New Exploit Lets Attackers Control Macs Even After They Are Formatted

POST

MAIL

Posted June 2, 2015 at 8:25pm by iClarified

Macs older than one year are vulnerable to an exploit that can overwrite a machine's firmware, letting attackers control devices even after they are formatted or restored.

The vulnerability, discovered by OS X Security researcher Pedro Vilaca, target a machine's BIOS after it wakes from sleep. Normally, protection known as FLOCKDN, would prevent any apps write access to the BIOS region, but for some reason, the FLOCKDN protection is inactive after a Mac wakes from sleep. That leaves the operating system open to apps to reflash the BIOS and modify the extensive firmware interface (EFI).

"The bug can be used with a Safari or other remote vector to install an EFI rootkit without physical access," Vilaca said in his blog post. "The only requirement is that a suspended happened in the current session. I haven’t researched but you could probably force the suspend and trigger this, all remotely. That’s pretty epic ownage ;-)."

One installed, the malicious code would be very difficult to detect or delete, as reformatting or reinstalling the OS would do nothing since that does not reflash the BIOS. Unfortunately, there is not much users of vulnerable Macs can do to prevent the exploit until Apple releases a fix.

While Vilaca noted how serious this bug is, he did say that in theory, there is not too much to worry about. The bug is more likely to be applied as a targeted attack versus mass exploitation. Vilaca tested the bug on a MacBook Pro Retina, a MacBook Pro 8.2 and a MacBook Air, all running the latest available EFI firmware from Apple.

All Macs released since mid to late 2014 are not affected by this vulnerability, but Vilaca said he was not sure if Apple silently patched it or fixed it accidentally.

Read More via ArsTechnica

New Exploit Lets Attackers Control Macs Even After They Are Formatted

Follow iClarified

Sir Psycho Sexy - June 4, 2015 at 8:43am

Well said, dude. If you want ease of use and a machine that does what you want it to do when you want it to do it, and just plain works like it's supposed to, then get a Mac. If you want to curse your machine, pull your hair out and bang your fists...then buy a Windows machine. The choice is yours!!!

Reply · Like

gamerscul9870 - June 4, 2015 at 11:55am

You can't believe how many times I had to be fed up with it. I used it more because when I was a kid, I only knew windows back then because that's all my family had. I wish I realized was sooner how much of an effort OSX was made so I wouldn't be caught up in bsod anymore. No matter how many times I got rid of it, it kept coming back every other minute. The only way to fix it after it stopped and forced me into safe mode from there was to erase the storage. No joke!

Headbanger - June 4, 2015 at 2:07am

Everything before 2014 is outdated...everyone rush to the nearest Apple Store to upgrade your machines. This guy has to work for Apple

Macjorge - June 3, 2015 at 1:45pm

Mac the best system ? Never hear something like this on windows since msdos l days, mac was secure when only less than 3% of market use it when they reach the 5% the virus appears, the truth is that not is more secure than windows.

Tech Jedi - June 3, 2015 at 12:50am

Older than one year are vulnerable.

gamerscul9870 - June 3, 2015 at 12:42am

Thank got I still own a 2013 late mbpr, but how can that be no macs before 2014 aren't affected?

Edwinjr - June 3, 2015 at 3:34am

Sorry to break this to you but Macs older than 2014 are vulnerable to this attack and I'm pretty sure you're not out of the woods with your 2013 as relates to the technology world's version of the "Body Snatchers" but, since you actually have trouble understanding ... I'll restate clearly, 2013's are subject to this kind of attack so, you must either buy a PC (probably worst off) or go out an buy a new Mac, I'm pretty sure Apple wouldn't object Edwin

gamerscul9870 - June 3, 2015 at 3:43am

Read that wrong by mistake. I was thinking about buying a new Mac but I haven't compared my owc upgrades on my 2013 mpbr to the 2015 version with Apple parts. Depending on which one is faster, I'll choose between thise two.

PaladinLV - June 2, 2015 at 11:46pm

Knew there was a reason for selecting NEVER for Computer Sleep!

qba - June 2, 2015 at 9:32pm

Wow thank you Pedro , good catch !!!!