4 ms·

> Requires physical device access. For what it's worth, we're talking about mostly personal laptops, tablets, and smartphones here - not corporate servers. I

> Requires physical device access. For what it's worth, we're talking about mostly personal laptops, tablets, and smartphones here - not corporate servers. I wouldn't be so quick to dismiss the "physical access" requirement, although that does at least make it difficult for attackers to exploit the vulnerability at a large scale.

sprayk 6y ago
physically target the macbooks of employees that have access to those servers, especially the enterprise device management servers, and you can probably exploit this at a larger scale. You could do a pretty trivial amount of LinkedIn research to figure out your targets.
danpalmer 6y ago
Sure, but as mentioned there are basically 2 versions: steal, or modify in place. With the former, the device is already stolen. The only difference here is that the thief can re-sell it. That's not a huge win for the user who it was stolen from. With the latter, you need ongoing physical access in order to install and maintain a presence on the device. That's a sophisticated attack, but sophisticated attackers already have ways of doing this.
- ampdepolymerase 6y ago
  Or version 3, the powers that be ask you nicely to hand over your device. The fourth and fifth offers only very limited protection in the digital sphere and current precedents on decryption and access can easily be overrode by courts.
  - nkrisc 6y ago
    Yes, they mention that in their original post: > This makes it more attractive to do without stealing, but that's an attack style that is only really done by state level threats, and one that was still possible anyway, because hardware access is essentially game-over anyway at that point.
- CodeWriter23 6y ago
  > you need ongoing physical access in order to install and maintain a presence on the device I don’t think that’s 100% true. Yes, you need persistent hardware to re-root the T2 on every reboot. But what about a one and done T2 attack - a drive by keylogger installer? Get credentials and then mount a more traditional attack to install APT/RAT.
  - danpalmer 6y ago
    Yeah so the user should reboot if they believe someone has tampered with the device, such as after a TSA check.
    - kelnos 6y ago
      Will that help for all cases, though? Wouldn't this allow someone to install a persistent keylogger that would survive reboots? Also from my reading of that, the T2 chip doesn't reboot with the laptop -- it stays powered on at all times after it first starts up. If that's really the case, a reboot won't do much except kill non-persistent things that are running on macOS itself.
      - CodeWriter23 6y ago
        The article says you need a hardware device to maintain persistence and also recommends using Apple Configurator to “ reinstall bridgeOS on your T2 chip“. So, a) a T2 hack persists until such reinstall and b) you don’t need a persistent beachhead if you’ve taken the hill and maintain persistence there. This exploit opens the door to that, and you can install keyboard intercepts via the new System Extensions Interface. Did it yesterday myself via an update to Karibiner. Notarization can be disabled by interrupting the network pathway and you can definitely disable SIP after you capture the password. In essence, T2 is the lynchpin that prevents the defeat of other aspects of macOS security.

sprayk 6y ago

physically target the macbooks of employees that have access to those servers, especially the enterprise device management servers, and you can probably exploit this at a larger scale. You could do a pretty trivial amount of LinkedIn research to figure out your targets.

danpalmer 6y ago

Sure, but as mentioned there are basically 2 versions: steal, or modify in place. With the former, the device is already stolen. The only difference here is that the thief can re-sell it. That's not a huge win for the user who it was stolen from. With the latter, you need ongoing physical access in order to install and maintain a presence on the device. That's a sophisticated attack, but sophisticated attackers already have ways of doing this.

ampdepolymerase 6y ago
Or version 3, the powers that be ask you nicely to hand over your device. The fourth and fifth offers only very limited protection in the digital sphere and current precedents on decryption and access can easily be overrode by courts.
- nkrisc 6y ago
  Yes, they mention that in their original post: > This makes it more attractive to do without stealing, but that's an attack style that is only really done by state level threats, and one that was still possible anyway, because hardware access is essentially game-over anyway at that point.
CodeWriter23 6y ago
> you need ongoing physical access in order to install and maintain a presence on the device I don’t think that’s 100% true. Yes, you need persistent hardware to re-root the T2 on every reboot. But what about a one and done T2 attack - a drive by keylogger installer? Get credentials and then mount a more traditional attack to install APT/RAT.
- danpalmer 6y ago
  Yeah so the user should reboot if they believe someone has tampered with the device, such as after a TSA check.
  - kelnos 6y ago
    Will that help for all cases, though? Wouldn't this allow someone to install a persistent keylogger that would survive reboots? Also from my reading of that, the T2 chip doesn't reboot with the laptop -- it stays powered on at all times after it first starts up. If that's really the case, a reboot won't do much except kill non-persistent things that are running on macOS itself.
    - CodeWriter23 6y ago
      The article says you need a hardware device to maintain persistence and also recommends using Apple Configurator to “ reinstall bridgeOS on your T2 chip“. So, a) a T2 hack persists until such reinstall and b) you don’t need a persistent beachhead if you’ve taken the hill and maintain persistence there. This exploit opens the door to that, and you can install keyboard intercepts via the new System Extensions Interface. Did it yesterday myself via an update to Karibiner. Notarization can be disabled by interrupting the network pathway and you can definitely disable SIP after you capture the password. In essence, T2 is the lynchpin that prevents the defeat of other aspects of macOS security.