2 ms·

For me, this the single most insightful / unsettling quote from the article: > Thunderstrike 2 doesn't make use of any new zero-day > vulnerabilities -- th

by Jedd 11y ago

For me, this the single most insightful / unsettling quote from the article: > Thunderstrike 2 doesn't make use of any new zero-day > vulnerabilities -- these are all older vulnerabilities > that had been previously disclosed and fixed on other > platforms. The 'other platform' bit is a tad ambiguous, or simply overly generous, if you consider (U)EFI to be the platform.

tjohns 11y ago
It sounds like unsigned Option ROMs are an even bigger problem. If anything, UEFI provides an effective defense via Secure Boot. Sadly, Apple doesn't currently implement this feature -- at a minimum, they'd need to upgrade from EFI 1.10 to UEFI 2.3 to even be able to consider it.