All Posts by Date or last 15, 30, 90 or 180 days.
also by Lloyd: diglloyd.com photography and WindInMyFace.com
Thank you for purchasing through links and ads on this site.
OWC / MacSales.com...
diglloyd Deal Finder...
Buy other stuff at Amazon.com...
Upgrade the memory of your 2018 Mac mini up to 64GB

Thunderbolt EFI Exploit

As if security weren’t hard enough, attaching a compromised Thunderbolt device can write the flash ROM on the computer. A system reinstall or drive replacement has no effect, since the EFI firmware is modified. You’d have to throw away the Mac—that is if you had any way of discovering the hack. This sort of thing is why high security users do things like glue USB3 ports shut and disconnect wireless and tape over cameras and so on. Certainly never, ever plug in a USB3 stick you find on the street (so to speak). Your good luck may be no accident.

Apple EFI Firmware Security Vulnerabilities

This sort of hardware vector is unnerving, because there are all sorts of waypoints betwen the manufacturing of a device and its delivery. And no conventional way to detect the exploit. MPG has little doubt that the NSA has used such techniques to compromise systems, not that such activities need be confined to spy agencies.

Additionally, other Thunderbolt devices' Option ROMs are writable from code that runs during the early boot and the bootkit could write copies of itself to new Thunderbolt devices. The devices remain functional, which would allow a stealthy bootkit to spread across air-gap security perimeters through shared Thunderbolt devices.

More unnevering is that Apple would store a certificate in writeable flash memory, which can simply be overwritten. And that this bug has been known for two years and that it can be fixed, but has not been fixed.

B&H Deal ZoneDeals by Brand/Category/Savings
Deals expire in 18 hours unless noted. Certain deals may last longer.
$3199 SAVE $200 = 5.0% $99 FREE ITEMS Canon EOS R Mirrorless with 24-105mm in Cameras: Mirrorless
$1632 SAVE $700 = 28.0% $165 GIFT CARD LG C8PUA 55" Class HDR UHD Smart OLED TV in Electronics: Televisions
$3097 SAVE $200 = 6.0% $77 FREE ITEMS Nikon D850 DSLR in Cameras: DSLR
$1797 SAVE $200 = 10.0% Pentax K-1 Mark II DSLR in Cameras: DSLR
$998 SAVE $400 = 28.0% Sony a7 II Mirrorless in Cameras: Mirrorless
$1798 SAVE $200 = 10.0% Sony a7R II Mirrorless in Cameras: Mirrorless
$3998 SAVE $500 = 11.0% Sony a9 Mirrorless in Cameras: Mirrorless
$5987 SAVE $1839 = 23.0% ZEISS Loxia 5-Lens Bundle in Lenses: Mirrorless
$11594 SAVE $3157 = 21.0% ZEISS Otus ZF.2 3-Lens Bundle in Lenses: DSLR

diglloyd.com | Terms of Use | PRIVACY POLICY
Contact | About Lloyd Chambers | Consulting | Photo Tours
Mailing Lists | RSS Feeds | Twitter
Copyright © 2019 diglloyd Inc, all rights reserved.
Display info: __RETINA_INFO_STATUS__