Apple vulnerability could allow firmware modifications, researcher says

Older Apple systems unlock the firmware after a computer goes to sleep

A firmware flaw in older Apple computers could allow an attacker to slip a rootkit onto the machine, a security researcher says.

A firmware flaw in older Apple computers could allow an attacker to slip a rootkit onto the machine, a security researcher says.

A zero-day software vulnerability in the firmware of older Apple computers could be used to slip hard-to-remove malware onto a computer, according to a security researcher.

Pedro Vilaca, who studies Mac security, wrote on his blog that the flaw he found builds on previous ones but this one could be far more dangerous. Apple officials could not be immediately reached for comment.

Vilaca found it was possible to tamper with an Apple computer's UEFI (unified extensible firmware interface). UEFI is firmware designed to improve upon BIOS, which is low-level code that bridges a computer's hardware and operating system at startup.

The UEFI code is typically sealed off from users. But Vilaca wrote that he found the code is unlocked after a computer goes to sleep and reawakens, allowing it to be modified. Apple computers made before mid-2014 appear to be vulnerable.

Vilaca wrote it is then possible to install a rootkit, a type of malware that is hard to remove and nearly undetectable by security products. The only defense is to not let the computer sleep and always shut it down, Vilaca wrote.

Apple released patches earlier this year for a similar type of attack called Thunderstrike, which allowed modification of the UEFI by accessing a Mac's Thunderbolt interface. Thunderstrike was presented by researcher Trammell Hudson at the Chaos Communication Congress in Hamburg last December.

But Thunderstrike required an attacker to have physical access to the computer. Vilaca thinks it may be possible to remotely exploit the bug he found, making it potentially a whole lot more dangerous.

He tested the attack on a MacBook Pro Retina, a MacBook Pro 8.2 and a MacBook Air, all running the latest EFI firmware available. Newer machines, however, were not vulnerable, which Vilaca wrote led him to suspect that Apple fixed the problem in later models but didn't patch older computers.

It appears that Vilaca did not notify Apple before disclosing the bug, something that causes many technology companies to bristle. Most companies advocate that independent researchers notify them before going public so attackers cannot take advantage of software problems before a patch is ready.

Vilaca wrote, however, that he has no beef with Apple. "My goal is to make OS X better and more secure," he wrote.

Vilaca isn't the only researcher looking closely at Apple's firmware. Hudson, who found the Thunderstrike bug, is scheduled to give a talk with Xeno Kovah and Corey Kallenberg at the Defcon security conference in August.

The presentation will show that Apple computers are vulnerable to many firmware attacks that affect PCs and demonstrate Mac malware in firmware, according to a description on the conference website.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags ApplesecurityExploits / vulnerabilities

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?