Thunderstrike – Apple EFI firmware vulnerability
1–10 of 72 posts
Re: Thunderstrike – Apple EFI firmware vulnerability
#2I often come to the comment section looking for a summary of a dense article like this. Didn't find it, so here is my best shot at one:
Through the thunderbolt port, an attacker can put code that controls the firmware updates onto a mac. This cannot be removed by software, and could do all sorts of nasty stuff.
Anyone with physical access to the computer and a weaponized version of this exploit could do this. This includes intercepting hardware en-route to its recipients, spending a few minutes with a laptop while its owners are away, or while crossing international borders.
According to the author, this exploit works with every Mac with a thunderbolt port that they tested. Apple has a partial fix coming as a firmware update soon, but the author expresses concern that the proposed fix could still be bypassed.
Re: Thunderstrike – Apple EFI firmware vulnerability
#3I often come to the comment section looking for a summary of a dense article like this. Didn't find it, so here is my best shot at one: Through the thunderbolt port, an attacker can put code that controls the firmware updates onto a mac. This cannot be removed by software, and could do all sorts of nasty stuff. Anyone with physical access to the computer and a weaponized version of this exploit could do this. This in…
+1 for using the term "weaponize".
Re: Thunderstrike – Apple EFI firmware vulnerability
#4I often come to the comment section looking for a summary of a dense article like this. Didn't find it, so here is my best shot at one: Through the thunderbolt port, an attacker can put code that controls the firmware updates onto a mac. This cannot be removed by software, and could do all sorts of nasty stuff. Anyone with physical access to the computer and a weaponized version of this exploit could do this. This in…
I seem to recall that FireWire ports were disabled in some way when the system was locked (tip: show Keychain Access icon in menubar to have a manual lock at a click's distance) and that such attacks therefore required the computer to be unlocked.
Did I dream about that feature, and is that applicable to Thunderbolt?
Re: Thunderstrike – Apple EFI firmware vulnerability
#5An amazing write-up. Although I am using my EE training a lot more at work these days, and I've designed my fair share of MCU (and USB, FPGA, analog...) projects I've never found the time to dip into learning even a fraction of the detail presented here on low-level modern x86 architecture.
For me, reading this really hammers home just how feasible evil maid type attacks really are (considering attacks aimed at defeating Eg. Full disk encryption). But at the same time, if I am still typing the passphrase for my encrypted disks at each boot, simply filming me use my laptop would seem easier... So using that logic, I have been working on passwordless unlock before fiddling with the very tedious task of maintaining a SecureBoot Linux installation.
Can anyone say how strong the x86/TPM-equipped machines out there are against malicious firmware updates, assuming one has their BIOS admin password set?
Re: Thunderstrike – Apple EFI firmware vulnerability
#6I often come to the comment section looking for a summary of a dense article like this. Didn't find it, so here is my best shot at one: Through the thunderbolt port, an attacker can put code that controls the firmware updates onto a mac. This cannot be removed by software, and could do all sorts of nasty stuff. Anyone with physical access to the computer and a weaponized version of this exploit could do this. This in…
I seem to recall that FireWire ports were disabled in some way when the system was locked (tip: show Keychain Access icon in menubar to have a manual lock at a click's distance) and that such attacks therefore required the computer to be unlocked. Did I dream about that feature, and is that applicable to Thunderbolt?
Described exploit requires a reboot, so it doesn't matter if the computer is locked or not.
Re: Thunderstrike – Apple EFI firmware vulnerability
#7Great read to start 2015, it's been a while since I read something of that quality.
Re: Thunderstrike – Apple EFI firmware vulnerability
#8Very nice read.
Basically, when a MacBook is booted it allows random code to be executed from an attached Thunderbolt device (in a form of a legacy mechanism of Option ROM). The Option ROM is loaded unconditionally, including the case when the host system is rebooted to update its firmware. During such upgrade its primary on-board ROM is writable, so the exploit can write itself in it, replace RSA key used to verify firmware upgrades and thus prevent re-flashing the host with any official updates. Additionally, all this is possible because ROM includes only rudimentary self-integrity checks (in a form of CRC32) and proper crypto-signature checks are only applied during the update and not on every boot.
This particular exploit is pluggable by making firmware not use Option ROM during upgrades, which is a fix being deployed by Apple. Meanwhile you may want to superglue your TB port.
Re: Thunderstrike – Apple EFI firmware vulnerability
#9Why Apple uses little-endian, while everything else uses big-endian, is another mystery.
The Apple-I and Apple-II family were 6502 based machines and the 6502 was little-endian, would be my guess. Any takers?
Re: Thunderstrike – Apple EFI firmware vulnerability
#10I often come to the comment section looking for a summary of a dense article like this. Didn't find it, so here is my best shot at one: Through the thunderbolt port, an attacker can put code that controls the firmware updates onto a mac. This cannot be removed by software, and could do all sorts of nasty stuff. Anyone with physical access to the computer and a weaponized version of this exploit could do this. This in…
I seem to recall that FireWire ports were disabled in some way when the system was locked (tip: show Keychain Access icon in menubar to have a manual lock at a click's distance) and that such attacks therefore required the computer to be unlocked. Did I dream about that feature, and is that applicable to Thunderbolt?
[deleted]