Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thunderstrike – Apple EFI firmware vulnerability

trmm.net

Post reply on HN
Print view View original

61–70 of 72 posts

Re: Thunderstrike – Apple EFI firmware vulnerability

#61

Post by phil21 »

lotyrin wrote: post #39
MichaelGG wrote: post #38

Earlier quoted context omitted.

It's s huge problem, and another curse Apple has gotten the rest of the laptop industry to adopt. Newer ThinkPads ship with Thunderbolt instead of DisplayPort. So if I want external monitors, I'm screwed. I can't just epoxy the port, like I did with FireWire.

AFAIK, it's not Thunderbolt on Lenovos, just Mini DisplayPort+Audio, which has similar connectors and cables but excludes the PCI-alike interface for high-speed general purpose IO which this exploits.

I suppose it may depend on the model, but all the modern Thinkpads I've seen rolling around the office in the past year or so come with thunderbolt.

Re: Thunderstrike – Apple EFI firmware vulnerability

#62

Post by q3k »

cstross wrote: post #9

Why Apple uses little-endian, while everything else uses big-endian, is another mystery. The Apple-I and Apple-II family were 6502 based machines and the 6502 was little-endian, would be my guess. Any takers?

This is not about the endianness of the processor, but about the endianness of the RSA signatures placed in the file - which is a programming decision, not an architecture/hardware one.

Apple machines are little-endian, as are any other IA32e machines. The rest of the common 'full' architectures (ARM, MIPS, Power, SPARC, ...) are bi-endian, that is they can switch endianness on demand via a register.

People have finally realized Little Endian is the only true endianness ;).

Re: Thunderstrike – Apple EFI firmware vulnerability

#64

Post by feld »

ricardobeat wrote: post #14

Is every security bug now going to get a fancy name? We'll run out pretty fast.

What I've experienced so far is that companies seem to care more if it gets press and a fancy name while every other CVE is ignored.

It's not a great trend but if that's what it takes to improve global security...

Re: Thunderstrike – Apple EFI firmware vulnerability

#65

Post by abritishguy »

hit8run wrote: post #63

Anyone noticed that the File Vault password also seems to leak? https://www.flickr.com/photos/osr/16139512701/lightbox So basically a File Vault disk encryption is useless? Any clarification would be welcome :)

That has been known since 2012

Re: Thunderstrike – Apple EFI firmware vulnerability

#66

Post by jhallenworld »

I did not realize that macs did not include a TPM... So there can be no equivalent to bitlocker for them. This seems like a big competitive disadvantage for them.

I suppose you could make a dongle with a tpm for macs.. Perhaps there would be a market for it.

Re: Thunderstrike – Apple EFI firmware vulnerability

#68

Post by jhallenworld »

walterbell wrote: post #33
csirac2 wrote: post #5

An amazing write-up. Although I am using my EE training a lot more at work these days, and I've designed my fair share of MCU (and USB, FPGA, analog...) projects I've never found the time to dip into learning even a fraction of the detail presented here on low-level modern x86 architecture. For me, reading this really hammers home just how feasible evil maid type attacks really are (considering attacks aimed at defea…

> Can anyone say how strong the x86/TPM-equipped machines out there are against malicious firmware updates, assuming one has their BIOS admin password set? A machine with VT-d (IOMMU), TPM and TXT is needed. http://theinvisiblethings.blogspot.com/2011/09/anti-evil-mai...

Heh, but be careful of (intentional?) bugs. I have seen some versions of UEFI which do not measure option ROMs for example.

Look for changes to pcr-2 and pcr-3 when you plug or unplug cards with option ROMs:

  cat /sys/devices/* /* /pcrs

Re: Thunderstrike – Apple EFI firmware vulnerability

#69

Post by mjg59 »

pzb wrote: post #47
mjg59 wrote: post #41

The attack as described is plausible on non-Apple hardware, provided that the system doesn't have UEFI Secure Boot enabled. If it does then you'd need a separate attack to circumvent the requirement for signed drivers. Also worth mentioning that this isn't specific to Thunderbolt - Expresscard also breaks out PCIe to an externally-accessible port.

I assume it was you that asked the question about Secure Boot at the end of this talk at 31C3?

Yeah - after the previous day's discussion on how pretty much every existing Secure Boot implementation was vulnerable to kernel-level attack, it was nice to hear about something that was fully prevented by Secure Boot.

Re: Thunderstrike – Apple EFI firmware vulnerability

#70

Post by tyilo »

hit8run wrote: post #63

Anyone noticed that the File Vault password also seems to leak? https://www.flickr.com/photos/osr/16139512701/lightbox So basically a File Vault disk encryption is useless? Any clarification would be welcome :)

From the FAQ: Can it actually decrypt FileVault? Thunderstrike can not directly decrypt FileVault keys, but it does record the password the user types in to decrypt an encrypted boot volume and could use other data exfiltration techniques to send the key to the attacker's system.
Post reply on HN