Slashdot Mirror
Researchers Create Mac "Firmworm" That Spreads Via Thunderbolt Ethernet Adapters
BIOS4breakfast writes: Wired reports that later this week at BlackHat and Defcon, Trammell Hudson will show the Thunderstrike 2 update to his Thunderstrike attack on Mac firmware (previously covered on Slashdot). Trammell teamed up with Xeno Kovah and Corey Kallenberg from LegbaCore, who have previously shown numerous exploits for PC firmware. They found multiple vulnerabilities that were already publicly disclosed were still present in Mac firmware. This allows a remote attacker to break into the Mac over the network, and infect its firmware. The infected firmware can then infect Apple Thunderbolt to Ethernet adapters' PCI Option ROM. And then those adapters can infect the firmware of any Mac they are plugged into — hence creating the self-propagating Thunderstrike 2 "firmworm." Unlike worms like Stuxnet, it never exists on the filesystem, it only ever lives in firmware (which no one ever checks.) A video showing the proof of concept attack is posted on YouTube.
They will make a chip that can only be written to one time. They can call it, "read only". What a concept!
“He’s not deformed, he’s just drunk!”
>> "Firmworm"
You did NOT just introduce that to the Internet.
>> Rule 34
Oh yeah...I guess it's the reason we have Internet in the first place.
So, in other words, the user has to be a complete moron in order for this attack to work.
Human stupidity is the hacker's greatest tool. The entire staff does not have to be stupid, just a few to get things rolling.
Worms are basically a subset of viruses. They are self-replicating malware, just like typical viruses, but don't rely on a human action, such as installation of an infected application.
Assuming that your post wasn't intended as a joke (the dubious claim of viral invulnerability leads me to think it was a joke), how exactly is vulnerability to something like the worm mentioned okay to brush off (claiming mis-classification is a tactic to steer conversation away from the subject discussed)?
"Is not a sentence" is not a sentence. Well damn.
If you work in an IT capacity, I suggest you rethink architecting your security profile based on trusting users not to click on links sending them to websites hosting malicious exploit code.
You might have the smartest CS graduates working in your organization. Each one of them has a computer-inexperienced relative whose had their email compromised in one way or another. From those compromised email accounts, messages are sent to your coworkers that can contain solicitations to view content hosted on a remote website. The possibility of your teammates following those links is especially high. Once the exploit code has hit the desktop OS, it's inside your network. If you have vulnerable routers, the attackers can use the beachhead of the first compromised desktop machine to change the DNS settings on the network router. Now, every single user in the organization is vulnerable to being redirected from "www.google.com" to "www.exploitsite.com" while they still only see the friendly google search page in their browsers when they try to do a search.
Don't trust the end users. They're the weakest member of your corporate security.
$5 / month hosted VPS on linux = awesome!
Yeah, because no one ever falls for social engineering, so it's totally not anything to worry about.
All current MacBook Pros (for the past few years actually) do not have built-in ethernet but would require either a Thunderbolt or USB adapter.
Also, what about Thunderbolt displays, especially in an office "hotel" situation where one shows up and grabs an empty spot to plug in? This is pretty common enough behavior.
Because the worst pieces of software are antivirus programs, but macs are not vulnerable to the types of malware that antivirus software could protect against. Nobody said that macs are immune to viruses, just as they are not immune to water damage, theft or if you throw them off your roof (although there's a cool video on YouTube where a MacBook Air fell out of a two-seater airplane, but was still functional when it was found on the ground).
Well, duh. Why do you think it's called MacBook Air?
Get free satoshi (Bitcoin) and Dogecoins
Because this is a brand-new Class of malware.
What is, Thunderstrike 2 or what I was referring to, Flashback? Because Flashback looks like a trojan installed via a Java flaw.
Thunderstrike. I was apparently not reading closely.
However, Thunderstrike (and I believe Thunderstrike 2) has already been patched months ago by Apple, in their OS X 10.10.2 Update. Also, apparently Macs sold after mid-2014 are immune.
By the way, there is a far more sinister fact that is completely glossed over here on Slashdot: These same vulnerabilities were first found in the UEFI firmware on "Windows/Linux" PCs. The "researchers" just wanted some notoriety; so, when they found the same vulnerability in Macs, they decided to develop a proof-of-concept for that platform and crow about it to the world. And BTW, "Option ROMs" are certainly not unique to Apple-compatible peripherals. Far from it. So, even if you don't use OS X, this exploit, or one very similar to it, can be coming to a computer on your desktop.