Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

OS X 10.10.2 Includes Fix for 'Thunderstrike' Hardware Exploit Affecting Macs

MacRumors

macrumors bot
Original poster
Apr 12, 2001
51,085
12,639



Apple is readying a fix in OS X 10.10.2 for the so-called "Thunderstrike" hardware exploit targeting Macs equipped with Thunderbolt ports, iMore has learned. According to the report, Apple patched the vulnerability by making code changes in the upcoming software update that prevent a Mac's bootrom from being replaced or rolled back to a previous state in which it could be attacked.
To secure against Thunderstrike, Apple had to change the code to not only prevent the Mac's boot ROM from being replaced, but also to prevent it from being rolled back to a state where the attack would be possible again. According to people with access to the latest beta of OS X 10.10.2 who are familiar with Thunderstrike and how it works, that's exactly the deep, layered process that's been completed.
Thunderstrike is a serious vulnerability discovered earlier this year by security researcher Trammell Hudson, enabling an attacker to replace a Mac's bootrom with malicious code without a user knowing. Since the malicious code is stored in a low level inaccessible to the user, the problem would remain even if the bootrom was replaced.

The proof-of-concept attack is limited in scope, however, as an attacker would require physical access to the Mac or savvy social engineering skills in order to trick a user into attacking his or her Mac themselves. Apple has already addressed the issue in its latest hardware, including the iMac with Retina 5K Display and new Mac mini.

OS X 10.10.2 has been in pre-release testing for over two months and should be made available to the public in the coming days. The most recent OS X 10.10.2 beta was seeded to developers for testing last Wednesday. In addition to the Thunderstrike fix, the upcoming software update addresses security vulnerabilities exposed by Google's Project Zero security team last week.

According to 9to5Mac, the latest OS X Yosemite release will also add iCloud Drive in Time Machine and resolve issues related to Wi-Fi, VoiceOver and security. In particular, a recently identified glitch causing Spotlight on OS X to expose system information to spammers through remote content loading will reportedly be patched. Safari will also gain improved performance and security.

No public instances of Thunderstrike attacks have yet to be reported.

Article Link: OS X 10.10.2 Includes Fix for 'Thunderstrike' Hardware Exploit Affecting Macs
 

maflynn

Moderator
Staff member
May 3, 2009
67,420
34,632
Boston
Hopefully this fixes other bugs as well. Its good to close down some security vulnerabilities though.
 
Comment

ghostface147

macrumors 68040
May 28, 2008
3,400
3,145
Bugs and bugs and bugs, fixes and fixes and fixes. Such is the life in software development.
 
Comment

redheeler

macrumors 604
Oct 17, 2014
7,663
7,518
It's good they're finally patching this, since being able to modify the Firmware by simply plugging in an infected Thunderbolt device and booting up has scary possibilities.

I wonder when Mavericks users are getting this patch.
 
Comment

redheeler

macrumors 604
Oct 17, 2014
7,663
7,518
EXCELLENT. I've been hoping I would eventually be able to go to a cloud based backup.

I'd rather see them increase the free storage amount to 10 GB to be more in line with other cloud backup services. Not everyone has the incentive or need to pay for more storage.
 
Comment

HenryDJP

Suspended
Nov 25, 2012
5,084
843
United States
I'd rather see them increase the free storage amount to 10 GB to be more in line with other cloud backup services. Not everyone has the incentive or need to pay for more storage.

While I totally agree with you 100% (who wouldn't agree) but what would be Apple's incentive to offer us more free storage? Please don't say "More Mac or iDevice sales" because Apple most certainly doesn't need money and their products speak for themselves now.
 
Comment

gotluck

macrumors 603
Dec 8, 2011
5,669
1,072
East Central Florida
did macrumors even cover the original thunderstrike story? don't remember seeing it here

i understand its only proof of concept, but it's unprecedented, you essentially could never do international travel with a mac
 
Comment

0003462

Suspended
Dec 17, 2013
179
208
Is iCloud Drive in Time Machine a possible sign of Time Machine for iOS coming soon? It seems incomplete for the only option to create your own backup of an iOS device to be via a computer. Trusting iCloud Backup as your sole backup (despite it being what I do myself, having no computer to backup to) isn't very sensible.

Have there been any rumours of an iOS Time Machine or Time Capsule?

----------

While I totally agree with you 100% (who wouldn't agree) but what would be Apple's incentive to offer us more free storage? Please don't say "More Mac or iDevice sales" because Apple most certainly doesn't need money and their products speak for themselves now.

A better and less confusing and frustrating experience for customers.
 
Comment

steve333

macrumors 6502a
Dec 12, 2008
946
629
Apple had better improve performance to at least where my Mini was under mavericks.
Safari stinks as well under Yosemite.
Start-up time is 10 times longer than before as well
Closed system under Apple is supposed to prevent stuff like this from happening and until Yosemite it was pretty much true.

Keep Ivy away from the Operating System!
After seeing what he did to the Mini I wouldn't mind seeing him take a long hike permanently
 
Comment

HenryDJP

Suspended
Nov 25, 2012
5,084
843
United States
A better and less confusing and frustrating experience for customers.

That doesn't actually answer the question. That's a benefit for the customers. Apple needs an incentive to give us more free storage. They are at a stage where they are not hungry to please customers immensely, especially in terms of cloud storage.
 
Comment

coolfactor

macrumors 601
Jul 29, 2002
4,845
5,110
Vancouver, BC
I'd rather see them increase the free storage amount to 10 GB to be more in line with other cloud backup services. Not everyone has the incentive or need to pay for more storage.

Didn't you just contradict yourself? If someone doesn't need more storage, then why would an upgrade to 10GB be of any value? Or do you mean you don't want yet another cost added to your computing experience?
 
Comment

Joe Rossignol

Editor
Staff member
May 12, 2012
661
1,874
🇨🇦
did macrumors even cover the original thunderstrike story? don't remember seeing it here

i understand its only proof of concept, but it's unprecedented, you essentially could never do international travel with a mac

We didn't cover it in the past. I did outline that it is a potentially serious problem, but attackers requiring physical access to the Mac mitigates a lot of the risk for most users in my opinion.
 
Comment

coolfactor

macrumors 601
Jul 29, 2002
4,845
5,110
Vancouver, BC
We didn't cover it in the past. I did outline that it is a potentially serious problem, but attackers requiring physical access to the Mac mitigates a lot of the risk for most users in my opinion.

Another possibility is compromised devices being sold through retail, but then would the Mac then "phone home" to the hacker so that they would know that a compromise was successful?

----------

just release it already, Im so sick of the wifi disconnects

To what extent have you tried to solve this problem?

  1. Have you switched to a 5GHz network?
  2. Have you ensured only essential wireless networks are set up in your home? (ie. Turn off any that aren't needed)
 
Comment

AlecZ

macrumors 65816
Sep 11, 2014
1,173
122
Berkeley, CA
As I asked on the other vulnerability reports, is Mavericks vulnerable to this? If so, I thought Apple was supposed to provide security support 3 OS X releases backwards.

Also, "The proof-of-concept attack is limited in scope, however, as an attacker would require physical access to the Mac or savvy social engineering skills in order to trick a user into attacking his or her Mac themselves." Um, good luck. It's already difficult enough to do that with a port that most people actually use.

Edit: I suppose a fake TB accessory could exploit the flaw, so it's worse than I originally thought.
 
Last edited:
Comment

gotluck

macrumors 603
Dec 8, 2011
5,669
1,072
East Central Florida
We didn't cover it in the past. I did outline that it is a potentially serious problem, but attackers requiring physical access to the Mac mitigates a lot of the risk for most users in my opinion.

agreed, the scary scenario is international customs / border checkpoint etc IMO

nice to hear this isnt some unfixible without replacement hardware problem
 
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.