. I had to get on with customer service and get a new code. Uh, but once I did that, I just ordered it in the store. You also have the option to send in your phone for like a coupon and they still took the 4a so I put that option in I will say this runs into another tech problem though that I didn't realize I got my phone in like three days it was fine I paid like 350 bucks which is also the reason why I went for I got an 8a as a replacement okay I'm I don't need the newest phone and I usually go for Whatever is the smallest phone on the market because I hate having giant phones and my hands are women-sized. I got in like three days. It was fine. I got a really good deal on it because I did the trade-in, which gave me like $40. But I noticed I can't get TikTok on my new phone anymore. It is on my old phone, but it's not in the app store anymore. So I don't have TikTok anymore, which kind of makes me sad. Tom Merritt Yeah. You'll have to travel in order to get TikTok. Dr. Nikki Yeah, I'll have to get a VPN or I don't know. But the transfer was fine. The fact that it's also a Pixel phone means that I could just transfer everything over. So it was fine. The new phone's fine. It doesn't feel like a gigantic upgrade. I have to say like my screen's not cracked anymore. I don't feel like it's that much more performant other than the battery life. Even though it's supposed to be a really big like picture upgrade, I haven't really noticed, but I've also haven't gone out and, you know, tested in the world, but I'm not like, wow. Tom Merritt So it was an older phone near the end of its life. Anyway, you were probably going to replace it anyway. And then the, you know, the battery thing happens and Google does, you know, we could argue about whether it's the right thing or not to have caused the problem in the first place, but At least makes an effort to say, Hey, we know that this shouldn't have happened. So they give you $100 off of a new phone. They still let you get a trading credit. You end up with a newer phone and you pay less than you would have paid otherwise. How do you feel after all of that, though? Dr. Nikki So honestly, it's going to be a little hypocritical because I went through with the whole thing but i'm kind of like annoyed that they can just do this like oh we bricked your phone here's A coupon don't worry about it um again not bricked sort of bricked but and it is one of the cheaper phones on the market so if there was a cheaper option i may have just not taken the coupon And gone with that. In Europe, this is probably not legal in Europe because program obsolescence is against the law in a lot of European countries. So I don't know how they've dealt with that over there. That is one of those things that just makes me really angry. I'm very much of the team. If it works, keep using it until it breaks. I had a Nokia brick phone for a really long time until like, I want to say 2014. So that annoys me and it makes me think, well, if they can just do this whenever they want, then they can force me to get the upgrade anytime. Phone, I may go for a company that doesn't do program obsolescence as frequently. Are there any that don't? I don't know. Tom Merritt I am of the opinion that companies don't specifically program the obsolescence, that they don't care that it happens. In other words, they make their operating systems for the newest phones they have. And then if that has a side effect like it did this time, they don't spend a whole lot of effort to try to change the new operating system for that. They just issue coupons and stuff instead. So it's more of a side effect than a plan, right? Yeah. Dr. Nikki And that's why I don't have an iPhone because it happens regularly that they update the new iOS and then nothing's usable anymore from the previous generations. I wish that I could still use my old. What is it? I touch. What were those called? Touch. Yeah. I touch like those went out. I mean, again, I'm always late with technology because I try to not throw things away. But yeah, those become really unusable. Like you can't download WhatsApp. And I guess this happens with any tech at a certain period of time, but it would be nice to have the option to keep your phone as long as possible. Tom Merritt Arguably, Apple has a pretty good track record in supporting their phones longer ([Time 0:19:00](https://share.snipd.com/snip/d04b42ad-5708-4850-81ac-761fa9c6456a)) - **Pebble Enthusiasm** - Many Pebble enthusiasts shared their excitement about its potential return, desiring features like color e-ink and NFC. - Paul still wears his Pebble Time Steel daily and keeps a backup, highlighting the watch's enduring appeal. Transcript: Jenn Cutter We end every episode of DTNS with some shared wisdom. We heard from many folks who are enthusiasts of the Pebble, recounting their experiences with the model and their excitement at the prospect of its return. Here are a few excerpts. Tom Merritt Yeah. Apologies for not reading your full emails on the show, but I did read them in person. Cindy said, I loved my round Pebble watch. I'd love to have another as long as it has three things. Color e-ink, NFC for payments, and a step counter. Rob Bugs Life said, I want a useful device for notifications and media playback controls with physical buttons that isn't dead in less than 24 hours. I miss the pebble watches so much. I'm on board day one. Rob was the first person to respond. He posted on the Patreon post for yesterday's episode, I think within minutes of it going up. Mike said, I'm so glad there are dozens of us, dozens who just want to watch that tells time, shows notifications, it doesn't need to be charged every day. Tony Wanger, we talked to recently about Red Note, said, I can't believe it's coming back. I won't be getting one, though. And Tony was like a backer of the original. He said, as a watch enthusiast, the Samsung ring is the perfect fitness tracker for me, so I don't have to wear a smart watch to track my health, and I get to enjoy my watches in my collection. I think he's doing Seiko watches now. Marty says, Eric has been open in interviews about the mistakes that led to the sale of the company last time. I hope there have been lessons learned to make sure Pebble finds long-term success this time around. Martin said, if the Re-Pebble team can launch a good-looking product at a reasonable price and not sell my personal data to other companies, then this watch will be a must-buy for me. And I don't want to pick a favorite, but I kind of think this is my favorite from Paul, who said, I still wear my Pebble Time steel daily. This is my second after my first died. And I maintain a new old stock backup just in case. However, I am not a Pebble diehard by any means. I just can't get these features in any other watch. To this day, I still get compliments and questions about my unique looking smartwatch. I don't know, Paul. It sounds like maybe you defined what a Pebble diehard is there with what you do. Jenn Cutter That is a ride or die and prepared for contingencies. ([Time 0:29:30](https://share.snipd.com/snip/322e82be-84d5-462b-b311-100b7a8750f4))