Ars Technica:
Macs older than a year are vulnerable to exploits that remotely overwrite the firmware that boots up the machine, a feat that allows attackers to control vulnerable devices from the very first instruction.
The attack, according to a blog post published Friday by well-known OS X security researcher Pedro Vilaca, affects Macs shipped prior to the middle of 2014.
The new attack doesn’t require even brief physical access as Thunderstrike did. That means attackers half-way around the world may remotely exploit it. While the attack isn’t likely to be exploited on a mass scale, it’s also not hard for people with above-average skill to carry it out.
I’ve been chatting with my favorite security expert on Twitter about this and he says, “It looks pretty serious. Not panic level, but I hope Apple patches quickly. It makes a root exploit permanent but you still need the initial exploit. Nearly impossible to remove once exploited.”
One of the commenters at ARS makes a good point, on that no one seems to be addressing…
In the article:
Macs older than a year are vulnerable to exploits that remotely overwrite the firmware that boots up the machine, a feat that allows attackers to control vulnerable devices from the very first instruction.
And then later updated comment to reflect the HEADLINE only:
Headline updated to remove the word “remote” since the hack involves use of a local exploit.
If true, and this needs to be run locally, this is much less scary.
It is not a local exploit, as it can be performed remotely with enough creativity. This particular exploit is only one small (but scary) piece to a potentially larger puzzle. It allows you to rewrite any part of memory, including the non-volatile locations that store the Mac’s firmware. The fear is that a good hacker can combine this with a browser exploit that gives you arbitrary code access along with another exploit that gives you root access from userland (the latter exists, not in the wild yet; the former is typically easier). In that way, this can be exploited remotely.
Or even easier, just do some social engineering to get the user to install some malware, which then gains root access.
In either case, you can potentially exploit the machine for life in a (maybe?) undetectable way, if you really know what you’re doing.
If any of that is true why was the headline changed? Also, through social engineering you can get control of anything if someone is gullible enough.
I am not suggesting that this isn’t of great concern, I’d just like some more accurate information other than maybe’s and possible scenarios’s.
Headlines are changed for many reasons. Also, tech writers rarely understand exactly what the actual exploits do. You don’t have to believe me.. read the original article the security researcher published to see how it works and what is possible:
https://reverse.put.as/2015/05/29/the-empire-strikes-back-apple-how-your-mac-firmware-security-is-completely-broken/
Social engineering alone does not get you a permanent modification to system firmware, so again, that is only one piece of the overall puzzle. As for the sudo command, as I mentioned in the previous post, the hacker can use a privilege escalation exploit to go from a normal user to root access to get around needing a password. These are not currently used in the wild (as far as I know) but people do have them. No social engineering required.
“Accurate information” vs “possible scenarios”, these are not necessarily separate things. The ability to chain together multiple exploits to permanently modify Mac firmware is both accurate and a possible scenario. I agree it is doubtful that it will be exploited on a wide scale due to the complexity involved, so end users probably don’t have to worry too much about it as long as Apple fixes it in a reasonable time. The media is (as always) going to play it up to sound really scary, but this exploit is real, and it can be exploited remotely when combined with other exploits. Even though it does not appear this is happening currently, that does not invalidate either of those factual statements.
I read the original post you linked to after leaving the comment. That’s why I appended it. Thanks for the link though.
I wasn’t aware of a remote exploit to escalate privileges. I know of only a few ways, all of them require access to the computer, because of having to shutdown and reboot into single user mode. But I am not an expert either, at least not at cracking.
So, PPC Macs are not affected? Yes, I should read the article, if my intrawebz hold.