4 ms·
This attack wouldn't require physical access. The researcher analyzed a firmware update that Apple had sent out to reverse engineer the passwords, which he then
by function_seven 15y ago
This attack wouldn't require physical access. The researcher analyzed a firmware update that Apple had sent out to reverse engineer the passwords, which he then used to poke around the code in the battery.
Theoretically, malware could get onto a machine by whatever means, then use the battery as a nasty hiding place, or target the battery itself.
EDIT: It should be noted that a second vulnerability will be needed to get code from the battery into the machine.
- tptacek 15y agoI have zero familiarity with Charlie's research, but I have a (passing) familiarity with battery controllers, and the malware-hiding-on-battery thing doesn't add up to me. How does the battery access host memory? It's not like these things do DMA, right?
- function_seven 15y agoThat's the second vulnerability that would need to be found. Maybe it's locked down and we're okay. Or maybe the code in OSX that reads the battery's health and capacity has a buffer waiting to be overflowed.
- tptacek 15y agoMy impression is that the "second vulnerability" Charlie is talking about is the remote->kernel transit needed to allow you to talk to the battery in the first place.