Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s T2 security chip jailbreak

reportcybercrime.com

Post reply on HN
Print view View original

291–300 of 393 posts

Re: Apple’s T2 security chip jailbreak

#291

Post by cwhiz »

kmeisthax wrote: post #237
cwhiz wrote: post #142

Earlier quoted context omitted.

Some of the people here can’t understand that some people have different opinions. I don’t care that I can’t easily change the SSD. If that were important to me, I would buy a different laptop. I don’t consider my MacBook Pro to be working against me, at all.

You don't care that you can't change out the SSD, but you will care when you take your dead laptop to the Genius Bar and they tell you it's going to be cheaper to buy a new one and that your data is already gone.

Cheaper to buy a new laptop than to replace an SSD? Come on, man. I feel like you've never owned an Apple laptop and you're getting your opinions on the genius bar from Louis Rossman. What you're describing is probably 0.001% of genius bar encounters.

Re: Apple’s T2 security chip jailbreak

#292

Post by heavyset_go »

duskwuff wrote: post #290
heavyset_go wrote: post #271

Earlier quoted context omitted.

macOS will deprecate older Macs 6-7 years after their release. You can use older Macs as Linux machines, with one of the BSDs, or with Windows. The T2 chip can prevent people from putting their OS of choice on their hardware once Apple deprecates support for their machine.

> macOS will deprecate older Macs 6-7 years after their release. This is substantially inaccurate. Current versions of macOS run on nearly all Apple systems from 2012 (8 years old), with the exception of some 2012 Mac Pros. The limiting factor in most cases is GPUs -- macOS 10.14 and later require some GPU capabilities which weren't reliably available in 2012.

No, it is substantially accurate.

Catalina, released in October 2019, dropped support for MacBooks released before 2015, MacBook Air models from before mid-2012, MacBook Pro models from before mid-2012, Mac Minis from before late 2012, and Mac Pros from before late 2013[1]. Do the math and that is 5 to 7 years between initial release of the hardware and deprecation by macOS.

[1] https://www.macworld.co.uk/feature/mac-software/what-version...

Re: Apple’s T2 security chip jailbreak

#293

Post by RonanTheGrey »

Ductapemaster wrote: post #224
toyg wrote: post #135

Earlier quoted context omitted.

It's a trade-off. I buy MBPs for the great form-factor and OS, not for the walled-garden shenanigans. If those shenanigans can be somewhat reduced, the trade-off balance looks better.

I don't mean to me facetious, but I am genuinely curious: why should you get to have it your way? You are attempting to buy a product they do not sell.

Then perhaps they should sell it, and stop ignoring people who want it?

Benign neglect (not creating limitations) is not the same as active interference (actively preventing) and Apple is much more on the side of active interference. They could simply do nothing (which is cheaper). They choose not to, at which point we get to question their motives.

In the end your question reduces to "why do you want anything at all that someone doesn't already make?" and that doesn't make alot of sense given that new products come out on the market all the time.

Re: Apple’s T2 security chip jailbreak

#294

Post by acdha »

_lffv wrote: post #231
deepstack wrote: post #151

Earlier quoted context omitted.

Some one from Apple, I'm sure you read this. Please answer this ASAP. I rely on mac and FileValute for professional use at work. Need to know the state of this exploit.

> I rely on Mac and FileVault for professional use ... then phase out your use, because proprietary systems will always get cracked given enough time.

Good point, let’s switch to unbreakable open source systems based on OpenSSL instead.

This kind of advocacy is not only unhelpful but actually counterproductive

Re: Apple’s T2 security chip jailbreak

#295

Post by RonanTheGrey »

dkonofalski wrote: post #236
oauea wrote: post #228

Earlier quoted context omitted.

They also indicated they'd never ever use Mac's notarization requirement to block legitimate software. Then they got in a legal fracas with Epic and immediately retaliated against Epic by banning all their software from all Apple hardware! Apple has shown they are very eager to use their position of power to strong-arm the competition, and these kinds of chips only add to their power.

That's a very disingenuous assessment of the situation at hand. Epic knowingly violated their developer agreement. There was no retaliation. There was the consequences that were written into the developer agreement that Epic agreed to.

> Epic knowingly violated their developer agreement. There was no retaliation

I think you don't understand how this works. The agreement itself is the subject of the lawsuit and thus MUST be violated in order to show harm. Epic did it on purpose in order to sue Apple and whether you agree with that or not, it is the only mechanism the law allows to make the agreement itself the subject of the suit. And Epic does have a right to sue Apple for whatever reason they choose.

Re: Apple’s T2 security chip jailbreak

#296

Post by RonanTheGrey »

curiousgal wrote: post #117
Causality1 wrote: post #70

Earlier quoted context omitted.

You guys are fighting the good fight for everything that owning hardware and being a user used to mean. Thank you.

I never understood this sentiment, if people choose to pay their way into a walled garden, why should they still care about hardware ownership/repairabilty, etc.?

I'd be interested in a real study that actually measured how often people are explicitly choosing the walled garden, and how often they're choosing something else that the walled garden "happens to come with".

My money is on the second option but AFAIK there's no study like this.

Re: Apple’s T2 security chip jailbreak

#297

Post by duskwuff »

heavyset_go wrote: post #292
duskwuff wrote: post #290

Earlier quoted context omitted.

> macOS will deprecate older Macs 6-7 years after their release. This is substantially inaccurate. Current versions of macOS run on nearly all Apple systems from 2012 (8 years old), with the exception of some 2012 Mac Pros. The limiting factor in most cases is GPUs -- macOS 10.14 and later require some GPU capabilities which weren't reliably available in 2012.

No, it is substantially accurate. Catalina, released in October 2019, dropped support for MacBooks released before 2015, MacBook Air models from before mid-2012, MacBook Pro models from before mid-2012, Mac Minis from before late 2012, and Mac Pros from before late 2013[1]. Do the math and that is 5 to 7 years between initial release of the hardware and deprecation by macOS. [1] https://www.macworld.co.uk/feature/mac…

> dropped support for MacBooks released before 2015

Those machines were all sold in 2011 or earlier. Saying "before 2015" is misleading, because the MacBook name was used during two disjoint periods to refer to two completely different machines.

Between 2006 and mid-2011, the MacBook brand name was used for a line of low-cost Core 2 laptops, most of which had plastic cases. (Some sales to schools continued through 2012.) These are the laptops which were not supported by macOS 10.14 and later.

Between mid-2011 and 2015, there were no computers sold under the MacBook brand. Apple only sold laptops under the MacBook Air and MacBook Pro brands during this period.

In 2015, Apple reused the MacBook brand name for a line of 12" ultraportable laptops. These are supported under current releases of macOS.

Re: Apple’s T2 security chip jailbreak

#298

Post by acdha »

parliament32 wrote: post #256
deepstack wrote: post #151

Earlier quoted context omitted.

Some one from Apple, I'm sure you read this. Please answer this ASAP. I rely on mac and FileValute for professional use at work. Need to know the state of this exploit.

>FileVault for professional use Probably not the best choice :) you never want to use proprietary software if security is a concern

Go count how many CVEs have come out for OpenSSL, GNUTLS, LUKS, etc. and ask whether you’re offering helpful advice. Security is expensive and there are no silver bullets: at the end of the day you need a lot of skilled work and being open source doesn’t magically get that for free.

Re: Apple’s T2 security chip jailbreak

#299

Post by pvg »

DaiPlusPlus wrote: post #40
pvg wrote: post #17

Earlier quoted context omitted.

The things stored in the enclave are encrypted with a key derived from, among other things, your device password so no jailbreak is going to provide access to them. It would be a big deal if one could, say, run 'offline' dictionary attacks against secure enclave content.

> run 'offline' dictionary attacks against secure enclave content. Isn't the T2 chip the only reason they can't do that:: because it sets a minimum time-limit and cooldown period on attempts to authenticate using the device passcode? So presumably rooting T2 and removing the artificial time limits and/or extracting KDF data would mean game-over because brute-forcing `[0-9]{4,8}`, with even the most expensive hash fun…

I don't think it's just that - the design intent is for the crypto operations to run only on the device and also to depend not just on a key derived from the user password but on parameters built into the device that are not accessible to the software. Just controlling the software is not necessarily enough to take the attempts off-device.

Re: Apple’s T2 security chip jailbreak

#300

Post by aunali1 »

acolumb wrote: post #284
dstroot wrote: post #214

Earlier quoted context omitted.

>Hi guys, I am part of the team working on all things T2. So there is a team working on this? What is the incentive model? Are you paid to do this work? What is the revenue model? I woke up today learning my MacBook Pro is now substantially less secure but why? So I can run games on the touch bar? So I can use the T2 as a raspberry pi?

There is a team taking advantage (jailbreaking on iOS) of the security flaw in all A-series chips up to A11 in the hardware-level bootloader. The T2 in your 2018 or newer Mac is a variant of the A10. The bootROM flaw allows for an exploit that can only be executed with physical access, another Mac and DFU mode. It's not persistent. The main use of this exploit was to install unsigned code on iOS devices (jailbreaking…

I would say it is persistent enough to be malicious. The T2 does not reboot, with the exception occuring during a DFU restore, extremely drained battery, or firmware update. With that in mind, a party intending harm would have more than enough time.
Post reply on HN