Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thunderstrike – Apple EFI firmware vulnerability

trmm.net

Post reply on HN
Print view View original

31–40 of 72 posts

Re: Thunderstrike – Apple EFI firmware vulnerability

#31

Post by lnanek2 »

eps wrote: post #6
lloeki wrote: post #4

Earlier quoted context omitted.

I seem to recall that FireWire ports were disabled in some way when the system was locked (tip: show Keychain Access icon in menubar to have a manual lock at a click's distance) and that such attacks therefore required the computer to be unlocked. Did I dream about that feature, and is that applicable to Thunderbolt?

Described exploit requires a reboot, so it doesn't matter if the computer is locked or not.

The article claims he can trigger the reboot from the device, although that wasn't implemented in the proof of concept.

Re: Thunderstrike – Apple EFI firmware vulnerability

#32

Post by ricardobeat »

huhtenberg wrote: post #18
ricardobeat wrote: post #14

Is every security bug now going to get a fancy name? We'll run out pretty fast.

Go read the article, then decide if you snark is appropriate and substantiated.

I did read the article and found it extremely interesting. My comment is not detracting of the work itself.

Re: Thunderstrike – Apple EFI firmware vulnerability

#33

Post by walterbell »

csirac2 wrote: post #5

An amazing write-up. Although I am using my EE training a lot more at work these days, and I've designed my fair share of MCU (and USB, FPGA, analog...) projects I've never found the time to dip into learning even a fraction of the detail presented here on low-level modern x86 architecture. For me, reading this really hammers home just how feasible evil maid type attacks really are (considering attacks aimed at defea…

> Can anyone say how strong the x86/TPM-equipped machines out there are against malicious firmware updates, assuming one has their BIOS admin password set?

A machine with VT-d (IOMMU), TPM and TXT is needed.

http://theinvisiblethings.blogspot.com/2011/09/anti-evil-mai...

Re: Thunderstrike – Apple EFI firmware vulnerability

#35

Post by wmf »

twoodfin wrote: post #27
userbinator wrote: post #21

As I mentioned in a previous discussion here ( https://news.ycombinator.com/item?id=8779696 ), Thunderbolt is basically "external PCIe" so you wouldn't want to plug in anything that you wouldn't plug into a PCIe slot on the motherboard of a desktop... it's not like USB where communication has to go through a special controller that requires drivers, this is the raw system bus itself. Note that what Apple refers to as…

Thunderbolt is basically "external PCIe" so you wouldn't want to plug in anything that you wouldn't plug into a PCIe slot on the motherboard of a desktop... it's not like USB where communication has to go through a special controller that requires drivers, this is the raw system bus itself. As cool as the raw power you get from Thunderbolt is, I wonder if externalizing an internal bus was a fundamental design flaw. P…

That's not surprising since Intel's whole business is built on backwards compatibility. And the benefits are pretty clear: Thunderbolt devices can use existing PCIe chips and drivers. If it was an incompatible protocol then it would require new TB-to-X chips for all X, and since the Thunderbolt market probably isn't large enough to support those chips then it would just fail.

Re: Thunderstrike – Apple EFI firmware vulnerability

#36

Post by errata »

goo wrote: post #2

I often come to the comment section looking for a summary of a dense article like this. Didn't find it, so here is my best shot at one: Through the thunderbolt port, an attacker can put code that controls the firmware updates onto a mac. This cannot be removed by software, and could do all sorts of nasty stuff. Anyone with physical access to the computer and a weaponized version of this exploit could do this. This in…

Just note that the 2014 iMac Retina and Mac mini are (at least paritally) not longer vulnerable to this.

Re: Thunderstrike – Apple EFI firmware vulnerability

#37

Post by bravo22 »

There is an interesting opportunity here for a Thunderbolt "condom". You would permanently attach it to your Mac's TB port -- and plug everything through that. It would block Snare attacks by detecting/preventing PCIe reads in a certain address range.

During boot time, it would read your BootROM and compare it against a known good and visually let you know if your ROM is compromised or not.

Re: Thunderstrike – Apple EFI firmware vulnerability

#38

Post by MichaelGG »

twoodfin wrote: post #27
userbinator wrote: post #21

As I mentioned in a previous discussion here ( https://news.ycombinator.com/item?id=8779696 ), Thunderbolt is basically "external PCIe" so you wouldn't want to plug in anything that you wouldn't plug into a PCIe slot on the motherboard of a desktop... it's not like USB where communication has to go through a special controller that requires drivers, this is the raw system bus itself. Note that what Apple refers to as…

Thunderbolt is basically "external PCIe" so you wouldn't want to plug in anything that you wouldn't plug into a PCIe slot on the motherboard of a desktop... it's not like USB where communication has to go through a special controller that requires drivers, this is the raw system bus itself. As cool as the raw power you get from Thunderbolt is, I wonder if externalizing an internal bus was a fundamental design flaw. P…

It's s huge problem, and another curse Apple has gotten the rest of the laptop industry to adopt. Newer ThinkPads ship with Thunderbolt instead of DisplayPort. So if I want external monitors, I'm screwed. I can't just epoxy the port, like I did with FireWire.

Re: Thunderstrike – Apple EFI firmware vulnerability

#39

Post by lotyrin »

MichaelGG wrote: post #38
twoodfin wrote: post #27

Earlier quoted context omitted.

Thunderbolt is basically "external PCIe" so you wouldn't want to plug in anything that you wouldn't plug into a PCIe slot on the motherboard of a desktop... it's not like USB where communication has to go through a special controller that requires drivers, this is the raw system bus itself. As cool as the raw power you get from Thunderbolt is, I wonder if externalizing an internal bus was a fundamental design flaw. P…

It's s huge problem, and another curse Apple has gotten the rest of the laptop industry to adopt. Newer ThinkPads ship with Thunderbolt instead of DisplayPort. So if I want external monitors, I'm screwed. I can't just epoxy the port, like I did with FireWire.

AFAIK, it's not Thunderbolt on Lenovos, just Mini DisplayPort+Audio, which has similar connectors and cables but excludes the PCI-alike interface for high-speed general purpose IO which this exploits.

Re: Thunderstrike – Apple EFI firmware vulnerability

#40

Post by mmmaaaxxx »

bravo22 wrote: post #37

There is an interesting opportunity here for a Thunderbolt "condom". You would permanently attach it to your Mac's TB port -- and plug everything through that. It would block Snare attacks by detecting/preventing PCIe reads in a certain address range. During boot time, it would read your BootROM and compare it against a known good and visually let you know if your ROM is compromised or not.

It is my understanding that verifying the BootROM is not possible once infected with sufficiently malicious code. I talked with Trammell about this briefly and my takeaway was that once you have code on the BootROM, you can control how code is read from the BootROM, making it possible to present the appearance of a non-compromised ROM image.

To the best of my knowledge, the only solution is something sitting on top of the BootROM chip, monitoring for writes. It may also be possible to alter the write-protect/write-enable pin (forget which it has) on the ROM to prevent all writes.

Post reply on HN