Slashdot Mirror
First OSX Bootkit Revealed
Trailrunner7 writes A vulnerability at the heart of Apple's Mac OS X systems—one thus far only partially addressed by Apple—opens the door to the installation of malicious firmware bootkits that resist cleanup and give hackers persistent, stealthy control over a compromised Mac. The research is the work of a reverse engineering hobbyist and security researcher named Trammel Hudson, who gave a talk at the recent 31C3 event in Hamburg, Germany, during which he described an attack he called Thunderstrike. Thunderstrike is a Mac OS X bootkit delivered either through direct access to the Apple hardware (at the manufacturer or in transport), or via a Thunderbolt-connected peripheral device; the latter attack vector exposes vulnerable systems to Evil Maid attacks, or state-sponsored attacks where laptops are confiscated and examined in airports or border crossings, for example.
Hudson's bootkit takes advantage of a vulnerability in how Apple computers deal with peripheral devices connected over Thunderbolt ports during a firmware update. In these cases, the flash is left unlocked, allowing an Option ROM, or peripheral firmware, to run during recovery mode boots. It then has to slip past Apple's RSA signature check. Apple stores its public key in the boot ROM and signs firmware updates with its private key. The Option ROM over Thunderbolt circumvents this process and writes its own RSA key so that future updates can only be signed by the attacker's key. The attack also disables the loading of further Option ROMs, closing that window of opportunity.
Hudson's bootkit takes advantage of a vulnerability in how Apple computers deal with peripheral devices connected over Thunderbolt ports during a firmware update. In these cases, the flash is left unlocked, allowing an Option ROM, or peripheral firmware, to run during recovery mode boots. It then has to slip past Apple's RSA signature check. Apple stores its public key in the boot ROM and signs firmware updates with its private key. The Option ROM over Thunderbolt circumvents this process and writes its own RSA key so that future updates can only be signed by the attacker's key. The attack also disables the loading of further Option ROMs, closing that window of opportunity.
Then so can Apple.
From their reaction pushing out an automatically installed security patch for the recent NTP vulnerability, I'm hoping that Apple will furnish a patch before this ever becomes more than a Blackhat proof of concept.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
From what I understand, thunderbolt is essentially an external PCIe interface. That's inherently insecure. It was bad enough that Firewire gave devices DMA access, but with PCIe it will probably be 10x worse.
FileVault 2 disables DMA over FireWire/Thunderbolt when no user is logged in or the machine is locked.
If you want an extra layer of security, execute this command:
sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25
...and your Mac will erase its decryption key from RAM every time it goes to sleep.
How can I believe you when you tell me what I don't want to hear?
Are you going to go all "no mainstream Scotsman" on us now?
As noted it's as simple as enabling it.
Most users will not, but then most also do not need to worry about someone physically capturing the system and installing malware then returning it...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I know it's dangerous to base opinions on summaries, but the summary says "during recovery mode boots". So, at least it doesn't seem to be as bad as autorunning files on a usb stick, which used to be pretty common.
It is certainly a serious vulnerability, but considering the number of times I've done a recovery mode boot, I'm not overly concerned about it.
When you learn the skills needed for this level of hacking, you get to keep those skills. It's like asking a chef why he bothers preparing food when it's just going to get eaten. There are a lot of good reasons: it's fun, it hones skill, and if you're really good you advance your entire profession, and when you've done it enough you pass on your knowledge to your sous chef.
Looks like it's better to call it limpware if it's so soft and easy to reprogram.
“He’s not deformed, he’s just drunk!”
I'm really curious what this hedge fund does that they need to do this kind of hardcore security research.
They need more bots to do those super fast trades
“He’s not deformed, he’s just drunk!”
Wasn't everything Apple supposed to be the best?
To be the best, you only have to make sure everyone else is worse than you.
“Common sense is not so common.” — Voltaire
also you can get paid to do it.
Physical access to your machine (and/or you) can result in any number of compromises. This has been true since day one; it'll remain true well into the indefinite future (in fact, I see nothing at all coming down the pike that would ameliorate this in any way. I'm just allowing for the possibility.)
I've fallen off your lawn, and I can't get up.
It doesn't require someone having physical access to a system, it requires the user to connect a compromised Thunderbolt accessory
A compromised Thunderbolt accessory connected WHILE they are also booting during a firmware update.
Hope you got a lot of patience because I've not done that in years...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Are you going to go all "no mainstream Scotsman" on us now?
No *true* mainstream Scotsman anyway.
But we all know that Apple Macintosh isn't a true Scotsman's name....
Unless you're going to factory-reset every time you leave you machine unattended it won't actually help you avoid this, it will only help you recovery once you detect it.
Actually, it would be worse: the attacker could factory-reset your machine and then apply the attack, making any applied patches useless.
I modified the boot.efi to allow my old mac pro 2,1 to run Mavericks. I'm glad I never upgraded. My old mac with 32gb of ram is plenty fast enough.. make -j 20... all I have to say is wow this baby can compile code fast. I also have an NVIDIA GTX 560 graphics card and a vintage GT120 for boot selection. I picked another mac pro 8 core 2,1 on ebay and built up a 32gb8 core Linux beast running linux on bare mac metal. Now that I see thunderbolt is full of security holes I bet the next generation if macs will be locked down. I will never purchased locked down hardware.
Fsck all those people that are the reason we can't have (keep) any nice things.
I had someone come in and take my Motorola XOOM tablet, it was rooted, and 4.2 thanks to hackers who did what Motorola said wasn't possible.
I found who took it so called 911, an officer called me asking what I wanted him to do about it, I said to shoot em.
It was taken as it was meant to of been, and they checked it out, still no word.
Hedge funds employ lots of tech people. Someone has to write trading strategies, systems for getting generated orders to the brokers/exchanges, systems for assigning trades to accounts, and the glue that holds it all together. They also need an army of IT operations, support and security staff to keep the beast running.
... that involve me turning around for up to 30 seconds. It's cute. The lesson here is, if you let your machine out of your sight for a while, don't be surprised if it comes back rooted. Isn't rule #1 of computer security always "If you don't have physical security, you don't have security"?
What exactly is the vector here? Give someone a thunderbolt hard drive and hope they plug it in and hope they run a firmware update while the drive is connected? Oh no, this could affect potentially dozens of people per decade! Outside of very targeted attacks, who will get hit by this? And if you think you are targeted, the solution is simple: don't have anything but the power cord plugged in when updating firmware. (Which is how you are supposed to do it anyway.)
This isn't exactly a drive-by download.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
FSFS it's to HAVE been. What have they started teaching in lieu of English in US schools?
Il n'y a pas de Planet B.
...infecting macs through innocent chargers and other USB devices, mostly acquired from China.
http://www.engadget.com/2014/11/06/apple-malware/
Sent from my ENIAC
I like how UEFI is now on x86 machines. Ships enabled, but easily turned off if you have any technical knowledge. Some BIOS config tools even put up a warning to help ward off "dancing bunny" attacks.
Maybe Apple should see about TPMs. On most machines, they ship disabled, but easily turned on. If FileVault 2 used a TPM, this would not just provide resistance to evil maid attacks, but would stop brute force password guess attacks in their tracks, since the key decoding the VEK would be stashed in the TPM. Of course, if that is lost, there are other mechanisms for recovery (the number string Apple tells you to stash in a secure place.) TPMs would also do a decent job at securing local KeyRing storage, so credentials stored there would be well protected from compromise, even if FileVault isn't used, as the TPM would hold that data, not the OS.
What I've wondered about is something that was present on Compaqs back in 1993-1994 -- an "enable flash" jumper.
Having this would put a kibosh on flashing option ROMs without the user knowing. Of course, there is always the dancing bunny attack, where a pr0n site asks a user to follow some detailed instructions before downloading a codec, or a dodgy device from China won't work unless the user follows directions (including flipping that jumper and disabling signature enforcement.) However, a master switch would be a significant security boost.
With modern PCs, it wouldn't be a jumper/switch per se, but would be something done from a BIOS level app. This utility would be something a user would almost never use, but would be available just in case someone is doing development work. This way, option ROMs that are signed can be used without issue, but unsigned Trojans would be stopped cold. This mechanism also gives the user the ability to purge all loaded option ROMs and restore back to a default, should their machine get nailed.
The firmware has always been a possible vector for infecting a computer with malware, and we know the NSA has done it for years. This OS X bootkit shows one method of getting the malware into the firmware. I'm sure on many PCs the NSA could just flash a new BIOS, probably with the full support and help of the firmware manufacturers.
It surprised me to learn that laptops from popular manufacturers like Lenovo ship with a piece of BIOS-based malware called Lojack. Used as a method of theft prevention, once activated it can infect a fresh install of Windows with tracking software. Was quite an eye opener to me.
Certainly in this post-Snowden era, I certainly trust my devices a lot less. Every little device is a computer these days with its own firmware. Who knows what runs there. A brave new world indeed. Looks like writing passwords down on paper is probably the most secure thing after all.
being able to do it remote or "just by plugging in an usb stick" requires the machine to be up and running.
big difference.
world was created 5 seconds before this post as it is.
It surprised me to learn that laptops from popular manufacturers like Lenovo ship with a piece of BIOS-based malware called Lojack. Used as a method of theft prevention, once activated it can infect a fresh install of Windows with tracking software.
Even if it performs "sneaky stuff" I wouldn't call it malware as it is designed to help the real owner of the laptop in case of theft.
It was taken as it was meant to of been
Heh. So far I have only seen "should have" being replaced with "should of", but "to of" is certainly a new one. :)
As they don't usually have Thunderbolt, or if they do they boot differently.
I apologize for the lack of a signature.
Yes, it is. The option rom checks for firmware update mode. If it isn't in update mode, it sets update mode and resets the machine. POOF, you are now booting during a firmware update.
FSFS it's to HAVE been. What have they started teaching in lieu of English in US schools?
Too old to care, let alone change.
Exactly. Physical access to the machine and all bets are off when it comes to security.
I've decided to Diversify my Holdings. I've divided my cash between my left and right pockets, instead of all in one.
it will only help you recovery once you detect it.
Bingo. No more "once it's compromised, it's always compromised" and no more "corrupt the BIOS to brick the device" attacks.
Also, buyers of used merchandise can assure themselves that the BIOS is the factory BIOS, not one that a previous owner installed.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Actually, it would be worse: the attacker could factory-reset your machine and then apply the attack, making any applied patches useless.
1) The attacker would have to have physical access to the device to do the factory reset. Either that or trick the user into getting out the screwdriver.
2) Applying a subsequent factory-reset would remove any malware installed by the attacker. Data loss would result, but at least you wouldn't have a permanently-compromised machine.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Actually, it would be worse: the attacker could factory-reset your machine and then apply the attack, making any applied patches useless.
1) The attacker would have to have physical access to the device to do the factory reset. Either that or trick the user into getting out the screwdriver.
2) Applying a subsequent factory-reset would remove any malware installed by the attacker. Data loss would result, but at least you wouldn't have a permanently-compromised machine.
1) The attacker already needs physical access to the device to perform this attack.
2) As someone else said, unless you factory reset each time you use your computer, this is useless (as you won't know if the malware is installed until you perform a reset). After a reset, you would of course have to apply all the patches again before you could use your system safely.
so much work put into finding and exploiting one tiny little thing that, like you said, is destined to be patched
And yet all that work is the reason it's destined to be patched.
The purpose of a factory reset is not to give 100% protection. It is not to mitigate all of the damage caused by the attack. It is to provide a way to rescue the hardware once the threat has been identified and means of re-infection have been gotten rid of. In other words, it's to save the cost of buying replacement hardware for a box that would otherwise be deemed "never to be trusted again."
Here are two examples:
1) A rouge employee tampers with a USB/Firewire/Thunderbolt device and uses that to infect Macs (or PCs, or phones, or whatever). The employee is discovered and shown the door and all potentially-infectious devices which cannot be factory-reset have been destroyed or removed from use. Those which can be factory-reset are reset and updated from known-good sources.
2) I buy a used piece of equipment. I want to know with certainty that there is no malware on it. I do a factory-reset and update it from known-good sources.
Also, the concept of a factory-reset is not specific to recovering from against hardware/peripheral-based attacks. It also helps recover from software-based attacks (including remote attacks) that take advantage of bugs to replace the "main" firmware with their own. In this case, the recovery is a two-step process:
* Do a factory reset
* Update to a version of the "real" firmware that does not have any known exploits
It also has the limitation that it does not protect against exploits (including remote exploits) that will be discovered in the future.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
the level of effort to actually generate an exploit that works regularly is the point of diminishing returns
You would think so, but experience has shown that without a working proof of concept exploit, software vendors dismiss the vulnerability as theoretical, downplay the severity, or outright ignore it. Sometimes they even ignore vulnerabilities with working exploits, if it isn't actually being exploited in the wild (that anyone knows about). And a working exploit is useful for testing your own systems.