Re:Thunderstrike – Apple EFI firmware vulnerability
by lloeki on Thursday January 01, 2015 @07:09AM
(#8822726)
I seem to recall that FireWire ports were disabled in some way when the system was locked (tip: show Keychain Access icon in menubar to have a manual lock at a click's distance) and that such attacks therefore required the computer to be unlocked.
Did I dream about that feature, and is that applicable to Thunderbolt?
Re:Thunderstrike – Apple EFI firmware vulnerability
by eps on Thursday January 01, 2015 @07:38AM
(#8822767)
Described exploit requires a reboot, so it doesn't matter if the computer is locked or not.
Re:Thunderstrike – Apple EFI firmware vulnerability
by lnanek2 on Thursday January 01, 2015 @01:23PM
(#8823694)
The article claims he can trigger the reboot from the device, although that wasn't implemented in the proof of concept.
Re:Thunderstrike – Apple EFI firmware vulnerability
by danesparza on Thursday January 01, 2015 @09:44AM
(#8823041)
In-lining this exploit in a bit of cable would be fairly trivial. This is a nasty one.
Re:Thunderstrike – Apple EFI firmware vulnerability
by errata on Thursday January 01, 2015 @04:34PM
(#8824394)
Just note that the 2014 iMac Retina and Mac mini are (at least paritally) not longer vulnerable to this.
Re:Thunderstrike – Apple EFI firmware vulnerability
by spacefight on Thursday January 01, 2015 @07:01AM
(#8822713)
+1 for using the term "weaponize".
Through the thunderbolt port, an attacker can put code that controls the firmware updates onto a mac. This cannot be removed by software, and could do all sorts of nasty stuff.
Anyone with physical access to the computer and a weaponized version of this exploit could do this. This includes intercepting hardware en-route to its recipients, spending a few minutes with a laptop while its owners are away, or while crossing international borders.
According to the author, this exploit works with every Mac with a thunderbolt port that they tested. Apple has a partial fix coming as a firmware update soon, but the author expresses concern that the proposed fix could still be bypassed.