31–40 of 393 posts
I wonder if this has security implications. The T2 houses the "secure enclave" and that's where your private keys, certificates and passwords are stored.
of course. Previously your keys are stored securely in a vault in a security facility but now the doors to the security facility is blown wide open. They still need to figure out the Secure Enclave though, which is no easy feat
The fact that Apple uses this chip to, among other things, block "unauthorized repair" (can't change a freaking SSD in 2020, really), makes me very happy that people are finding ways to break this chip to make repairs more accessible. On the other hand, this could have serious implications on the iOS security model for example. And I'm pretty sure someone is gonna run Doom on the touchbar in some months.
I actually dont mind they block unauthorised repair, at least I believe in the Steve Jobs's Apple era he wanted the best customer experience. And they want the Data of what is failing in their Mac where their Genius Bar gain first hand experience and knowledge which leads to feedback to the Design team. ( They dont publicly announce or admit it, but the database has those problem listed. )
The goal was to aim for perfection, a machine that is so reliable it wouldn't need to repair in the first place. And if and when they fail, Genius Bar is there to help. You used to get some nice gesture from Apple Retail. Now they are simply trying gouge customers into buying a new MacBook, hopefully with AppleCare+, or replacement for the logic board. Every single problem they will just quote you to replace the logic board price. Not only are they expensive, the actual work or replacement isn't even up to Apple's standard.
I will need time to dig up some data. But MacBook Pro 2016+'s resale price has dropped quite significantly compared to MBP 2015 in the same age. And MBP 2015 second hand market is actually going strong.
The checkra1n support is just in a PoC state, it will successfully exploit and boot the T2. The payload support is partially broken, but being worked on.
Additionally, we have SSH working over usbmuxd from a tethered device [2] and SSH working from macOS on device, with an SDK in the works [3].
Some key takeaways from the T2 being jailbroken:
- Custom Bootloaders (OpenCore, Coreboot, etc) are now possible as the T2 validates/sends the UEFI payload to PCH using a bridgeOS binary called MacEFIUtil, which can trivially have its signature checks patched.
- Filevault and by extension Touch ID are more or less crippled, especially in light of the recent SEP exploits. Amusingly, Apple uses a hardcoded "passcode", analogous to an iDevice's unlock pin in plain text within the UEFI firmware.
- Support for In-System Debugging of the PCH/Intel processor over USB. This works in a similar fashion to those Bonobo cable used for debugging iDevices [4]. We are working on building an accessory that you can purchase and plug into your Mac with a USB male endpoint exposing Intel's DCI debugging protocol.
- Lightweight AppleSilicon Tinkering environment. With SSH support from macOS on device, and the T2's modest specs, its a nice sandbox for messing with arm64 stuff. It's a pretty peppy chip, at times coming close to my 8th gen i7...yikes.
1. https://www.theiphonewiki.com/wiki/T8012_checkm8
2. https://twitter.com/qwertyoruiopz/status/1237904335184564224
3. https://twitter.com/su_rickmark/status/1286886010681462784
Earlier quoted context omitted.
Doom on touchbar (2016) https://www.theverge.com/circuitbreaker/2016/11/21/13697058/... https://twitter.com/b3ll/status/800472338496036864?s=20
Back in the days, we had bootsector games. In the future we will have TouchBar games running before even the OS boots.
Earlier quoted context omitted.
Exactly. This would "in theory" allow Doom to be running outside of the "prescribed parameters".
So the monsters would actually leave the touchbar. This sounds really risky, folks
Hi guys, I am part of the team working on all things T2. [1] The checkra1n support is just in a PoC state, it will successfully exploit and boot the T2. The payload support is partially broken, but being worked on. Additionally, we have SSH working over usbmuxd from a tethered device [2] and SSH working from macOS on device, with an SDK in the works [3]. Some key takeaways from the T2 being jailbroken: - Custom Bootl…
Do you have any thoughts about what Apple's switch to own-brand ARM chips in laptops and desktops will mean for T2/T3/etc?
I wonder if this has security implications. The T2 houses the "secure enclave" and that's where your private keys, certificates and passwords are stored.
The things stored in the enclave are encrypted with a key derived from, among other things, your device password so no jailbreak is going to provide access to them. It would be a big deal if one could, say, run 'offline' dictionary attacks against secure enclave content.
Isn't the T2 chip the only reason they can't do that:: because it sets a minimum time-limit and cooldown period on attempts to authenticate using the device passcode?
So presumably rooting T2 and removing the artificial time limits and/or extracting KDF data would mean game-over because brute-forcing `[0-9]{4,8}`, with even the most expensive hash function - and with a salted hash - can probably be done on a desktop within a day.
...but why can't we do that today by de-capping the T2 chip and looking at its flash storage with an electron-microscope?