12 ms·
Apple T2 Security Chip: Security Overview [pdf]
- saagarjha 8y agoIs there anything different in the T2 chip introduced today in MacBook Air and the one in the MacBook Pro released earlier this year?
- josephmosby 8y agoDoesn't appear to be. Apple lists the MBP and iMac chips as one and the same - assume that the MBA would be added to this list. https://support.apple.com/en-us/HT208862 https://support.apple.com/en-us/HT208862
- voctor 8y ago"All Mac portables with the Apple T2 Security Chip feature a hardware disconnect that ensures that the microphone is disabled whenever the lid is closed." It's interesting, I don't know if other brands do that?
- badwolf 8y agoVery interesting indeed.
- joshstrange 8y agoI wonder how that works for the Mac Mini. I'm honestly not sure if it even has a microphone built in or not.
- eddieroger 8y agoThe Mac Mini isn't a portable, so not at all?
- saagarjha 8y agoAFAIK it doesn't. You need to provide your own microphone.
- robotpony 8y agoPrevious gen didn't, so I doubt the new gen does.
- duxup 8y agoI wish we had a physical switch that cut power to the camera and mic... I worked on some old networking equipment a while back that had a physical fail over switch. If you opened the cover you could watch the connection switch, fun stuff. Also very effective.
- gh02t 8y agoThe description makes it sound like Apple is using a hardware interlock that I'd assume cuts power to the microphone via a MOSFET when the lid is closed. That's pretty much the same thing, just with a solid state switch instead of a mechanical contact.
- duxup 8y agoThat's pretty cool.
- therein 8y agoIt is pretty cool indeed, however keep in mind that's just standard component in circuits to turn signals on and off. It is just a PNP or NPN transistor. Everyone makes use of it.
- gh02t 8y agoTo be clear too, I'm just speculating about that part. The only thing this document says is that "This disconnect is implemented in hardware alone, and therefore prevents any software, even with root or kernel privileges in macOS, and even the software on the T2 chip, from engaging the microphone when the lid is closed." That implies to me that they are using some form of physical interlock (probably a magnet and Hall-effect sensor), and that they use this to completely disable the microphone. The most obvious way to me to do that in this case would be to cut the power with a transistor, but in principle there are a number of other ways it could be achieved.
- therein 8y ago
- duxup 8y agoDoes this mean you can't use it in a configuration with say one laptop, two external monitors, and lid closed... and still use the mic? I don't have a Mac so maybe that isn't a valid use anyway, but I do that with PCs all the time.
- rubatuga 8y agoIt is a valid use case, and no it seems like it won't work.
- duxup 8y agoTY, interesting. Granted, I get that for security ... can't be bending the rules or it would just be the method use to circumvent it.
- Wowfunhappy 8y agoAlso, since the mic would be covered by the lid, you probably wouldn't want to use it anyway under this scenario.
- dpkonofa 8y ago>seems like it won't work Are you speculating here or do you have some kind of insight?
- duxup 8y agoI think he is speculating, but any work around to bypass the rules related to the security chip would seem unlikely.
- rconti 8y agoOr maybe we're just reading it too literally and the document actually means "when the computer is asleep" but they said "when the lid is closed", thus creating the confusion? But I guess if it's about "sleep" mode, that's too easy to bypass in software without even attacking T2...
- nabla9 8y agoWhy you need security chip to ensure that?
- pwinnski 8y agoTo prevent nefarious software from listening in unknown to you.
- nabla9 8y agoWhy it needs to go trough security chip? Laptop closed -> microphone cut off does not need complex logic. It's just simple switch.
- Wowfunhappy 8y agoI don't think you do, it's just an additional security feature that they put in the T2 PDF for some reason.
- dsfyu404ed 8y agoBecause if you don't mention that you've got a hardware switch covering the mic someone will ask you why your security chip has this glaringly obvious hole in it.
- PascLeRasc 8y ago
- byproxy 8y agoI wonder what determines whether or not the lid is closed.
- jrochkind1 8y agoupvoting because I want people who know more than me about security to see and comment. :)
- JumpCrisscross 8y ago> line-speed encrypted storage What does this mean? > The Mac unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the Secure Enclave during manufacturing. No software or firmware can read the keys directly Does anyone know the details underlying this?
- larrysalibra 8y agoIt means that it can encrypt and decrypt data at the same speed as the interface/underlying storage. Encrypted storage doesn't slow down storage versus unencrypted usage.
- Rebelgecko 8y agoI don't have any insight into the details, but I'd guess that under the hood (and not-so-under the hood) it looks and behaves a lot like a TPM
- als0 8y agoIndeed. Since Apple controls the full hardware and software stack, it's not surprising that they are making their own security chip without any of the ugly downsides of TPM (TPM has more complex interfaces and logic that try to cover a broader set of use cases than what Apple support). As another upside, they are also not reliant on any supplier code for the chip.
- conradev 8y agoMore information on the GID/UID can be found in the iOS Security Guide: > With the exception of the Apple A8 and earlier SoCs, each Secure Enclave generates its own UID (Unique ID) during the manufacturing process. Because the UID is unique to each device and because it’s generated wholly within the Secure Enclave instead of in a manufacturing system outside of the device, the UID isn’t available for access or storage by Apple or any of its suppliers. > Software running on the Secure Enclave takes advantage of the UID to protect device-specific secrets. The UID allows data to be cryptographically tied to a particular device. For example, the key hierarchy protecting the file system includes the UID, so if the memory chips are physically moved from one device to another, the files are inaccessible. The UID isn’t related to any other identifier on the device. The GID is common to all processors in a class of devices (for example, all devices using the Apple A8 processor). https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide....
- hyperrail 8y agoOne interesting point in the discussion of UEFI secure boot: it appears there is no way to boot OSes other than Mac OS and Windows without disabling secure boot entirely. > By default, Mac computers supporting secure boot only trust content signed by Apple. However, in order to improve the security of Boot Camp installations, support for secure booting Windows is also provided. The UEFI firmware includes a copy of the Microsoft Windows Production CA 2011 certificate used to authenticate Microsoft bootloaders. > NOTE: There is currently no trust provided for the the Microsoft Corporation UEFI CA 2011, which would allow verification of code signed by Microsoft partners. This UEFI CA is commonly used to verify the authenticity of bootloaders for other operating systems such as Linux variants. It isn't clear whether new root CAs can be added or if there is a customer-accessible setup mode for secure boot at all. Another part of the discussion is about the various levels of secure boot enforcement. In the default "Full Security" mode, the Mac OS setup (or Boot Camp assistant for Windows boot) requests that Apple sign the OS boot loader with a signature derived from the T2 chip's unique ID, and then the boot firmware on the T2 checks for this machine-specific signature on boot. As I understand it, Apple claims that by simply changing its online service to deny signing certain boot loaders, it can prevent many OS downgrades to versions with known vulnerabilities.
- tetrep 8y ago> As I understand it, Apple claims that by simply changing its online service to deny signing certain boot loaders, it can prevent many OS downgrades to versions with known vulnerabilities. That seems like a very reasonable ability considering that "Full Security" mode says, "This mode requires a network connection at software installation time." I'd guess it's a challenge/response deal with the T2 in your Mac issuing a challenge to Apple. The response could be as simple as Apple signing the signature of its software with the challenge, i.e. response = sign(challenge + sign(MacOS)) Presumably it's whatever Apple currently does for iOS, as my understanding is that it has the same downgrade protection feature and that is part of what makes jailbreaking so precious, you need to be on the vulnerable version of iOS in the relatively short window it's still being served by Apple (aka before Apple patches some or all of your exploit chain).
- 8y ago
- techie128 8y agoWhat happens if the T2 Chip fails? Is it possible to recover data on the disk? Or do we have to recover data from the last backup?
- wmf 8y agoIt's probably impossible if the T2 itself fails; I imagine the encryption keys are in there. Data recovery is possible if the T2 is working: https://9to5mac.com/2018/09/20/apple-t2-data-recovery-transfer-imac-pro-macbook/ https://9to5mac.com/2018/09/20/apple-t2-data-recovery-transf...
- bonestamp2 8y agoWith multiple points of failure, backups become so much more important.
- jonahhorowitz 8y agoYou can store recovery keys externally if that is consistent with your threat model.
- thelittleone 8y agoAs an example, the current gen Macbook Pro has an SSD that is soldered to the motherboard (so you obviously can't remove it and cable it up to USB via an adapter to extract data). Apple installed a port on the motherboard that their techs can use to recover data if the motherboard fails. But sure enough it didn't work with my 11 month old Macbook Pro. Moral of the story... even if Apple has a mechanism for hardware failures, there's a chance it won't work.
- Dunedan 8y agoThe current generation of MacBook Pro doesn't have such a recovery port for the SSD anymore. The MacBook Pro 2016 and MacBook Pro 2017 had such a port, but the MacBook Pro 2018, which features the T2 chip, doesn't. As the encryption keys are located inside the T2 chip, if that chips breaks, all data on the SSD is lost.
- jsgo 8y agoanyone who uses eGPUs (w/ Nvidia): whenever I setup my MBP shortly after buying (middle of this year), one of the steps required disabling Secure Boot and another security item via terminal. Is that still the case? Pretty sure my T2 chip is disabled due to this. Not a major loss if it must remain that way, but wasn't sure if it was just mitigating something that is no longer an issue.
- saagarjha 8y ago> one of the steps required disabling Secure Boot and another security item via terminal Probably SIP from Recovery Mode. This doesn't disable your T2 chip completely, since it's still necessary do things like control your camera and microphone or read from your SSD, but it disables certain protections.
- deleted 8y ago[deleted]
- alliecat 8y agoIt’s no longer required; High Sierra and Mojave both officially support eGPUs.
- solatic 8y agoI'm of two minds about how the T2 safeguards access to storage. On the one hand, safeguards like these are a great step forward for endpoint security to guard against device theft. On the other hand, if you break your machine in some way that your storage is still intact - too bad, you're locked out. What Apple is really saying with this kind of design is that you need to treat your machine as if it were disposable. You won't worry about losing your data if your laptop only has a cached copy. If your machine breaks, ditch it, get another one, redownload your data from the cloud. But most customers don't actually use their Macs this way. They don't see their highly-priced luxury machines as disposable. They don't pay for cloud storage; if they do, then they don't keep all their data backed up to their cloud storage accounts, and they expect that their original data will still be available. They don't have 3-2-1 backup strategies and they don't plan for being locked out of their cloud backups. So this doesn't feel to me like Apple focusing on security. It feels like the security-focused extension of Apple's general strategy: rising prices and declining repairability as the basic formula for strategic revenue growth from their Western upper-class customer base. And that's something to be resisted.