Researchers Develop Worm That Infects Mac Firmware

Researchers have developed a worm that can infect the firmware of Mac computers to infect other Macs again from there. Even if they are not connected to each other via a network. Not only is to detect the attack difficult, but also the prevent or resolve an infection would almost be impossible.

"For most users, this would mean that they should throw away their computer. Most people and organizations do not have the expertise to open their machine and the electronic chip to be reprogrammed," says researcher Xeno Kovah opposite Wired .Kovah conducted with researcher Trammell Hudson investigating the firmware attack. The two will present their findings this week at the Black Hat conference in Las Vegas show.

Vulnerabilities

Firmware, with PCs often referred to as BIOS or UEFI, is essential for the operation of the system, and the first software that is loaded. An infected firmware can survive a new installation of the operating system or replace the hard drive. In the past Kovah discovered along with another researcher for several vulnerabilities in the BIOS of the PC. Now it appears that the same vulnerabilities are also present in Mac computers. "Almost all the attacks we found for PCs also work on the Mac," said Kovah.

The researchers decided to inform Apple. One of the vulnerabilities has been fixed, while another has been partially solved.Three vulnerabilities but are still waiting for an update. Through the vulnerabilities it is then possible to create a worm that can spread unnoticed among MacBooks, say the researchers. Because the worm is beyond the operating system, which will not be noticed. The malware has only seconds to infect the firmware and the attack can be carried out remotely, for example by sending an infected email attachment.

Once infected, the malware can infect the firmware of Thunderbolt devices. These devices will, when connected to another Mac that infect computer. Another problem, according to the investigators that security does not check the contents of firmware. To prevent firmware attacks and advise Hudson Kovah manufacturers allow only signed firmware and firmware updates, and hardware, for example, is equipped with a physical switch that prevents unwanted updating the firmware. The researchers also video below in which the attack is demonstrated.

Symantec Confirms Firmware Flaw In Mac Computers

Symantec has confirmed that there is indeed a vulnerability in the firmware of most Mac computers exists that an attacker could install a rootkit to gain persistent root access to the computer. This week, researcher Pedro Vilaca revealed the vulnerability of the EFI firmware.

The problem, which is not present in the latest models of Apple, occurs when the computer wakes from its hibernation, allowing a user to access the firmware. The vulnerability can be used both locally and over the internet. For this last attack, however, would an attacker must have a second vulnerability that provides root access. "Although these vulnerabilities is not widespread, they come from time to time or for", says Symantec .

The anti-virus company says that it is a critical vulnerability, as it may give an attacker root access persistent even erasing the hard drive or it can survive reinstallation of the operating system. Symantec notes that no attacks have been observed in the wild yet, but warns that the risk of seizures increases as the news about the leak from spreading.

Until an update is available, users who think risking the advice to use their computer completely off instead of sleep mode. In addition, it is advisable to keep all the software completely up-to-date, since there is a second leak is necessary in order to attack the vulnerability firmware over the internet. The vulnerability has been confirmed in the Mac Mini 5.1, MacBook Pro 8.2, 9.1 and 9.2, 10.1 Retina MacBook Pro and MacBook Air 5.1. MacBook Pro and MacBook Air 11.3 6.2 would not be vulnerable.

Leak In Older MacBooks Makes Installation Possible Rootkit

A security researcher has discovered a vulnerability in the firmware of several older Apple MacBooks, allowing an attacker could install malware. The latest models do not seem to be vulnerable, but 100% sure researcher Pedro Vilaca not, he tells on his blog.

Vilaca discovered that he is the Unified Extensible Firmware Interface (UEFI) can adjust from "userland". UEFI is the successor to the BIOS and a new model for the interface between the computer's operating system and the platform firmware.The UEFI code should normally be inaccessible to users but the researcher discovered that the code is accessible after a computer is restarted and is in sleep mode.

The problem is in MacBooks for mid-2014 and is mounted on a MacBook Pro Retina MacBook Pro 8.2 and a MacBook Air.Through the vulnerability it is possible to install a rootkit. An attacker does not even have a physical access, since the leak via Safari or attack another attack vector distance is.

The researcher thought that Apple knew of the problem, but that turns out not to be so. So it is a zero-day vulnerability for which no security update Apple has released. Users also are advised to completely turn off their computers and not to put into sleep mode. Vilaca further advises to mail Apple asking for a firmware update.

CERT / CC Warns BIOS Flaw in Intel Chipsets

The CERT Coordination Center (CERT / CC) at Carnegie Mellon University has warned of a vulnerability in the Intel chipsets making it possible to adjust the BIOS to circumvent Secure Boot and damage the firmware of the motherboard so that the system will not work anymore. In addition, there is also warned of a vulnerability in various UEFI systems. Both vulnerabilities were demonstrated during the recent CCC conference in Hamburg.

The first issue ( pdf ) is located in the Intel chipsets that use a particular way to the BIOS (Basic Input / Output System and the first major software running when you start the computer) to protect against writing. The vulnerability is possible to bypass this protection and yet to make adjustments. A local attacker with access to the system can then write malicious code to the firmware of the computer.

It is also possible if a certain variable is set, which is the case in many implementations, in order to circumvent the security measure Secure Boot. Secure Boot is a feature that only with a valid digital signature software loads on startup. Finally, an attacker could also damage the computer's firmware, so that will not boot.

The problem is at least in American Megatrends Incorporated (AMI) and Phoenix Technologies. These are manufacturers whose BIOS / UEFI software is used by a large number of computers. Or manufacturers such as Asus, Dell, HP, Intel, Sony and Toshiba are vulnerable is unknown. The CERT / CC currently has no concrete solution for owners of an affected system.

Unified Extensible Firmware Interface (UEFI)

In addition to the above problem, researchers found Corey Kallenberg and Rafal Wojtczuk a vulnerability ( pdf ) in UEFI firmware of many computers. UEFI is a new model for the interface between the computer's operating system and firmware of the platform. It is used in almost all modern computers. A vulnerability in the UEFI firmware allows a local attacker to access the "boot script" can get to then bypass the write protection.

After this it is possible to bypass Secure Boot or modify the firmware of the computer, even if that just signed firmware to accept. Like the problem with the Intel chipsets may now be corrupted firmware so that the computer will not start. This problem is at least in AMI, Intel and Phoenix Technologies. Again given no concrete action perspective and highlights the CERT / CC for information from the respective vendors.