Flaw in MacBook EFI allows attackers to boot ROM with malware using Thunderbolt PortsEvil Maid AttackPersistence
Evil Maid Attack
The attack is an “evil maid,” replacing the boot code on the computer. His research involves infect Apple EFI (Extensible Firmware Interface) firmware using the externally accessible Thunderbolt ports. EFI ROMs are supposed to be cryptographically signed, but Hudson says that the Thunderbolt Option ROMs may be used to circumvent the signature checks in Apple’s EFI firmware update routines. Neither the MacBook hardware nor software perform cryptographic checks of the ROMs at boot time allowing the machine to be illegally accessed. Hudson states on Events blog, In simpler words, an attacker can replace the ROM of the machine, with one of their own. Apple devices usually undergo check before such an operation can be performed, which include cryptographic signatures, but this check is not performed if the change is done via the Thurnderbolt port. Neither the OS, nor any hardware mechanism perform any sort of check. If the attacker manages to replace the ROM, the attacker now has the ability to control the machine right from boot up.
Persistence
Hudson has created a proof of concept bootkit which also replaces Apple’s cryptographic keys in the ROM and prevents any attempt to replace them that isn’t signed with the attacker’s private key. The ROM thus installed, is even capable enough of hiding itself from detection by other applications, leaving any security mechanism on the machine useless. The code also has the capability to survive a complete OS re-installation making it near impossible for any normal user to eradicate it. The code can only be removed with an in-system hardware device. Apple has not commented on this story. We will update this article as and when they do.
