>They developed a new tool eficheck, released in High Sierra on 25 September 2017. Each week until it was dropped from Sonoma, eficheck checked current firmware

>They developed a new tool eficheck, released in High Sierra on 25 September 2017. Each week until it was dropped from Sonoma, eficheck checked current firmware against a local database of versions known to be ‘good’, and with the user’s permission sent a report to Apple in the event that it found discrepancies. What stops me from writing a malicious firmware implant which tampers with the local database every time the computer boots, and inserts itself as "known good"? I don't see how it's possible to monitor the firmware from the OS, if the OS already implicitly trusts the firmware... Also: Does anyone know of good resources for learning about firmware security from the ground up? Seems like this article already assumes a certain level of background knowledge.