Next week, a researcher is set to demonstrate a method in which a malicious actor could use a specifically-made Thunderbolt device to inject a bootkit, which could survive almost any attempt to remove it, into the EFI boot ROM of any Mac with a Thunderbolt port. The demonstration is set to take place at the Chaos Communication Congress by researcher Trammell Hudson who claims the attack takes advantage of an old flaw in the Thunderbolt Option ROM which was disclosed in 2012 but hasn’t been patched since. Along with showing the custom code, Hudson will show a method by which the bootkit could replicate itself to any attached Thunderbolt device, allowing the malicious actor to spread across even air-gapped networks.
Since the code lives in a separate ROM on the logic board, the attack can’t be prevented by reinstalling OS X or even swapping out the hard drive. Hudson notes that he could replace Apple’s own cryptographic key with a new one which even prevents legitimate firmware updates from being accepted. He wrote the following regarding the matter:
There are neither hardware nor software cryptographic checks at boot time of firmware validity, so once the malicious code has been flashed to the ROM, it controls the system from the very first instruction. It could use SMM and other techniques to hide from attempts to detect it.
Although Hudson’s attack does require physical access, its ability to spread through other Thunderbolt devices makes it extra dangerous. Users tend to plug smaller shared devices into their computers without much thought and this would help spread the danger rather quickly.
Hudson is set to present his findings on December 29th at 6:30pm local time in Hamburg, Germany.
Source: Chaos Communication Congress via AppleInsider
Connect With Us
Message