3 ms·

Can the T2 chip be accessed via a publicly accessible API? Or would some reverse engineering be required? Since the third party check is software based, it's t

Can the T2 chip be accessed via a publicly accessible API? Or would some reverse engineering be required? Since the third party check is software based, it's theoretically possible to write a piece of software that could either overwrite the flag on the T2 chip or man-in-the-middle spoof the return value to relevant applications. EDIT: I'm also curious to find out whether it's the OS or EFI that's performing the check. Because if it's Mac OS, the easy "hack" fix would be to use an alternate OS such as Windows or Linux that doesn't care about the T2 chip. But I guess that would defeat the purpose of buying a Macbook Pro in the first place. Also, now that I think about it, if the check is in EFI then you're kinda screwed since you can't really patch it preemptively or man-in-the-middle it without booting an OS first... ...No wait, that's why projects like rEFInd exist. I guess someone could write a custom EFI manager that would bypass the check. Just install rEFInd first before replacing parts. Seems that this is super hackable and is just a matter of time until we are able to spoof the flag.

JonathonW 8y ago
The check in question is likely happening on the T2 itself; it's a small ARM processor (derived from the ones used in iOS devices) running its own OS (a variant of watchOS, which is itself ultimately a derivative of macOS). Among other things, it's responsible for the early boot process; it performs firmware and OS verification and can stop the boot process if it thinks things don't look right.
- dabockster 8y ago
  > it performs firmware and OS verification and can stop the boot process if it thinks things don't look right Well crap. There goes my ideas.
jakobegger 8y ago
Isn't the whole point of the T2 chip to prevent these kinds of attacks? The T2 starts the boot process and verifies the integrity of the system (including OS) and you can't flash the T2 without a digital signature from Apple. Unless someone finds a serious flaw in the system, or one of Apple's signing keys is leaked, I don't see how you'd circumvent it.
jesseendahl 8y ago
FWIW, Windows does care about the T2 chip: https://www.computerworld.com/article/3290415/apple-mac/the-macbook-pro-s-t2-chip-boosts-enterprise-security.html https://www.computerworld.com/article/3290415/apple-mac/the-... https://support.apple.com/en-us/HT208330 https://support.apple.com/en-us/HT208330

JonathonW 8y ago

The check in question is likely happening on the T2 itself; it's a small ARM processor (derived from the ones used in iOS devices) running its own OS (a variant of watchOS, which is itself ultimately a derivative of macOS). Among other things, it's responsible for the early boot process; it performs firmware and OS verification and can stop the boot process if it thinks things don't look right.

dabockster 8y ago
> it performs firmware and OS verification and can stop the boot process if it thinks things don't look right Well crap. There goes my ideas.

jakobegger 8y ago

Isn't the whole point of the T2 chip to prevent these kinds of attacks? The T2 starts the boot process and verifies the integrity of the system (including OS) and you can't flash the T2 without a digital signature from Apple. Unless someone finds a serious flaw in the system, or one of Apple's signing keys is leaked, I don't see how you'd circumvent it.

jesseendahl 8y ago

FWIW, Windows does care about the T2 chip: https://www.computerworld.com/article/3290415/apple-mac/the-macbook-pro-s-t2-chip-boosts-enterprise-security.html https://www.computerworld.com/article/3290415/apple-mac/the-... https://support.apple.com/en-us/HT208330 https://support.apple.com/en-us/HT208330