Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thunderstrike – Apple EFI firmware vulnerability

trmm.net

Post reply on HN
Print view View original

51–60 of 72 posts

Re: Thunderstrike – Apple EFI firmware vulnerability

#51

Post by wigigpci »

bravo22 wrote: post #48
wigigpci wrote: post #44

I can't wait for the same demo next year, but wireless. I wish I were joking: The WiGig Bus Extension (WBE), which can enable a wireless version of the PCI Express (PCIe) slots used to connect everything from video cards to hard drives. WBE is now a published specification available to members of the consortium. WiGig Bus Extension (WBE) aka PCIe over Wi-Fi, coming to a laptop near you.

There is already a wireless USB. WBE would essentially replace the cable. It is invisible to upper stacks. There is encryption/scrambling. I'm sure there are vectors for snooping attacks but I don't see viable "imitation" attacks where you could issue commands on behalf of the other device.

No need to issue commands, just provide an Option ROM over Wi-Fi like this attack. It's the same PCI protocol after all, just over Wi-Fi...

Re: Thunderstrike – Apple EFI firmware vulnerability

#52

Post by 13 »

bravo22 wrote: post #49
13 wrote: post #45

Earlier quoted context omitted.

I'll have to find the data sheet, but it should be very possible to pull a pin high or low to disable writing to the chip itself. I doubt they do any checks for being able to write to the chip in software, that would just wear out the flash unnecessarily.

SPI flash has a write disable pin but that would also prevent Apple updates.

Could bodge in a physical switch for write protect.

Re: Thunderstrike – Apple EFI firmware vulnerability

#53

Post by userbinator »

twoodfin wrote: post #27
userbinator wrote: post #21

As I mentioned in a previous discussion here ( https://news.ycombinator.com/item?id=8779696 ), Thunderbolt is basically "external PCIe" so you wouldn't want to plug in anything that you wouldn't plug into a PCIe slot on the motherboard of a desktop... it's not like USB where communication has to go through a special controller that requires drivers, this is the raw system bus itself. Note that what Apple refers to as…

Thunderbolt is basically "external PCIe" so you wouldn't want to plug in anything that you wouldn't plug into a PCIe slot on the motherboard of a desktop... it's not like USB where communication has to go through a special controller that requires drivers, this is the raw system bus itself. As cool as the raw power you get from Thunderbolt is, I wonder if externalizing an internal bus was a fundamental design flaw. P…

Option ROMs are certainly useful - for example, every GPU has one to initialise it, and it's how devices like RAID controllers can be used for booting or network cards adding PXE support. Things like putting a standard GPU over Thunderbolt would've been very difficult to do otherwise.

However, you're right that the security characteristics of an external bus are quite different from an internal one. I haven't looked in detail at the specs but I've worked with PCI/PCIe and it should certainly be possible to distinguish between a device plugged into the external port (it likely appears as a separate bus with a PCI-PCI bridge) and an internal one, allowing a BIOS (EFI, whatever it's called these days) option to control it. Something like "Execute Thunderbolt Option ROM [Yes/No/Prompt]"? But then, knowing Apple, they'd be more inclined to want everything to "just work" and default it to Yes without allowing the user to change it...

Re: Thunderstrike – Apple EFI firmware vulnerability

#54

Post by wcfields »

ricardobeat wrote: post #32
huhtenberg wrote: post #18

Earlier quoted context omitted.

Go read the article, then decide if you snark is appropriate and substantiated.

I did read the article and found it extremely interesting. My comment is not detracting of the work itself.

Same reason that hurricanes (and now powerful tornados) are named.

Naming something makes it more real as a thing and easy to speak about.

Re: Thunderstrike – Apple EFI firmware vulnerability

#57

Post by post_break »

dingaling wrote: post #43
Veratyr wrote: post #42

Earlier quoted context omitted.

Definitely more than 'arguably' more useful. The intervalometer alone fills in for a $129 piece of hardware [0] and the HDR recording, although far from the standard of a Blackmagic camera, allows a $500 consumer SLR to produce HDR video where a $2000 camera would normally be required. And those are just the features I could easily equate to money. There's also the zebra striping and so many other features I can't th…

Interestingly the developers of Magic Lantern have explicitly stated that they will never develop it for the pro 1D and C ranges of cameras. Apparently this is a result of some informal or undisclosed agreement with Canon, as the pro cameras are where Canon's recurring revenue lies.

It's probably a threat. Enable ML for the pro series cameras, and we encrypt boot loaders etc. Or even sue. But don't touch them and we'll have a gentlemen's agreement.

Re: Thunderstrike – Apple EFI firmware vulnerability

#58

Post by MichaelGG »

lotyrin wrote: post #39
MichaelGG wrote: post #38

Earlier quoted context omitted.

It's s huge problem, and another curse Apple has gotten the rest of the laptop industry to adopt. Newer ThinkPads ship with Thunderbolt instead of DisplayPort. So if I want external monitors, I'm screwed. I can't just epoxy the port, like I did with FireWire.

AFAIK, it's not Thunderbolt on Lenovos, just Mini DisplayPort+Audio, which has similar connectors and cables but excludes the PCI-alike interface for high-speed general purpose IO which this exploits.

The W540 has Thunderbolt, but also miniDP. I guess that's OK. But seeing as how they try to ape Apple, who knows what the next gen will bring.

Re: Thunderstrike – Apple EFI firmware vulnerability

#59

Post by bravo22 »

wigigpci wrote: post #51
bravo22 wrote: post #48

Earlier quoted context omitted.

There is already a wireless USB. WBE would essentially replace the cable. It is invisible to upper stacks. There is encryption/scrambling. I'm sure there are vectors for snooping attacks but I don't see viable "imitation" attacks where you could issue commands on behalf of the other device.

No need to issue commands, just provide an Option ROM over Wi-Fi like this attack. It's the same PCI protocol after all, just over Wi-Fi...

PCIe is a bus. It is the drivers that would choose to read and execute option ROM. It isn't part of the protocol actually.

If your peripheral device is compromised by a third party (say NSA) then it doesn't matter if it is over wireless or cable.

Re: Thunderstrike – Apple EFI firmware vulnerability

#60

Post by bravo22 »

jschwartzi wrote: post #50
bravo22 wrote: post #37

There is an interesting opportunity here for a Thunderbolt "condom". You would permanently attach it to your Mac's TB port -- and plug everything through that. It would block Snare attacks by detecting/preventing PCIe reads in a certain address range. During boot time, it would read your BootROM and compare it against a known good and visually let you know if your ROM is compromised or not.

This is one of the original purposes for the Trusted Platform Module which Apple has never used and no longer even includes in their hardware.

Indeed.
Post reply on HN