Apple vulnerability could allow firmware modifications, researcher says

Older Apple systems unlock the firmware after a computer goes to sleep

A firmware flaw in older Apple computers could allow an attacker to slip a rootkit onto the machine, a security researcher says.

A firmware flaw in older Apple computers could allow an attacker to slip a rootkit onto the machine, a security researcher says.

A zero-day software vulnerability in the firmware of older Apple computers could be used to slip hard-to-remove malware onto a computer, according to a security researcher.

Pedro Vilaca, who studies Mac security, wrote on his blog that the flaw he found builds on previous ones but this one could be far more dangerous. Apple officials could not be immediately reached for comment.

Vilaca found it was possible to tamper with an Apple computer's UEFI (unified extensible firmware interface). UEFI is firmware designed to improve upon BIOS, which is low-level code that bridges a computer's hardware and operating system at startup.

The UEFI code is typically sealed off from users. But Vilaca wrote that he found the code is unlocked after a computer goes to sleep and reawakens, allowing it to be modified. Apple computers made before mid-2014 appear to be vulnerable.

Vilaca wrote it is then possible to install a rootkit, a type of malware that is hard to remove and nearly undetectable by security products. The only defense is to not let the computer sleep and always shut it down, Vilaca wrote.

Apple released patches earlier this year for a similar type of attack called Thunderstrike, which allowed modification of the UEFI by accessing a Mac's Thunderbolt interface. Thunderstrike was presented by researcher Trammell Hudson at the Chaos Communication Congress in Hamburg last December.

But Thunderstrike required an attacker to have physical access to the computer. Vilaca thinks it may be possible to remotely exploit the bug he found, making it potentially a whole lot more dangerous.

He tested the attack on a MacBook Pro Retina, a MacBook Pro 8.2 and a MacBook Air, all running the latest EFI firmware available. Newer machines, however, were not vulnerable, which Vilaca wrote led him to suspect that Apple fixed the problem in later models but didn't patch older computers.

It appears that Vilaca did not notify Apple before disclosing the bug, something that causes many technology companies to bristle. Most companies advocate that independent researchers notify them before going public so attackers cannot take advantage of software problems before a patch is ready.

Vilaca wrote, however, that he has no beef with Apple. "My goal is to make OS X better and more secure," he wrote.

Vilaca isn't the only researcher looking closely at Apple's firmware. Hudson, who found the Thunderstrike bug, is scheduled to give a talk with Xeno Kovah and Corey Kallenberg at the Defcon security conference in August.

The presentation will show that Apple computers are vulnerable to many firmware attacks that affect PCs and demonstrate Mac malware in firmware, according to a description on the conference website.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityAppleExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?