Slashdot Mirror
Thunderbolt Rootkit Vector
New submitter Holi sends this news from PC World:
Attackers can infect MacBook computers with highly persistent boot rootkits by connecting malicious devices to them over the Thunderbolt interface. The attack, dubbed Thunderstrike, installs malicious code in a MacBook's boot ROM (read-only memory), which is stored in a chip on the motherboard. It was devised by a security researcher named Trammell Hudson based on a two-year old vulnerability and will be demonstrated next week at the 31st Chaos Communication Congress in Hamburg.
An attacker with physical access to the target is usually a bad thing (tm),
It shouldn't surprise anybody that a malicious PCI-E card can access a system.
Why didn't I think of that.
I am pretty sure it does not install in ROM.
Too bad it doesn't play the song.
If I have physical access to your machine, I'm going to get you one way or another.
Firewire, USB 3.0, and Thunderbolt all have DMA, which means any device hooked to a host can pretty much do anything they want to the host, no matter what the host hardware or OS is. I didn't think this sort of thing was still news?
Almost as stupid as making PCI-E part of an external bus. The BIOS write protect jumper of old was the right idea.
For that to happen someone would have to make a thunderbolt device you wanted to buy.
A writable ROM are clearly not a ROM
The attack, dubbed Thunderstrike,
Tell me. Does it get it's own little theme song performed by AC/DC too?? That would just complete the marketing circle!
The USB and Firewire interface on the 10 year old J-Bus (UltraSparc IIIi) had memory management for the I/O interfaces as well as the CPU. The DMA from external interfaces could only access memory granted to it by the OS.
A Shadeless room is a brighter room.
Does the vulnerability work if an open firmware password has been set?
So if you get hit by this attack, have you been... Thunderstruck?? /me shows self to door
"installs malicious code in a MacBook's boot ROM (read-only memory)"
Nope. It may write to EPROM or something like that but by definition it can not write to ROM. ROM means Read Only Memory and as such there is no writing to it. EPROM or some other flavor of Erasable Programmable Read Only Memory is what it would have to be working with. Too bad writers can't read. Not even their own sentences. Or perhaps they can't comprehend. IM (Incomprehensible Memory) in the case of the OP.
So you thought of that all your self, from an attack called Thunderstrike???
You're a genius
An attacker with physical access to the target is usually a bad thing (tm),
The attacker does not need physical access. All the attacker needs to do is sell hacked thunderbolt cables on ebay or alibaba.
Thunderbolt Grease Slapper
You apparently did not get the joke
"The attack, dubbed Thunderstrike, installs malicious code in a MacBook's boot ROM (read-only memory), which is stored in a chip on the motherboard"
:)
Dear Slashdot editors, shouldn't this be malicious 'computer' boot ROM code. At least it would be so referenced if it infected a Windows 'computer'
With older (PPC?) based Macs, to update the firmware you had to power off the machine, then turn it on by holding the power button until you got an extra beep or sound. This would physically un-write-protect the firmware EPROM so that it could be updated by open firmware.
In their quest to make everything as "user friendly" as possible, they took out this hardware security feature, allowing the update to just happen without any physical action.
Bad Apple, no donut.
Ummm no, if its truly ROM you cant write to it.. Geesh.
You keep using that word. I don't think it means what you think it does....
"Flyin' in just a sweet place,
Never been known to fail..."
Here's how you do it:
1. Go to a conference, and allow your dongle to 'accidentally' fall out of your bag onto the floor. Wait for somebody to come and pick it up.
2. Open up an online shop and sell knock-off dongles at a reduced price
3. Post an ad on Craigslist selling your 'old' dongle
4. Go to a conference and swap out the dongle that is there with your dongle
At $30 a pop people many unwitting Mac users would pick up one of these devices if they were convinced it were impossible to find out the owner. They might not use it right away, but chances are that at some point they will be in a bind and need one.
No physical access necessary - just a bit of social engineering to bring your device to the machine.
This is really probably the scariest vulnerability I have seen in a while.
If you can write to ROM it isn't ROM to begin with, but PROM*. And you can alter PROM by flipping (the default) ones to zeroes (making it harder, but often still possible to apply useful changes).
And as not all attacks need lots of code even PROM is susceptible to being "updated" for something malicious.
*For the ones who are wondering how data than is placed into the ROM, the full name is "masker-programmable ROM". The zeroes and ones are put into the ROM as a part of the physical manufacturing process.
Can someone explain to me how you can write to Read Only Memory?
Try it! Library of Babel
Find the mistake.
Vendors are stupid, if they make ROM writable, without setting a jumper. Or making it writable at all.
ROM -- Read Only Memory. As stated, data is stored during the manufacturing process. Non-changeable
PROM -- Programmable Read Only Memory. Stores data by burning fusible links inside the chip using a special programming station. Non-changeable for most practical purposes. You can't fix a burned link, but you can burn additional ones.
EPROM -- Erasable Programmable Read Only Memory. Data can be stored and then erased by exposing the chip to UV radiation. Chips of this type can be recognized by the opaque sticker covering the quartz window on the top of the chip. No UV sources are built into computer enclosures.
EEPROM -- Electrically Erasable Programmable Read Only Memory. The only type of ROM memory that can be reprogrammed inside a computer. Almost identical to FLASH memory.
Such features were likely removed at the request of the NSA or other shadowy government agency.
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen