Slashdot Mirror
Apple Laptops Vulnerable To Battery Firmware Hack
Trailrunner7 writes "Security researcher Charlie Miller, widely known for his work on Mac OS X and Apple's iOS, has discovered an interesting method that enables him to completely disable the batteries on Apple laptops, making them permanently unusable, and perform a number of other unintended actions. The method, which involves accessing and sending instructions to the chip housed on smart batteries, could also be used for more malicious purposes down the road. Miller discovered the default passwords set on the battery at the factory to change the battery into unsealed mode and developed a method that let him permanently brick the battery as well as read and modify the entire firmware. 'You can read all the firmware, make changes to the code, do whatever you want. And those code changes will survive a reinstall of the OS, so you could imagine writing malware that could hide on the chip on the battery. You'd need a vulnerability in the OS or something that the battery could then attack, though,' Miller said."
In other news - batteries have firmware.
As of 10/06/03, I hate COBOL developers.
Isn't this sort of like how the Pandora Batteries worked on the PSP? I think they enabled a diagnostic mode as opposed to a direct hack, but the battery being used to corrupt the system thing isn't totally new.
On the plus side, the hard to replace batteries people complain about make this attack more difficult to perform, instead of just taking a few seconds.
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
I don't have to worry about that. Not only am I using a Dell, but my battery exploded.
This is just one more reason why software that's not designed to be frequently changed should be write-protected unless the user sets a specific hardware switch.
If the hardware switch is in its default location - "protect" - it should be mathematically provable that the firmware cannot be overwritten.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I only skimmed it, but it doesn't seem to say if he needed physical access to the battery to do this. Obviously the two must communicate (on-battery and OS), but it doesn't say if access was achieved on an in-use battery from the host machine.
Obviously this is important, because it changes the attack vector significantly. There's a big difference between being vulnerable to the battery manufacturer or if a random infection could push code to the battery (or even brick it).
I'm not worried, mine has never been anywhere near a Chinaman.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
No it doesn't. He grabbed the passwords from updates and now has access, no vulnerabilities required.
If I install windows or some linux flavor on my mac, it doesn't mean this vulnerability goes away. It's a hardware problem, hardware made by someone besides apple. I'm not sure what this has to do with which operating system is most secure.
So does anyone know if the firmware can be upgraded to cause the battery to burst into fames? That would be funny and probably not covered by the apple warranty.
This both enables people to refurbish packs (which has its consequences, since untracked Li-Ion cells can be *dangerous*), and to sell counterfeit packs (which is even worse).
On the plus side, it might allow refurbished packs and cheap offbrand replacements.
If it's a problem at Apple then it's a problem with a number of other hardware devices that use the same battery controllers, so your windoze laptops isn't safe either. Someone could also hack my Logitech Mouse and brick it too, or any number of peripherals that have upgradeable firmware, like my router, printer, keyboard, the list goes on.
There was an unknown error in the submission.
BTW, Apple batteries have had firmware for the last 10-15 years, so your info is a little late.
There was an unknown error in the submission.