News for hackers. Stuff that matters.
Re:Mac OS High Sierra automatically checks EFI firmware each... by magnat on Monday September 25, 2017 @02:41AM (#15328485)
Surely a firmware rootkit can prevent eficheck from accessing TPM altogether or force the program to report everything is OK. If eficheck is not unsealing secrets stored in TPM, what would be benefits of checking PCRs?
Re:Mac OS High Sierra automatically checks EFI firmware each... by zeep on Monday September 25, 2017 @03:37AM (#15328632)
Couldn't it simply replace eficheck and not worry about anything else?
Re:Mac OS High Sierra automatically checks EFI firmware each... by bdonlan on Monday September 25, 2017 @06:25AM (#15329264)
That depends - it's possible to have a first stage bootloader in mask or OTP ROM that hashes the firmware before passing off control. No idea if Macs do this though.
Re:Mac OS High Sierra automatically checks EFI firmware each... by magnat on Monday September 25, 2017 @08:19AM (#15329773)
Why bother with providing userland tool then? If you have complete chain of trust, the tool can just MsgBox("Everything's OK") because you wouldn't be able to boot OS if EFI didn't pass the check. If you don't have a chain of trust, the tool can be easily tampered with by the rootkit. Either way - it serves no real security purpose other than perhaps reassuring user or detecting obsolete, existing rootkits.
Re:Mac OS High Sierra automatically checks EFI firmware each... by amluto on Monday September 25, 2017 @11:26AM (#15331203)
A lot of newer Intel CPUs can be programmed, via fuses, to refuse to boot unless the first-stage firmware hashes to a specified value.
Re:Mac OS High Sierra automatically checks EFI firmware each... by rothbardrand on Monday September 25, 2017 @09:18AM (#15330151)
I do believe the whole point of the TPM on macs is the make sure the firmware and ultimately OS is signed with Apple keys.
Re:Mac OS High Sierra automatically checks EFI firmware each... by amluto on Monday September 25, 2017 @11:25AM (#15331189)
In principle, eficheck could attest to the firmware's health to an Apple server. It's not entirely clear what it would accomplish UI-wise, though.