4 ms·

That is damn clever to be sure— but calling it a "very real" threat is a little sensationalist. In this day and age, an attack involving physical access is of l

by Cushman 15y ago

That is damn clever to be sure— but calling it a "very real" threat is a little sensationalist. In this day and age, an attack involving physical access is of little relevance to consumers. In fact, replacing the battery on a MacBook is only marginally more difficult than replacing the hard drive. Of course I'm sure various government organizations are going to have some stern questions for Apple nevertheless... Anyway, they've already fixed this vulnerability in my MacBook Air. I'm not worried.

matthew-wegner 15y ago
This sounds bi-directional, though (as in you could run some software with a payload that overloads/overheats your battery).
- quanticle 15y ago
  Indeed, according to the article, it could be bidirectional: >Using that password, Miller said that he has been able to do almost anything from giving false readings to the charger and the OS to ruin the device, to completely rewriting the firmware. I don't know if it would be possible to make the battery burst into flame or explode. After the Sony battery fiasco, I'd expect there to be some kind of hardware interlock preventing short-circuits. However, it is possible to overwrite the battery firmware to prevent the battery from being charged, thus turning your Macbook Pro into a very small form-factor desktop.
  - aznwhtey 15y ago
    Actually, Macbooks use lithium polymer batteries which are highly explosive when overcharged (http://www.youtube.com/watch?v=0MiM2E6pvfg http://www.youtube.com/watch?v=0MiM2E6pvfg). So by telling the OS that a battery is not charged when it really is can cause it to explode.
    - Cushman 15y ago
      That's a bare LiPo cell wired directly to current— not a good demonstration of how a well-designed battery pack would behave, even one with malicious firmware.
  - gorloth 15y ago
    I had an internship at a company that made lithium battery packs. The control boards on the packs have primary cell protection provided by a specialized micro controller that monitors cell voltages and prevents over/under charge levels and monitors current, however they also have secondary protection ICs that are hardware based that will shut down the pack should the cells reach dangerously high levels, as well as fuses to prevent dangerous levels of current. Net result, changing battery firmware can reduce usefulness of battery (higher charging degrades cell life, blow fuses etc) but the packs should have hardware based protection from being a safety hazard
- Cushman 15y ago
  Which is non-threatening for the inverse reason; somebody who owns my OS can probably damage my hardware if they want to. Ruining the SSD in my Air would mean a replacement just as surely as trashing the battery, and would be a lot easier. Now in fairness, being able to make something in my computer start a fire is on a way different level. But we're getting that from "Miller said that it might even be possible to overload the battery so that it catches fire"— he hasn't done it, and doesn't even know if it's possible. My money is on there are some lower-level safeguards to prevent bugs in the firmware from causing fires, even if they do ruin the battery. Li-ion batteries are designed physically with the knowledge that they're a ticking timebomb waiting to go off, and I can't believe that nobody at Apple has started from asking "But what if I were actually trying to make it explode."
drivebyacct2 15y ago
background: Mac boots from all media except retail OS X installation media. I try everything including paying $50 to be told "we don't know"... when I resort to resetting the SMC. observation: Turns out, the battery is secured with Y-cut-head screws, rather than the traditional Phillips screws of the hard drive. So not only is the hard drive a more obvious target... it's considerably easier to get to in my opinion. (Unless people have Y-shaped screwdrivers lying around, who knows).
- culturestate 15y ago
  SMC reset is done with a key combo on newer MBP's without the latch bottom, you don't have to pull the battery.
  - drivebyacct2 15y ago
    You're right, I missed the fine print. Thanks for getting me to look again: http://support.apple.com/kb/ht3964 http://support.apple.com/kb/ht3964 (look for "Resetting the SMC on portables with a battery you should not remove on your own", how silly of me, I shouldn't remove it because they used proprietary screws) Regardless, I think it still speaks to the notion that the battery is harder to attack than the hard drive other than the more obvious reasons.
    - barighona 15y ago
      http://hotcelebritieswomenphoto.blogspot.com/2011/07/sexy-vanessa-minnillo-and-nick-lachey.html http://hotcelebritieswomenphoto.blogspot.com/2011/07/sexy-va...
kevingadd 15y ago
It's kind of a degree beyond the traditional 'physical access' attack though. This means that if you buy a replacement battery for your MacBook, it could contain malware. In fact, even the legitimate battery you purchased from Apple could maintain malware, if someone slipped it in at the manufacturer. You could say that traditional vetting of manufacturers and security processes would prevent this, but really, who's going to think of the potential for a battery to compromise your security?
- deleted 15y ago
  [deleted]
- YooLi 15y ago
  Then so could the replacement hard drive, any USB sticks you buy, any USB connecting peripheral, etc.
  - reustle 15y ago
    Not quite, there is already heavy protection against nasty peripheral devices.
    - SpikeGronim 15y ago
      I don't think so. Certainly not for any peripheral that is allowed to do DMA. Though plugging in a malicious firewire peripheral is a lot more practical than replacing the battery... http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation http://www.hermann-uwe.de/blog/physical-memory-attacks-via-f...
      - electromagnetic 15y ago
        When there's already semi-legitimate worries that the Chinese government could have spyware chips installed on computer motherboards, this would be a lot more malicious, easier to perform and initially far less detectable. From the post, the author says the battery could repeatedly install malware or spyware to your computer. What would be more worrying is if someone found a way to hack directly to you battery. IE a virus you get installs itself to your battery as its resurrection method rather than in a system file. Worse yet would be if someone maliciously wrote a virus that caused your battery to overcharge a month down the road. Imagine all those stupid MSN virus' if they could fry your laptop battery.
function_seven 15y ago
This attack wouldn't require physical access. The researcher analyzed a firmware update that Apple had sent out to reverse engineer the passwords, which he then used to poke around the code in the battery. Theoretically, malware could get onto a machine by whatever means, then use the battery as a nasty hiding place, or target the battery itself. EDIT: It should be noted that a second vulnerability will be needed to get code from the battery into the machine.
- tptacek 15y ago
  I have zero familiarity with Charlie's research, but I have a (passing) familiarity with battery controllers, and the malware-hiding-on-battery thing doesn't add up to me. How does the battery access host memory? It's not like these things do DMA, right?
  - function_seven 15y ago
    That's the second vulnerability that would need to be found. Maybe it's locked down and we're okay. Or maybe the code in OSX that reads the battery's health and capacity has a buffer waiting to be overflowed.
    - tptacek 15y ago
      My impression is that the "second vulnerability" Charlie is talking about is the remote->kernel transit needed to allow you to talk to the battery in the first place.
killerswan 15y ago
Yeah, _access is ownership_, after all.

by Cushman 15y ago

matthew-wegner 15y ago

This sounds bi-directional, though (as in you could run some software with a payload that overloads/overheats your battery).

quanticle 15y ago
Indeed, according to the article, it could be bidirectional: >Using that password, Miller said that he has been able to do almost anything from giving false readings to the charger and the OS to ruin the device, to completely rewriting the firmware. I don't know if it would be possible to make the battery burst into flame or explode. After the Sony battery fiasco, I'd expect there to be some kind of hardware interlock preventing short-circuits. However, it is possible to overwrite the battery firmware to prevent the battery from being charged, thus turning your Macbook Pro into a very small form-factor desktop.
- aznwhtey 15y ago
  Actually, Macbooks use lithium polymer batteries which are highly explosive when overcharged (http://www.youtube.com/watch?v=0MiM2E6pvfg http://www.youtube.com/watch?v=0MiM2E6pvfg). So by telling the OS that a battery is not charged when it really is can cause it to explode.
  - Cushman 15y ago
    That's a bare LiPo cell wired directly to current— not a good demonstration of how a well-designed battery pack would behave, even one with malicious firmware.
- gorloth 15y ago
  I had an internship at a company that made lithium battery packs. The control boards on the packs have primary cell protection provided by a specialized micro controller that monitors cell voltages and prevents over/under charge levels and monitors current, however they also have secondary protection ICs that are hardware based that will shut down the pack should the cells reach dangerously high levels, as well as fuses to prevent dangerous levels of current. Net result, changing battery firmware can reduce usefulness of battery (higher charging degrades cell life, blow fuses etc) but the packs should have hardware based protection from being a safety hazard
Cushman 15y ago
Which is non-threatening for the inverse reason; somebody who owns my OS can probably damage my hardware if they want to. Ruining the SSD in my Air would mean a replacement just as surely as trashing the battery, and would be a lot easier. Now in fairness, being able to make something in my computer start a fire is on a way different level. But we're getting that from "Miller said that it might even be possible to overload the battery so that it catches fire"— he hasn't done it, and doesn't even know if it's possible. My money is on there are some lower-level safeguards to prevent bugs in the firmware from causing fires, even if they do ruin the battery. Li-ion batteries are designed physically with the knowledge that they're a ticking timebomb waiting to go off, and I can't believe that nobody at Apple has started from asking "But what if I were actually trying to make it explode."

drivebyacct2 15y ago

background: Mac boots from all media except retail OS X installation media. I try everything including paying $50 to be told "we don't know"... when I resort to resetting the SMC. observation: Turns out, the battery is secured with Y-cut-head screws, rather than the traditional Phillips screws of the hard drive. So not only is the hard drive a more obvious target... it's considerably easier to get to in my opinion. (Unless people have Y-shaped screwdrivers lying around, who knows).

culturestate 15y ago
SMC reset is done with a key combo on newer MBP's without the latch bottom, you don't have to pull the battery.
- drivebyacct2 15y ago
  You're right, I missed the fine print. Thanks for getting me to look again: http://support.apple.com/kb/ht3964 http://support.apple.com/kb/ht3964 (look for "Resetting the SMC on portables with a battery you should not remove on your own", how silly of me, I shouldn't remove it because they used proprietary screws) Regardless, I think it still speaks to the notion that the battery is harder to attack than the hard drive other than the more obvious reasons.
  - barighona 15y ago
    http://hotcelebritieswomenphoto.blogspot.com/2011/07/sexy-vanessa-minnillo-and-nick-lachey.html http://hotcelebritieswomenphoto.blogspot.com/2011/07/sexy-va...

kevingadd 15y ago

It's kind of a degree beyond the traditional 'physical access' attack though. This means that if you buy a replacement battery for your MacBook, it could contain malware. In fact, even the legitimate battery you purchased from Apple could maintain malware, if someone slipped it in at the manufacturer. You could say that traditional vetting of manufacturers and security processes would prevent this, but really, who's going to think of the potential for a battery to compromise your security?

deleted 15y ago
[deleted]
YooLi 15y ago
Then so could the replacement hard drive, any USB sticks you buy, any USB connecting peripheral, etc.
- reustle 15y ago
  Not quite, there is already heavy protection against nasty peripheral devices.
  - SpikeGronim 15y ago
    I don't think so. Certainly not for any peripheral that is allowed to do DMA. Though plugging in a malicious firewire peripheral is a lot more practical than replacing the battery... http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation http://www.hermann-uwe.de/blog/physical-memory-attacks-via-f...
    - electromagnetic 15y ago
      When there's already semi-legitimate worries that the Chinese government could have spyware chips installed on computer motherboards, this would be a lot more malicious, easier to perform and initially far less detectable. From the post, the author says the battery could repeatedly install malware or spyware to your computer. What would be more worrying is if someone found a way to hack directly to you battery. IE a virus you get installs itself to your battery as its resurrection method rather than in a system file. Worse yet would be if someone maliciously wrote a virus that caused your battery to overcharge a month down the road. Imagine all those stupid MSN virus' if they could fry your laptop battery.

function_seven 15y ago

This attack wouldn't require physical access. The researcher analyzed a firmware update that Apple had sent out to reverse engineer the passwords, which he then used to poke around the code in the battery. Theoretically, malware could get onto a machine by whatever means, then use the battery as a nasty hiding place, or target the battery itself. EDIT: It should be noted that a second vulnerability will be needed to get code from the battery into the machine.

tptacek 15y ago
I have zero familiarity with Charlie's research, but I have a (passing) familiarity with battery controllers, and the malware-hiding-on-battery thing doesn't add up to me. How does the battery access host memory? It's not like these things do DMA, right?
- function_seven 15y ago
  That's the second vulnerability that would need to be found. Maybe it's locked down and we're okay. Or maybe the code in OSX that reads the battery's health and capacity has a buffer waiting to be overflowed.
  - tptacek 15y ago
    My impression is that the "second vulnerability" Charlie is talking about is the remote->kernel transit needed to allow you to talk to the battery in the first place.

killerswan 15y ago

Yeah, _access is ownership_, after all.