Menu
Apple vulnerability could allow firmware modifications, researcher says

Apple vulnerability could allow firmware modifications, researcher says

Older Apple systems unlock the firmware after a computer goes to sleep

A firmware flaw in older Apple computers could allow an attacker to slip a rootkit onto the machine, a security researcher says.

A firmware flaw in older Apple computers could allow an attacker to slip a rootkit onto the machine, a security researcher says.

A zero-day software vulnerability in the firmware of older Apple computers could be used to slip hard-to-remove malware onto a computer, according to a security researcher.

Pedro Vilaca, who studies Mac security, wrote on his blog that the flaw he found builds on previous ones but this one could be far more dangerous. Apple officials could not be immediately reached for comment.

Vilaca found it was possible to tamper with an Apple computer's UEFI (unified extensible firmware interface). UEFI is firmware designed to improve upon BIOS, which is low-level code that bridges a computer's hardware and operating system at startup.

The UEFI code is typically sealed off from users. But Vilaca wrote that he found the code is unlocked after a computer goes to sleep and reawakens, allowing it to be modified. Apple computers made before mid-2014 appear to be vulnerable.

Vilaca wrote it is then possible to install a rootkit, a type of malware that is hard to remove and nearly undetectable by security products. The only defense is to not let the computer sleep and always shut it down, Vilaca wrote.

Apple released patches earlier this year for a similar type of attack called Thunderstrike, which allowed modification of the UEFI by accessing a Mac's Thunderbolt interface. Thunderstrike was presented by researcher Trammell Hudson at the Chaos Communication Congress in Hamburg last December.

But Thunderstrike required an attacker to have physical access to the computer. Vilaca thinks it may be possible to remotely exploit the bug he found, making it potentially a whole lot more dangerous.

He tested the attack on a MacBook Pro Retina, a MacBook Pro 8.2 and a MacBook Air, all running the latest EFI firmware available. Newer machines, however, were not vulnerable, which Vilaca wrote led him to suspect that Apple fixed the problem in later models but didn't patch older computers.

It appears that Vilaca did not notify Apple before disclosing the bug, something that causes many technology companies to bristle. Most companies advocate that independent researchers notify them before going public so attackers cannot take advantage of software problems before a patch is ready.

Vilaca wrote, however, that he has no beef with Apple. "My goal is to make OS X better and more secure," he wrote.

Vilaca isn't the only researcher looking closely at Apple's firmware. Hudson, who found the Thunderstrike bug, is scheduled to give a talk with Xeno Kovah and Corey Kallenberg at the Defcon security conference in August.

The presentation will show that Apple computers are vulnerable to many firmware attacks that affect PCs and demonstrate Mac malware in firmware, according to a description on the conference website.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags AppleExploits / vulnerabilities

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments