Slashdot Mirror
Critical EFI Code in Millions of Macs Isn't Getting Apple's Updates (wired.com)
Andy Greenberg, writing for Wired:At today's Ekoparty security conference, security firm Duo plans to present research on how it delved into the guts of tens of thousands of computers to measure the real-world state of Apple's so-called extensible firmware interface, or EFI. This is the firmware that runs before your PC's operating system boots and has the potential to corrupt practically everything else that happens on your machine. Duo found that even Macs with perfectly updated operating systems often have much older EFI code, due to either Apple's neglecting to push out EFI updates to those machines or failing to warn users when their firmware update hits a technical glitch and silently fails. For certain models of Apple laptops and desktop computers, close to a third or half of machines have EFI versions that haven't kept pace with their operating system system updates. And for many models, Apple hasn't released new firmware updates at all, leaving a subset of Apple machines vulnerable to known years-old EFI attacks that could gain deep and persistent control of a victim's machine.
That was a pretty weak attempt at emulating the Luddites App spam post...
Just give us control over our own damn equipment! Let us form our own communities that will service these machines as necessary.
Why is everything shrouded in a goddamn fucking mystery? WHY?!
If Apple doesn't want to throw resources at it, then fine.
But why can't I throw resources at it? Give me the source code of the firmware, and allow me to install an upgraded version in my own time.
but one thing I see surprisingly frequently on the Surface Pro is EFI firmware updates.
That can be seen as a good thing and a bad thing. One would hope these are feature updates and not such a long list of critical vulnerabilities but .... Microsoft.
You'd be surprised at how many computers you can get physical access to without much effort........some of which control or can get access to more things than you realize.
But don't let that stop a good Apple ass-whoopin'... carry on.
Beware of the Leopard.
I guess you would say this is another example of Apple simply dropping support in a way most users won't notice. I would say many PC makers also stop doing bios updates as well after a few years. Not excusing either of this but it does appear to be something not exclusive to just Mac's.
Apple's solution is probably "buy a new Mac". Tim Cook said himself that Apple products are not for the rich so buying another $1000+ computer every year or two shouldn't be a problem for anyone.
Next up: Tim Cook doesn't understand the meaning of "rich" compared to the rest of the population.
Except that the people who upgrade their Macs every year or two are few and far between. Apple knows this well. That said, TFA even mentions the EFI update failed on certain percentages of NEWER systems, like the 2-16 MacBook. To wit: " And three versions of the 2016 Macbook Pro had the wrong EFI version for their operating system version in 25% to 35% of cases, suggesting they too had serious EFI update failure rates."
This doesn't sound nefarious to me, it sounds more like there's a hiccup in the update process, which thankfully doesn't render the system a brick when it fails. Naturally something that needs to be addressed though.
For what it's worth, I'm happily working away on a 2011 iMac, which in the past 6 years has only had one problem, a failed hard drive. This was a recent, and certainly not unexpected failure. Anecdotal for sure, but this is the case for most people I know who own a Mac as well. It's also the reason they (and I) will purchase a new one when the time is right. I know it's trendy to blindly bash on Apple though.
Locked hardware, leak of support, 1 year only hardware warranty, higher prices. Thatâ(TM)s Apple.
He was just giving his two bits
Has this negatively impacted users or present a vector for hackers that has been exploited?
For what it's worth, my posts are made from a 2010 Mac mini, which in the past seven years had its RAM upgraded twice (from 2GB to 8GB, then to 16GB) and hard drives upgraded twice too (from 320GB to 750GB, then dropped the optical drive to add an SSD).
#DeleteFacebook
It's time to upgrade again and throw out your glued in batteries and ssds for a new system
http://saveie6.com/
I still use a haswel i7 at home and needed to replace a damaged board. All the popular MSI, Gigabyte, and Asus boards with 97 stopped being updated with new EFI.
I googled for Windows 10 compability and use the latest 2015 UEFI flashes.
Do Macs need them updated or tied to specific releases of MacOSX?
http://saveie6.com/
For what it's worth, I'm happily working away on a 2011 iMac, which in the past 6 years has only had one problem, a failed hard drive. This was a recent, and certainly not unexpected failure. Anecdotal for sure, but this is the case for most people I know who own a Mac as well. It's also the reason they (and I) will purchase a new one when the time is right. I know it's trendy to blindly bash on Apple though.
I second this!
My newest Apple Computer is a 2012 nrMacBook Pro with a spinning-rust HD (that hasn't failed yet). It looks and works exactly the same as when I bought it in May, 2013.
Out of all of my Apple-owning friends, I don't know any that are on the "Upgrade Treadmill" that Slashtards like to constantly allude to. One did just buy a 2017 MBP, but her previous MBP was a 2009 model, and the other recent Upgrader bought himself a 2016 MBP as a retirement gift. That replaced his 2007 MBP.
I even have a friend that still rocks a frickin' PPC G4 TiBook, and I run a 2005 G5 Tower at home as a Surveillance, FTP, and iTunes Server, FFS!!!
Apple's users need to declare their independence from dependence on Apple and switch to free software OSes running on hardware they own. The same is true for independence from any proprietor.
You will never get the control over your own damn equipment you seek so long as you do business with proprietors (Apple, Google, Microsoft, etc.). Like I've said so many times before on /., the themes of the articles here are the same and so are the fixes you can implement today: software freedom is a good unto itself because it helps grant you the independence and true ownership you seek, running free software on hardware you can fully own is the best currently viable way to get the independence you seek. The rest is a matter of political will—are you willing to change your system and hardware so you can have the best available hardware and software that respects your freedom? Wishing and hoping achieve nothing, real change requires political action.
I recommend perusing the GNU Project's list of free distros and the Free Software Foundation's "Respects Your Freedom" hardware list.
Digital Citizen
...if your firmware's up to date? I can find the version of the firmware that's installed. What I can't find is anything documenting what the latest version for my Mac is. Apple's support site is a joke.
Never let a lack of data get in the way of a good rant.
Give me the source code of the firmware, and allow me to install an upgraded version in my own time.
Buy your own copy of IDA Pro.
You now have the source code for the firmware.
You don't know how to program in assembly language?
Are you sure you are actually a programmer?
The length of time that some system has not been updated does not alone provide a good metric as to how secure it actually is or isn't. Its certainly a mistake to judge the invulnerability of some system just by when it was last updated, which seems to be what the article is doing.
It was Microsoft who managed to brainwash the world into thinking that weekly/monthly updates are just some normal aspect of all computer systems. prior to then, it was not unusual for updates for professional OS's (SunOS, HPUX, Solaris, VMS etc) to be more like years apart.
A high frequency of updates is absolutely necessary if you're running a fundamentally crappily-designed OS like Windows, but let's not paint all things with the same brush.
That said, I do agree that Apple should release updates every time a new exploit (EFI or otherwise) is identified, which the article also clearly mentions just isn't happening.
Not like anyone even bothers, any bugs in UEFI are only important if you have access to the hardware.
EFI bugs are important...
But only to 64 bit Linux users, who haven't commented out the call to ExitBootServices() which 64 bit Linux insists on making.
The bug, which exists in Intel's EFI/UEFI reference implementation build system, occurs due to not marking a section of one static library as "required by runtime services".
Apple EFI implementations have the bug; so do many other companies.
We fixed it at Google, with the help of the UEFI engineer on the H2O BIOS. Most people haven't fixed it.
So Linux people tend to get all pissy any time they can't update the EFI because they can't read disassembled assembly source and make modifications.
but one thing I see surprisingly frequently on the Surface Pro is EFI firmware updates.
Personally I'm waiting on the security update for the last Windows XP release...
lol, "cosmonaut"
Pretty sure its "confidante".
Nope, mid-2010 Mac mini. Officially the maximum is 8GB because when it was released the biggest SODIMMs available were 4GB. After an EFI update, the maximum went up to 16GB.
#DeleteFacebook
I'm a little unclear why a bootloader would ever even be in a position to become 'critical'. Either it works, in which case the machine works and a real operating system takes over, or it doesn't, in which case the machine displays the ultimate in security and fails to deliver service to anyone, including malicious agents.
If bootloaders are now written to somehow be remote-hackable, we have done something very wrong.
UEFI displaces root kits by being one. It was inevitable to find a flaw in the code.
One of the great things about running Linux is the ability to run using BIOS only.
My PC BIOS is UEFI-only, you insensitive clod!
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
2012 mini and pro for sure. MacBook Pros are 2016.
The cesspool just got a check and balance.
However, you need to buy very very specific RAM for the 2010 - PC3-8500 CL7 DIMMs for stable 16GB operation. Oh, and mine is at the current EFI level for that platform, as are my other systems. I checked them all.
The cesspool just got a check and balance.
I run a 2005 G5 Tower at home as a Surveillance, FTP, and iTunes Server, FFS!!!
A 2010 mini used to do that for me, at a fraction of your power draw. It used to serve as my HTPC as well. Now it's a 2012 quad i7 to handle all that and more.
The cesspool just got a check and balance.
That's the joke.
>Begin pedantic annoyance: If it's UEFI, it's technically not BIOS anymore.
I run a 2005 G5 Tower at home as a Surveillance, FTP, and iTunes Server, FFS!!!
A 2010 mini used to do that for me, at a fraction of your power draw. It used to serve as my HTPC as well. Now it's a 2012 quad i7 to handle all that and more.
I would have loved to do that with a mini, and in fact, I spec'ed a 2010 mini to do just that for a friend of mine. Still working quite nicely, too. But The G5 Tower was just languishing, having been replaced by my 2012 nrMBP as my "daily driver", and I didn't want to spend the coin on a mini for a non-essential function.