4 ms·
If the EFI firmware has been modified by a rootkit, surely it'll try to hide itself and present "valid" firmware data to the OS, and thus avoiding detection by
by cynix 9y ago
If the EFI firmware has been modified by a rootkit, surely it'll try to hide itself and present "valid" firmware data to the OS, and thus avoiding detection by this tool, right?
- microcolonel 9y agoYeah, it seems like this would have to be accomplished with a Management Engine application or something of the sort, otherwise probably easy to circumvent. Seems the collection behaviour is also pretty straightforward to avoid, since you could just have an NVRAM region with the actual code in it, or a decryption stub. Then again, at least it's something, no use raining on their parades.
- gruez 9y ago>Yeah, it seems like this would have to be accomplished with a Management Engine application or something of the sort, otherwise probably easy to circumvent. The correct solution to this is secureboot. No need for ME shenanigans.
- microcolonel 9y agoIf secureboot is functioning, then the wrong firmware wouldn't be installed to begin with by the time OS X gets to it, because it would not be allowed to run.
- amluto 9y agoA TPM can be used to avoid this -- the firmware can update PCRs with its own hash early enough that malware can't run.
- magnat 9y agoSurely a firmware rootkit can prevent eficheck from accessing TPM altogether or force the program to report everything is OK. If eficheck is not unsealing secrets stored in TPM, what would be benefits of checking PCRs?
- zeep 9y agoCouldn't it simply replace eficheck and not worry about anything else?
- bdonlan 9y agoThat depends - it's possible to have a first stage bootloader in mask or OTP ROM that hashes the firmware before passing off control. No idea if Macs do this though.
- magnat 9y agoWhy bother with providing userland tool then? If you have complete chain of trust, the tool can just MsgBox("Everything's OK") because you wouldn't be able to boot OS if EFI didn't pass the check. If you don't have a chain of trust, the tool can be easily tampered with by the rootkit. Either way - it serves no real security purpose other than perhaps reassuring user or detecting obsolete, existing rootkits.
- rothbardrand 9y agoI do believe the whole point of the TPM on macs is the make sure the firmware and ultimately OS is signed with Apple keys.
- amluto 9y agoA lot of newer Intel CPUs can be programmed, via fuses, to refuse to boot unless the first-stage firmware hashes to a specified value.
- amluto 9y agoIn principle, eficheck could attest to the firmware's health to an Apple server. It's not entirely clear what it would accomplish UI-wise, though.