4 ms·

This isn't persistent, right? At least on iPhones, checkra1n needs to run every boot to keep the device jailbroken. So if you saw the machine boot with nothing

by Gaelan 6y ago

This isn't persistent, right? At least on iPhones, checkra1n needs to run every boot to keep the device jailbroken. So if you saw the machine boot with nothing plugged in, you can trust it.

joshspankit 6y ago
“as long as ______ you can trust it” is a very dangerous statement. Persistent (and silent) hacks are kept out of the public’s eye because they get sold for six figures and higher. As soon as one of those becomes public, they are essentially worthless.
- devenblake 6y ago
  If you're being chased after the type of people who can buy hacks for six figures or higher you're as good as dead anyway.
- Gaelan 6y ago
  Fair enough. I guess what I meant to say is "as long as you saw it boot up with nothing in the USB ports, you don't have to worry about this particular vulnerability."
AnthonyMouse 6y ago
> So if you saw the machine boot with nothing plugged in, you can trust it. That's assuming they haven't just attached it to the port from the inside. Or, for that matter, replaced the entire logic board with their own, having used some less subtle attack against the original to extract and copy its secrets/data. You can't really trust anything an attacker has had unsupervised physical access to.
deleted 6y ago
[deleted]
jpillora 6y ago
Demo shows root shell. So an attacker could simply install a RAT into /Library/LaunchDaemons and it's permanent.
- mrarm 6y ago
  It's not that easy since the T2 chip runs a derivative of iOS which requires codesigning. The only problem is that the T2 rarely reboots which means that erasing any modifications from it might be difficult (as far as I am aware long pressing the power button for 10 seconds should be enough to reset both the T2 and Intel though). It is impossible to untethered persist a modified version of MacEFI without another exploit on the T2 since it has to be signed by Apple and the signature is properly checked.
  - saagarjha 6y ago
    > It's not that easy since the T2 chip runs a derivative of iOS which requires codesigning. I mean, you can just ad-hoc sign?
Nextgrid 6y ago
To me it seems like it would be persistent. They modified the EFI application which is the first thing that runs when the computer is booted. A backdoor in there can wait for the user to type in their full disk encryption password, mount the disk, replace the kernel binary with a malicious version and then boot the system. For good measure, repeat the above steps upon each system boot in case a system update or something overwrote the backdoored kernel. --- This is actually similar to how Computrace/LoJack worked, except that one didn't defeat full disk encryption and would only place its payload onto unencrypted disks.
penwellr 6y ago
The T2 in a portable stays on even when the Intel CPU and macOS are shutdown, so "persistence" is pretty easy (the T2 can go very very low power). Once you own the T2 you can just disable secure boot and modify macOS anyway (like injecting EFI apps/drivers into the EFI System Partition).

by Gaelan 6y ago

This isn't persistent, right? At least on iPhones, checkra1n needs to run every boot to keep the device jailbroken. So if you saw the machine boot with nothing plugged in, you can trust it.

joshspankit 6y ago

“as long as ______ you can trust it” is a very dangerous statement. Persistent (and silent) hacks are kept out of the public’s eye because they get sold for six figures and higher. As soon as one of those becomes public, they are essentially worthless.

devenblake 6y ago
If you're being chased after the type of people who can buy hacks for six figures or higher you're as good as dead anyway.
Gaelan 6y ago
Fair enough. I guess what I meant to say is "as long as you saw it boot up with nothing in the USB ports, you don't have to worry about this particular vulnerability."

AnthonyMouse 6y ago

> So if you saw the machine boot with nothing plugged in, you can trust it. That's assuming they haven't just attached it to the port from the inside. Or, for that matter, replaced the entire logic board with their own, having used some less subtle attack against the original to extract and copy its secrets/data. You can't really trust anything an attacker has had unsupervised physical access to.

deleted 6y ago

[deleted]

jpillora 6y ago

Demo shows root shell. So an attacker could simply install a RAT into /Library/LaunchDaemons and it's permanent.

mrarm 6y ago
It's not that easy since the T2 chip runs a derivative of iOS which requires codesigning. The only problem is that the T2 rarely reboots which means that erasing any modifications from it might be difficult (as far as I am aware long pressing the power button for 10 seconds should be enough to reset both the T2 and Intel though). It is impossible to untethered persist a modified version of MacEFI without another exploit on the T2 since it has to be signed by Apple and the signature is properly checked.
- saagarjha 6y ago
  > It's not that easy since the T2 chip runs a derivative of iOS which requires codesigning. I mean, you can just ad-hoc sign?

Nextgrid 6y ago

To me it seems like it would be persistent. They modified the EFI application which is the first thing that runs when the computer is booted. A backdoor in there can wait for the user to type in their full disk encryption password, mount the disk, replace the kernel binary with a malicious version and then boot the system. For good measure, repeat the above steps upon each system boot in case a system update or something overwrote the backdoored kernel. --- This is actually similar to how Computrace/LoJack worked, except that one didn't defeat full disk encryption and would only place its payload onto unencrypted disks.

penwellr 6y ago

The T2 in a portable stays on even when the Intel CPU and macOS are shutdown, so "persistence" is pretty easy (the T2 can go very very low power). Once you own the T2 you can just disable secure boot and modify macOS anyway (like injecting EFI apps/drivers into the EFI System Partition).