Macs Vulnerable To Userland Injected EFI Rootkits 82
Bismillah writes that a new vulnerability in recent Macs — and potentially older ones — can be used to plant code such as rootkits into areas of EFI memory that shouldn't be writeable, but become unlocked after the computer wakes up from sleep mode. The article explains that [The vulnerability] appears to be due to a bug in Apple's sleep-mode energy conservation implementation that can leave areas of memory in the extensible firmware interface (EFI) (which provides low-level hardware control and access) writeable from user accounts on the computer.
Memory areas are normally locked as read-only to protect them.
However, putting some late-model Macs to sleep for around 20 seconds and then waking them up unlocks the EFI memory for writing.
Still needs another vulnerability (Score:5, Insightful)
FTFA:
The researcher who discovered the flaw, Pedro Vilaça, said the vulnerability can be used to (some examples) that is invisible to the operating system in the writeable flash memory
So to summarize: as a user, you can sometimes write to EFI memory.
That's currently all there is to it. There's no rootkit, there's no malware, etc. Just this space where you can hide and survive an OS wipe and reinstall.
I'm sure some will come up with a payload that uses this space to hide itself, no doubt about it. But currently, this is all there is to it.
Re: (Score:3, Interesting)
Oh, I know how to solve this one. There's a bug in the EFI capsule update mechanism that allows to install unsigned firmware updates if you have root.
Now combine it with this bug, and you can corrupt an EFI update initiated by root from an unprivileged account. Essentially, wait for the next EFI update and you get arbitrary code execution from Ring 3, userland, to Ring -3, the firmware.
Re: (Score:3, Informative)
It's enough to make such a thing. Just lurk until it becomes writable, then make good use of it. Much simpler than stealing keys from the next VM over by cache-timing attacks, and we've seen those to be viable. So insisting on proof for what ought to be obvious is maybe a bit facetious.
This thing is also more indication that EFI actually makes peecees more insecure because there's another layer of software running with even more privileges than the OS itself, and it's closed-source firmware. Crappy firmware
Re: (Score:2)
Blame Intel with their idiotic system management mode. The person who thought that was a good idea should have been fired on the spot instead of the damn thing actually being implemented since the 386.
Re: (Score:3)
I think you will find that SMM debuted in the 386SL and continued in the 486SL begore becoming mainstream in the Pentium.
Those processor codes should give you a clue as to what it's original purpose was and why it came about.
Re: (Score:2)
You don't need a special processor mode to do power management FFS.
Re: (Score:2)
you mean like the downward facing call-stack which has provided so many buffer overflows over the years? seems to me like they've been breeding fast inside Intel...
(pun intended)
Re: (Score:2)
EFI does not run with more privileges than the OS.
Re:Still needs another vulnerability (Score:4, Interesting)
still ring-0. quite a big deal...
Re: (Score:1)
FTFA: The researcher who discovered the flaw, Pedro VilaÃa, said the vulnerability can be used to (some examples) that is invisible to the operating system in the writeable flash memory
So to summarize: as a user, you can sometimes write to EFI memory. That's currently all there is to it. There's no rootkit, there's no malware, etc. Just this space where you can hide and survive an OS wipe and reinstall. I'm sure some will come up with a payload that uses this space to hide itself, no doubt about it. But currently, this is all there is to it.
This *is* the vulnerability. The EFI loads the OS. If you can overwrite the EFI, game over. The OS will do whatever the new rootkit-EFI that loaded it tells it to do.
Re:Still needs another vulnerability (Score:5, Insightful)
So to summarize: as a user, you can sometimes write to EFI memory.
That's currently all there is to it. There's no rootkit, there's no malware, etc. Just this space where you can hide and survive an OS wipe and reinstall.
Yes - it is a vulnerability for which there is no exploit published (yet).
This vulnerability is serious, as it allows an attacker to permanently infect the Mac *firmware* and gain control each time the Mac is booted - even if you nuke and reinstall OS X.
You may try to dismiss this as "still needs another vulnerability". Another vulnerability or even a social engineering attack, evil maid attack will all suffice. This one can be used to take permanent, undetected residence on successfully exploited macs.
That's bad in my book
Re: (Score:2)
So to summarize: as a user, you can sometimes write to EFI memory.
That's currently all there is to it. There's no rootkit, there's no malware, etc. Just this space where you can hide and survive an OS wipe and reinstall.
Yes - it is a vulnerability for which there is no exploit published (yet).
This vulnerability is serious, as it allows an attacker to permanently infect the Mac *firmware* and gain control each time the Mac is booted - even if you nuke and reinstall OS X.
You may try to dismiss this as "still needs another vulnerability". Another vulnerability or even a social engineering attack, evil maid attack will all suffice. This one can be used to take permanent, undetected residence on successfully exploited macs.
That's bad in my book
Hey, dont try to use logic and reason here.
Re: (Score:1)
That's bad in my book
Well, i'd say.. If it can't be erased or written over, nothing short of replacing the peocessor would save the MAc. But shouldnb't you be able to overwrite any malkware? if it can be accessed once, then surely again..
Re:Still needs another vulnerability (Score:4, Interesting)
"Previous owner" isn't a scary vulnerability for exploits that live at the OS level; all the refurb stuff typically gets wiped once by the refurb house during their testing process, and re-imaged when it reaches the customer; but it is damn scary for firmware-level exploits. Especially motherboard firmware(HDD firmware exploits are scary; but taking out the HDD and shredding it, then replacing it with another low-capacity-everything-is-on-the-network-anyway boot disk is at least cheap); which compromises the system at a scary-deep level, and also compromises the component that makes up most of the value of the computer.
Without a good OS-level vector, preferably with a nice internet infection capability, it isn't a good candidate for a pandemic; but if this sort of firmware fuckery makes the used market about as reliable as buying street drugs, it will have a major impact.
Re: (Score:2)
Actually, it does. What happens if someone resells a mac w/ an EFI hack installed?
Re: (Score:2)
If there's potentially malware that embeds itself hard enough to resist a disk wipe, or even replacement, you have to worry about the prior owner's security, incompetence, potential malice, etc. And that's even if you aren't cool enough to have the NSA 'implant' teams intercepting your mail.
Given the size of the secondary market for things with firmware in th
Re: (Score:2)
The LOMs are a real concern. Some more than others. The ones that are just bridged into the ethernet and have a serial prot connection (possibly connection to the video card) are not TOO risky as long as they are kept off of the public internet (sadly, many aren't isolated), but some also have JTAG connections to the main system. They can do absolutely anything they want to the server including hot patching the OS..
Re: (Score:3)
"Just this space where you can hide and survive an OS wipe and reinstall." IF the user only put the unit to sleep and then woke it. Simply turning off the unit for a short time before OS wipe and reinstall defeats this potential hole.
I am betting that Windows, BSD, and Linux have a similar vulnerability lurking.
Re: (Score:2)
"Just this space where you can hide and survive an OS wipe and reinstall." IF the user only put the unit to sleep and then woke it. Simply turning off the unit for a short time before OS wipe and reinstall defeats this potential hole.
I am betting that Windows, BSD, and Linux have a similar vulnerability lurking.
IF they're on the same hardware. This is a vulnerability with the EFI on Apple computers. Because the hardware and firmware are different the same vulnerability is likely not exist with the EFI on IBM servers.
Also you're wrong about turning it off for a short time. This is basically the same as the flaws that lead to the old BIOS viruses. As malware can hide in the EFI it doesn't care what you do with the OS as the EFI is completely independent of it.
Re: What sort of fucking idiot are you? (Score:1)
You mad bro?
recent = made before mid 2014 (Score:5, Informative)
Vilaça believes Apple is aware of the issue - his testing shows the flaw is not found in the firmware of Macs made after mid 2014.
Re: (Score:3, Insightful)
VilaÃa believes Apple is aware of the issue - his testing shows the flaw is not found in the firmware of Macs made after mid 2014
How kind of Apple to publish a security advisory on the issue, like a reputable and scrupulous vendor would have done.
Re: (Score:2)
It could be just that they accidentally fixed the bug with other updates or just had not realized that what was they were fixing was a security vulnerability.
That's true, I shouldn't ascribe to malicious incompetence what may be due to simple incompetence.
Re: (Score:3)
Vilaça believes Apple is aware of the issue - his testing shows the flaw is not found in the firmware of Macs made after mid 2014
How kind of Apple to publish a security advisory on the issue, like a reputable and scrupulous vendor would have done.
Note the sentence in the article that wasn't quoted by the previous poster but which immediately followed it...
He did not disclose the flaw to Apple.
So, this is a flaw that Apple has not been notified about, which only exists in older hardware, and which is fiddly enough that the researcher can't explain why it's being caused, but does know that it needs to be targeted for specific machines. It's entirely likely that because this issue must be targeted at specific versions of firmware for each model that whatever fiddly bits were making it poss
Will anyone exploit it? (Score:1, Interesting)
With Mac's making up about 6% or so of PC market. Does anyone care about doing attacks on OS X or Mac's? In fact, it does seem the direction towards attacks made outside of singular device hardware is becoming more popular. Attacking routers, severs, even cloud based systems. Or direct attacks against certain systems that guarantee financial gain. Such as personal information, or other private information that can be sold. Maybe the NSA still wants to rootlet your Mac. But most hackers want monetary gains
Re:Will anyone exploit it? (Score:5, Insightful)
Targeting OS X is tempting because of 99% of all Mac users *knows* that "Macs can't get infected" (the Apple salespeople told them so), and therefore they don't have any kind of antivirus installed.
At work, I daily deal with Mac-users who gets their mailaccounts hijacked because of infections. It takes roughly 10-20 minutes to convince them to download and run Avast or something like that, but it's worth the "oh....".
Out if interest, what "infections"? Do you have any examples. That's clearly a big issue if you're dealing with it daily. What infections are we talking about here?
Not that I'm doubting your story or anything.
(NECESSARY DISCLAIMER: I AM NOT CLAIMING THAT OS X CANNOT GET INFECTIONS)
Re: (Score:1)
AIDS, Hepatitis, GC, Herpes - Mac users can get all sorts of infections. It's really scary sometimes.
Re: (Score:2)
Keep in mind malware = virus for most computer users.
I myself have cleaned two MacBooks of malware in the last six months. We don't use them here at work, but I had a neighbour bring over their two MacBooks because they had a "virus".
It turns out their children (adult children!) were going to free TV sites and the like and had their web browsers taken over (yes, including Safari. They had two browsers on these laptops, Chrome and Safari). Both ma
Re: (Score:1)
They will probably get an iPad and think that is safe... Well, they will if they are anything like my Apple loving chess-playing friend. I am his tech support which sucks as I have only owned a MBP once since the ][e days. Search engines and it being a form of UNIX are all that make me look good, even then it sometimes takes a day or two for turnaround.
Re: (Score:2, Informative)
I see your education on macs and OSX is so horribly outdated that your comment is essentially useless. Many do worry about it this is why several virus scanner companies are making products for OSX. Hell you can even get a free Avast for OSX. They would not even bothered if people were not asking for it.
Re:Will anyone exploit it? (Score:4, Informative)
Note that "people" are probably CIO's of Fortune 500's.
As an engineer who was doing programming and systems work in engineering, I evangelized Linux for a decade and a half at a Fortune 250. When someone in IT finally took a look at it, they, of course, demanded that it have a virus scanner. (To be fair, this was near one of the really big Windows outbreaks.) One of the AV companies had actually released a Linux version, so I just calmly told him about it, and stroked his notion that Linux was actually ready for the desktop, even though I thought the whole idea a complete waste of time. In my opinion, cleaning up whatever MIGHT have been caused by a Linux infection would never have been worth the traded performance and administrative overhead of installing it and keeping it updated.
Seems to me that this scenario might be playing out again, as OS X is actually a viable corporate desktop now. Again, I don't think the level of risk warrants the level of cost, but that's not my call. Having a "corporatized" AV (like the Symantec monstrosity that frequently stalls this high-end Dell mobile workstation) is a checkbox that would open the door to corporate deployments of Macs.
Re: Will anyone exploit it? (Score:3, Insightful)
If I had mod points, you'd have em. Institutional policy is the prime reason that AV exists for Macs. AV companies saw Macs coming into the workplace at greater rates due to the proliferation of iDevices and the frustration of using Windows 8 and decided a Mac version of their software might be profitable. No other reason than that. The primary marketing tactic from those companies was to protect your inbox so you didn't accidentally forward a PC virus along. In 8 years of Mac ownership, my AV (yes, I'm a M
Re: (Score:2)
Hahaha OS X... enterprise ready??? HAHAHAHAHAHAHAHA
What IT world do you live in. Managing hundreds or thousands of Macs in the workplace is an absolutely nightmare. Poor quality 'enterprise' tools, non-existent policy controls, horrible update options... a total PITA. Apple doesn't care about business/enterprise sales.
And yet, they just keep growing and growing; and the number of Macs in the workplace keeps growing and growing.
So, you had better adjust your thinking buddy-o; before you find yourself on the outside, looking in...
Re: (Score:3)
I see your education on macs and OSX is so horribly outdated that your comment is essentially useless. Many do worry about it this is why several virus scanner companies are making products for OSX. Hell you can even get a free Avast for OSX. They would not even bothered if people were not asking for it.
99.99999999999999999999999999999999% of those people are ex-Windows "Switchers"; who simply CANNOT believe that a computer system doesn't need sixteen-factors of malware protection.
Sorry. The ONLY reason why those companies are providing those AV products is to serve the perenially-paranoid.
I'm not saying that Macs CANNOT get viruses; but in over a DECADE of OS X, they just haven't. Period.
Re: (Score:1)
I do not vouch for the validity nor do I know what your definition is... I did have this in my favorites though:
http://securitywatch.pcmag.com... [pcmag.com]
You can say that those are infected applications but that is splitting hairs as far as I am concerned. Computers do not get viruses. People do. Security is a process and not an application - this is true for all computers.
Re: (Score:3)
At work, I daily deal with Mac-users who gets their mailaccounts hijacked because of infections. It takes roughly 10-20 minutes to convince them to download and run Avast or something like that, but it's worth the "oh....".
How are there mail accounts being hijacked? Because, seriously, I have never heard of a problem with that using OS X Mail.app.
I have been using Macs since they were Lisas, and OS X since the DP4 Public Beta, and have never heard of a Mac having a "hijacked" email,
Nothing stops someone from reselling your email address into slavery; but seriously, I have never heard of Macs being unwitting members in a Botnet, etc.
So, what exactly do you mean by "mailaccounts [sic] hijacked"? Citation, please.
Re:Will anyone exploit it? (Score:5, Insightful)
If I'm attacking systems for the data on them, or to MiTM/trojan/keylog the users of the systems; grab banking credentials and the like; mac users are a conveniently self-selected group of people atypically worth harvesting. Sure, there are a bunch of underemployed baristas with degrees in Individuality using the macbook pro that mommy and daddy bought them to watch movies in their dorm room; but as a whole, thanks to the higher prices, users of OSX devices skew upmarket pretty substantially(iOS devices have some of the same effect; but much less, since at least an iPhone 5c or the like is probably available as the 'free'-with-usurious-contract model on most telcos).
If you are attempting a corporate/institutional intrusion, macs vary in value: they are way, way, less common, frequently absent entirely; but where they are present, their minority status often means very limited integration into the enterprise's legion of 'security' products, IDSes, and everything else that the Windows users complain is causing logins to take 30 minutes. This makes them handy 'beachhead' systems, especially if they are loaded up with Office, Adobe Malware Runtime, and similar stuff that may well have cross-platform or partially shared libraries of vulnerabilities; but much reduced vigilance on OSX clients.
Re: (Score:1)
Time for the BIOS to be EEPROM again? (Score:4, Insightful)
That way it can't be overwritten by software. Or at least require an internal jumper to be set before any writes can happen. Any user updating their BIOS would be fairly experienced so taking the lid off an setting a jumper wouldn't be a problem for them and people who arn't technical could just take it to a store.
Re: (Score:3)
That way it can't be overwritten by software. Or at least require an internal jumper to be set before any writes can happen. Any user updating their BIOS would be fairly experienced so taking the lid off an setting a jumper wouldn't be a problem for them and people who arn't technical could just take it to a store.
Or, ship each Mac with an encrypted dongle that must be unlocked to do a firmware upgrade. You could even print the key on the dongle so you wouldn't worry about losing the key; if yo lose the dongle then still allow an authorized service center to do firmware upgrades. Of course, this my be a solution in search of a problem.
Re: (Score:2)
I think I like the jumper on the system board method a lot better than juggling keys. Reasons why left as an exercise.
I like the extra security of forcing someone to open the (physically locked?) machine as much as the next guy, but weigh that against the nuisance of having to do it yourself on all the Macs you own if you need to flash their EFIs for some reason. If they're iMacs, the front glass is taped to the case, and you'll need certified Apple(TM) brand replacement double sided tape to seal it back up again since the tape is one-use. Opening just one iMac is a thirty minute job if you know what you're doing.
Re: (Score:2)
Hey, It's a fucking jumper. Like every other goddamned port on the motherboard.
Run a couple of wires off of it, put a fucking physical switch on the outside of the machine. Hold button in while powering machine on. You may now update your BIOS/EFI.
Jesus, was it THAT hard to come up with something so simple for a solution?
Re: (Score:2)
No need for such an elaborate and potentially annoying scheme (most people will lose those dongles). Just make it so that only the firmware can update itself, and it only accepts cryptographically signed updates.
You can get memory ICs that can be locked against reading and writing until power cycled. The firmware does what it needs to do, locks the whole firmware against writing early in the boot process, and maybe locks any sensitive data (like crypto keys) against reading as well. If software wants to upd
Re:Time for the BIOS to be EEPROM again? (Score:5, Interesting)
Re: (Score:2)
Some of this seem to be blameable on hardware makers who once made firmware updates hard -- you had to set a jumper on the motherboard. Then they got rid of that part, but you couldn't flash it from the dominant GUI operating system and had to boot from a DOS disk. Then you didn't even have to do that and could flash any firmware on the system from the GUI.
Now it's too easy. It would seem to make more sense to require the system to be booted to a firmware update mode, simple and reliable enough to be pla
Re: (Score:3)
It's interesting that a lot of effort has been put into things like SecureBoot, but there is still a plethora of devices in a PC which are ready to accept new (potentially malicious) firmware at any given point in time.
Well, at least now you have an idea of just how bad IoT deployment is going to get.
Re: (Score:2)
That way it can't be overwritten by software. Or at least require an internal jumper to be set before any writes can happen. Any user updating their BIOS would be fairly experienced so taking the lid off an setting a jumper wouldn't be a problem for them and people who arn't technical could just take it to a store.
In the day and age where the tablet device is being pushed as the desktop replacement, and a laptop can be outfitted to be on par with desktop performance, it's becoming harder and harder to find this "lid" you speak of...
Re: (Score:2)
Not as good as a true hardware write protect(in theory, a suitably capab
Re: (Score:2)
Given that laptops(especially Apple's) are an increasingly heroic enterprise to open;
You need to update your personal Knowledge Base. MacBooks have been very EASY to open since the Unibody case (what is that, like nearly 10 years now???). The only thing difficult to replace on a Mac laptop nowadays is the Keyboard, funnily-enough.
It would be absolute pud for Apple to put a user-accessible pushbutton on the Mobo of a Unibody MacBook. Ten #00 Phillips screws and you're in. If the pushbutton was on the mobo side closest to the bottom-pan, it would be instantly accessible. Kind of like they u
Re: (Score:2)
That way it can't be overwritten by software. Or at least require an internal jumper to be set before any writes can happen. Any user updating their BIOS would be fairly experienced so taking the lid off an setting a jumper wouldn't be a problem for them and people who arn't technical could just take it to a store.
Oh yeah, great. So when there's a critical flaw in there which actually needs to be fixed, and IT in a company is supporting dozens, or hundreds, or maybe even thousands of machines. Yeah, great.
Where's my RO-FLASH dip switch? (Score:1)
Remind me again why there is not a read-only dip-switch that write-protects the entire firmware? It is not like you cannot hack the damn FLASH since their lockout modes are just as buggy as anything else nowadays, but still...
We were better off using EEPROMs, at least you could write protect those by actually air-gapping the pins required to erase and program the chip.
It's a mac and we made it thin so no easy open for (Score:1)
It's a mac and we made it thin so no easy open for you also we have storage on a card not a hdd so you really can't take it out easy on all systems. Also say takeing out the HDD in the mac mini can void the warranty or at the very least they can say when you took out the hdd you did ESD damage so people may ship out systems with there HDD that can get hacked at the repair shop.
Re: (Score:2)
It's a mac and we made it thin so no easy open for you also we have storage on a card not a hdd so you really can't take it out easy on all systems. Also say takeing out the HDD in the mac mini can void the warranty or at the very least they can say when you took out the hdd you did ESD damage so people may ship out systems with there HDD that can get hacked at the repair shop.
You're so full of shit it must be running out your mouth.
Unibody MacBooks are REALLY easy to open. Remove 10 phillips screws on the bottom-pan and, er, that's it. Replacing the HDD does NOT void the warranty on a Mac mini, unless you are stupid and drop a screw in it and then turn it on or something equally dense. The SSD in the 2015 Retina MacBook Pro is also right in view once you take off the bottom-pan, and is on a plug-in connector. Good luck finding an aftermarket replacement for their PCIe SSD, tho
Re: (Score:2)
In the first place?
Do you REALLY have to ask that?
Really?