Slashdot Mirror
Macs Vulnerable To Userland Injected EFI Rootkits
Bismillah writes that a new vulnerability in recent Macs — and potentially older ones — can be used to plant code such as rootkits into areas of EFI memory that shouldn't be writeable, but become unlocked after the computer wakes up from sleep mode. The article explains that [The vulnerability] appears to be due to a bug in Apple's sleep-mode energy conservation implementation that can leave areas of memory in the extensible firmware interface (EFI) (which provides low-level hardware control and access) writeable from user accounts on the computer.
Memory areas are normally locked as read-only to protect them.
However, putting some late-model Macs to sleep for around 20 seconds and then waking them up unlocks the EFI memory for writing.
FTFA:
The researcher who discovered the flaw, Pedro Vilaça, said the vulnerability can be used to (some examples) that is invisible to the operating system in the writeable flash memory
So to summarize: as a user, you can sometimes write to EFI memory.
That's currently all there is to it. There's no rootkit, there's no malware, etc. Just this space where you can hide and survive an OS wipe and reinstall.
I'm sure some will come up with a payload that uses this space to hide itself, no doubt about it. But currently, this is all there is to it.
8 of 13 people found this answer helpful. Did you?
That way it can't be overwritten by software. Or at least require an internal jumper to be set before any writes can happen. Any user updating their BIOS would be fairly experienced so taking the lid off an setting a jumper wouldn't be a problem for them and people who arn't technical could just take it to a store.
VilaÃa believes Apple is aware of the issue - his testing shows the flaw is not found in the firmware of Macs made after mid 2014
How kind of Apple to publish a security advisory on the issue, like a reputable and scrupulous vendor would have done.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
If I'm just harvesting nodes for my botnet, macs are pretty lousy targets, no more capable than PCs and substantially more obscure.
If I'm attacking systems for the data on them, or to MiTM/trojan/keylog the users of the systems; grab banking credentials and the like; mac users are a conveniently self-selected group of people atypically worth harvesting. Sure, there are a bunch of underemployed baristas with degrees in Individuality using the macbook pro that mommy and daddy bought them to watch movies in their dorm room; but as a whole, thanks to the higher prices, users of OSX devices skew upmarket pretty substantially(iOS devices have some of the same effect; but much less, since at least an iPhone 5c or the like is probably available as the 'free'-with-usurious-contract model on most telcos).
If you are attempting a corporate/institutional intrusion, macs vary in value: they are way, way, less common, frequently absent entirely; but where they are present, their minority status often means very limited integration into the enterprise's legion of 'security' products, IDSes, and everything else that the Windows users complain is causing logins to take 30 minutes. This makes them handy 'beachhead' systems, especially if they are loaded up with Office, Adobe Malware Runtime, and similar stuff that may well have cross-platform or partially shared libraries of vulnerabilities; but much reduced vigilance on OSX clients.
Targeting OS X is tempting because of 99% of all Mac users *knows* that "Macs can't get infected" (the Apple salespeople told them so), and therefore they don't have any kind of antivirus installed.
At work, I daily deal with Mac-users who gets their mailaccounts hijacked because of infections. It takes roughly 10-20 minutes to convince them to download and run Avast or something like that, but it's worth the "oh....".
Out if interest, what "infections"? Do you have any examples. That's clearly a big issue if you're dealing with it daily. What infections are we talking about here?
Not that I'm doubting your story or anything.
(NECESSARY DISCLAIMER: I AM NOT CLAIMING THAT OS X CANNOT GET INFECTIONS)
If I had mod points, you'd have em. Institutional policy is the prime reason that AV exists for Macs. AV companies saw Macs coming into the workplace at greater rates due to the proliferation of iDevices and the frustration of using Windows 8 and decided a Mac version of their software might be profitable. No other reason than that. The primary marketing tactic from those companies was to protect your inbox so you didn't accidentally forward a PC virus along. In 8 years of Mac ownership, my AV (yes, I'm a Mac owner with AV on my system) has detected one PUP in an attachment auto-downloaded thru my mail client, and the exploit was for Win32. Job done. AV works and serves its purpose.
Now, before the torches come out and the chants of "Fanboy!" start, I am sure someone out there somewhere has a Mac virus that could spread and wreak havoc. The darker parts of the Internet know about security exploits long before most /.-ers will. That said, I don't think this exploit will turn into a pandemic precisely because of the fact that >10% of computers are Macs. Hacking is a business, granted it is a criminal business, but business economics still apply, and writing an exploit for 10% is far less profitable than writing for 90% of users. Even if that 10% are totally security unaware.