Menu
Apple vulnerability could allow firmware modifications, researcher says

Apple vulnerability could allow firmware modifications, researcher says

Older Apple systems unlock the firmware after a computer goes to sleep

A firmware flaw in older Apple computers could allow an attacker to slip a rootkit onto the machine, a security researcher says.

A firmware flaw in older Apple computers could allow an attacker to slip a rootkit onto the machine, a security researcher says.

A zero-day software vulnerability in the firmware of older Apple computers could be used to slip hard-to-remove malware onto a computer, according to a security researcher.

Pedro Vilaca, who studies Mac security, wrote on his blog that the flaw he found builds on previous ones but this one could be far more dangerous. Apple officials could not be immediately reached for comment.

Vilaca found it was possible to tamper with an Apple computer's UEFI (unified extensible firmware interface). UEFI is firmware designed to improve upon BIOS, which is low-level code that bridges a computer's hardware and operating system at startup.

The UEFI code is typically sealed off from users. But Vilaca wrote that he found the code is unlocked after a computer goes to sleep and reawakens, allowing it to be modified. Apple computers made before mid-2014 appear to be vulnerable.

Vilaca wrote it is then possible to install a rootkit, a type of malware that is hard to remove and nearly undetectable by security products. The only defense is to not let the computer sleep and always shut it down, Vilaca wrote.

Apple released patches earlier this year for a similar type of attack called Thunderstrike, which allowed modification of the UEFI by accessing a Mac's Thunderbolt interface. Thunderstrike was presented by researcher Trammell Hudson at the Chaos Communication Congress in Hamburg last December.

But Thunderstrike required an attacker to have physical access to the computer. Vilaca thinks it may be possible to remotely exploit the bug he found, making it potentially a whole lot more dangerous.

He tested the attack on a MacBook Pro Retina, a MacBook Pro 8.2 and a MacBook Air, all running the latest EFI firmware available. Newer machines, however, were not vulnerable, which Vilaca wrote led him to suspect that Apple fixed the problem in later models but didn't patch older computers.

It appears that Vilaca did not notify Apple before disclosing the bug, something that causes many technology companies to bristle. Most companies advocate that independent researchers notify them before going public so attackers cannot take advantage of software problems before a patch is ready.

Vilaca wrote, however, that he has no beef with Apple. "My goal is to make OS X better and more secure," he wrote.

Vilaca isn't the only researcher looking closely at Apple's firmware. Hudson, who found the Thunderstrike bug, is scheduled to give a talk with Xeno Kovah and Corey Kallenberg at the Defcon security conference in August.

The presentation will show that Apple computers are vulnerable to many firmware attacks that affect PCs and demonstrate Mac malware in firmware, according to a description on the conference website.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags ApplesecurityExploits / vulnerabilities

Featured

Slideshows

Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Show Comments