Unfotunately here is no security forum
http://h-online.com/-1655108
From heise security
"EFI rootkit for Macs demonstrated
At the Black Hat hacker conference, Australian security expert Loukas K (aka Snare) has demonstrated a rootkit which is able to insert itself into a Macbook Air's EFI firmware and bypass the FileVault hard drive encryption system. Although the idea of an EFI rootkit is nothing new, this is the first time it has been demonstrated live and the hacker has used a previously unknown method based on a modified Thunderbolt to Ethernet adapter.
From the point of view of an attacker, a rootkit inserted into the EFI BIOS has some major advantages. The malicious code survives rebooting, is able to bypass hard drive encryption, does not have to make any changes to the hard drive, and is in a position to modify the operating system kernel on booting. Infection requires physical access to the computer (Evil Maid attack).
Depending on the ports available on the target system, an attacker can either insert a USB flash drive containing the malicious code or choose a newly demonstrated method using a Thunderbolt to Ethernet adapter – an accessory available from Apple. Snare was able to save a device driver, which is automatically loaded when the computer is rebooted, on the adapter. As proof, with the dongle inserted, the Mac displays an alternative start screen, rather than the usual apple, on booting. With the help of this device driver, the malicious code is loaded and executed later in the boot process.
Snare's device driver is not just able to load the malicious code which modifies the kernel – it is also able to perform actions such as recording the password for decrypting a FileVault-encrypted hard drive. According to Snare, Apple was informed of the issue several months in advance of his presentation and has even confirmed that the attack works, but, because of the technical capabilities of Thunderbolt, implementing a solution is not straightforward.
Snare told The H's associates at heise Security that adding functionality to the malicious code, such as opening a reverse shell after infecting the kernel, is simple.
(Uli Ries / djwm)"
http://h-online.com/-1655108
From heise security
"EFI rootkit for Macs demonstrated
At the Black Hat hacker conference, Australian security expert Loukas K (aka Snare) has demonstrated a rootkit which is able to insert itself into a Macbook Air's EFI firmware and bypass the FileVault hard drive encryption system. Although the idea of an EFI rootkit is nothing new, this is the first time it has been demonstrated live and the hacker has used a previously unknown method based on a modified Thunderbolt to Ethernet adapter.
From the point of view of an attacker, a rootkit inserted into the EFI BIOS has some major advantages. The malicious code survives rebooting, is able to bypass hard drive encryption, does not have to make any changes to the hard drive, and is in a position to modify the operating system kernel on booting. Infection requires physical access to the computer (Evil Maid attack).
Depending on the ports available on the target system, an attacker can either insert a USB flash drive containing the malicious code or choose a newly demonstrated method using a Thunderbolt to Ethernet adapter – an accessory available from Apple. Snare was able to save a device driver, which is automatically loaded when the computer is rebooted, on the adapter. As proof, with the dongle inserted, the Mac displays an alternative start screen, rather than the usual apple, on booting. With the help of this device driver, the malicious code is loaded and executed later in the boot process.
Snare's device driver is not just able to load the malicious code which modifies the kernel – it is also able to perform actions such as recording the password for decrypting a FileVault-encrypted hard drive. According to Snare, Apple was informed of the issue several months in advance of his presentation and has even confirmed that the attack works, but, because of the technical capabilities of Thunderbolt, implementing a solution is not straightforward.
Snare told The H's associates at heise Security that adding functionality to the malicious code, such as opening a reverse shell after infecting the kernel, is simple.
(Uli Ries / djwm)"
It is certainly possible to do this from the OS on some systems without the user seeing the firmware update progress bar or any other visual cue. The malware just communicates with the chipset that the EFI EEPROM is connected to (e.g. Intel P55) and that chipset talks to the EEPROM via SPI. Newer machines use the write-protect pin on the flash so that once the OS is booted you can't write to it, so the firmware flashing would need to happen in the early stages of EFI (which can be achieved in a similar way to how Apple's firmware updates work - pass an EFI capsule back to EFI and have it deploy the firmware from there).