8 ms·
Mac OS High Sierra automatically checks EFI firmware each week
- AgentEpsilon 9y agoPersonally, I use rEFInd to manage my MBP's OS installs. I know that it installs itself to the EFI partition, but would that cause this service to identify an insecure/corrupted/whatever EFI?
- kogir 9y agorEFInd is just an EFI application. It doesn't replace the system EFI firmware (which runs before, launches, and provides services to rEFInd). As to whether or not this tool will flag it, I suppose you'll find out shorty after installing High Sierra.
- cynix 9y agoIf the EFI firmware has been modified by a rootkit, surely it'll try to hide itself and present "valid" firmware data to the OS, and thus avoiding detection by this tool, right?
- microcolonel 9y agoYeah, it seems like this would have to be accomplished with a Management Engine application or something of the sort, otherwise probably easy to circumvent. Seems the collection behaviour is also pretty straightforward to avoid, since you could just have an NVRAM region with the actual code in it, or a decryption stub. Then again, at least it's something, no use raining on their parades.
- gruez 9y ago>Yeah, it seems like this would have to be accomplished with a Management Engine application or something of the sort, otherwise probably easy to circumvent. The correct solution to this is secureboot. No need for ME shenanigans.
- microcolonel 9y agoIf secureboot is functioning, then the wrong firmware wouldn't be installed to begin with by the time OS X gets to it, because it would not be allowed to run.
- amluto 9y agoA TPM can be used to avoid this -- the firmware can update PCRs with its own hash early enough that malware can't run.
- magnat 9y agoSurely a firmware rootkit can prevent eficheck from accessing TPM altogether or force the program to report everything is OK. If eficheck is not unsealing secrets stored in TPM, what would be benefits of checking PCRs?
- zeep 9y agoCouldn't it simply replace eficheck and not worry about anything else?
- bdonlan 9y agoThat depends - it's possible to have a first stage bootloader in mask or OTP ROM that hashes the firmware before passing off control. No idea if Macs do this though.
- magnat 9y agoWhy bother with providing userland tool then? If you have complete chain of trust, the tool can just MsgBox("Everything's OK") because you wouldn't be able to boot OS if EFI didn't pass the check. If you don't have a chain of trust, the tool can be easily tampered with by the rootkit. Either way - it serves no real security purpose other than perhaps reassuring user or detecting obsolete, existing rootkits.
- rothbardrand 9y agoI do believe the whole point of the TPM on macs is the make sure the firmware and ultimately OS is signed with Apple keys.
- amluto 9y agoA lot of newer Intel CPUs can be programmed, via fuses, to refuse to boot unless the first-stage firmware hashes to a specified value.
- cmurf 9y agoSo the firmware could be compromised for up to a week, allowing a malicious 3rd party that long to exfiltrate whatever they want? If the problem of fake firmware is real, why not check it at every boot? Why not implement both UEFI Secure Boot, and also Measured Boot?
- burntrelish1273 9y agoHIDS/HIPS has always been problematic because of chicken-and-egg rootkitability (ie a rooted box scanning itself is tantamount to worthless), also clean image scanning has been extremely inconvenient. It would make more sense to have an secure OS in ROM that runs at boot and at various times which bypasses the installed OS and drivers, and can scan firmwares, microcode on various buses and critical files. Basically, hardware TripWire, but with an authoritative signatures database. And certainly, UEFI Secure/Measured Boot is complementary for defense-in-depth. Also, it would be helpful if PCIe, HDMI, USB, Thunderbolt, etc. drivers ask permission of the user before automatically connecting devices inserted into PCs... basically a peripheral "firewall." There are too many buses that are happy to give up the FSB and PCIe-side without authorization. Hell, it would be even better if buses used some sort of minimal-but-essential PKI and encryption.
- colejohnson66 9y ago> It would make more sense to have an secure OS in ROM that runs at boot and at various times which bypasses the installed OS and drivers, and can scan firmwares, microcode on various buses and critical files. Isn’t that what Intel ME is? The only difference being we don’t know what exactly it does?
- hdhzy 9y ago> Also, it would be helpful if PCIe, HDMI, USB, Thunderbolt, etc. drivers ask permission of the user before automatically connecting devices inserted into PCs... Thunderbolt 3 does exactly this (at least on Windows). When connected to new hardware it asks whether to approve it or not (e.g. for Dell dock I had to approve both the dock and the cable).
- aaronbrethorst 9y ago
- geuis 9y agoWhat are the potential impacts to the hackintosh community? I haven’t powered up my old one in a while and it’s tremedously out of date.
- gervase 9y agoSince this appears to be strictly a notification for now, I expect Hackintosh users will see the message once, choose "Don't Send", and never see it again. According to the article, once you've made your choice, that choice is remembered between reboots. Long term, I could potentially see this being modified to pop up every time on startup, as a "We know what you're doing, and we don't like it" signal to the Hackintosh users out there. However, that seems like kind of a dick move for such a small (and passionate) fraction of your market.
- lostlogin 9y agoTried to use iMessage on a hackintosh recently. Don’t do this, and don’t let anyone you know do it. Watching your services get switched off in a cascade is rather awful.
- vogon_laureate 9y agoDid you generate a valid serial number / model combo first?
- lostlogin 9y agoIt wasn’t my machine but I think that had been done. It thought it was a nice new iMac.
- c0nsumer 9y agoI'd really like to know the mechanism used for this. Currently Apple has issues with macOS firmware updates done on networks with proxies. Specifically, the Touchbar updates have no concept of proxies and will cause the machine to appear to hang for a while (~20 minutes, IIRC) on boot when they can't directly phone home. This is a big problem on some large corporate networks.
- digitalsushi 9y agoi work at a fortune 50, had a mac mini that got borked... they said "will this fit in your backpack? can you sneak it home to fix it?" yup, sure could. kinda sad.
- lightedman 9y ago"Currently Apple has issues with macOS firmware updates done on networks with proxies." They had the exact same problem with installing system images via proxied networks a little over a decade ago. I wonder if they're utilizing the same coders.
- misterdata 9y agomacOS Sierra already periodically checks the firmware for Thunderbolt Ethernet adapters: /usr/libexec/firmwarecheckers/ethcheck/ethcheck: usage: ethcheck: [ --save -b <eth nvram bin output file> ] [ --integrity-check [ -b <eth nvram bin input file> ] ] [ --show-hashes [ -b <eth nvram bin input file> ] ] [ --cleanup -b <eth nvram bin input/output file> [ --send-change-in-firmware enable/disable] [ --version]
- crishoj 9y agoThis feature was the subject of a talk at Ekoparty: https://www.ekoparty.org/charla.php?id=798 https://www.ekoparty.org/charla.php?id=798
- deleted 9y ago[deleted]
- youdontknowtho 9y agoI'm a little surprised by how little chest thumping there is about apple collecting telemetry like this. I expected this to be full of people saying that you should only use tails and tor from a faraday cage. Pleasantly surprised.
- Operyl 9y agoUh. It’s not heavily sensitive information, has a show details button, and honors user choices. Why would there be any anger?
- youdontknowtho 9y agobecause people aren't rational about this subject. on this site their are people with intense maximalist positions on privacy. they can be kind of shrill.
- ballenf 9y agoI wonder if there'll be any transparency around the database of known 'good' firmwares? For example, could a state actor force inclusion of a 'bad' firmware in the list? That's rhetorical, but the question is wouldn't it be better if end users could have visibility into the list of valid hashes? A count of the prevelance of each hash would pretty quickly highlight any with only a handful of appearances in the wild.