OS X Lion Raises Bar on Security, But Battery Firmware Vulnerability Surfaces

[BTW]

Wow, I would have never thought about the battery being vulnerable. Amazing!

This guy should also blow the whistle on car manufacturers as most have system that are really easy to hack and take over. Wouldn't want to be driving down the road and someone infects my car with a virus or takes over my vehicle.

 

[munkery]

Seriously: how would such an attacker find that password?

The researcher, Charlie Miller, determined the password used by analyzing the battery firmware updates provided by Apple. The password for the battery firmware is the same for all devices.

I doubt this issue will manifest outside of research settings.

I suspect that password protecting the EFI (see the "Mac Security Suggestions" link in my sig) may mitigate this issue by preventing a machine from being booted from a USB drive. But, I am not sure about this.

@ munkery, I would just like to thank you for your posts. They have been extremely informative and well explained on a subject I know little about. Cheers.

No problem and your welcome.

 

[Tech198]

Freaky stuff

So the security is they can ruin hardware? That does't sound good

Coming from a long history of "it's impossible to distort hardware remotely", I'm surprised Apple "made" this possible.

By the way, what were they referring to when the article meant passwords in batteries? I diid't even now that.

Also, realiasing that ASLR can be bypassed in Windows, this may be a just a repeat on the Mac.

 

[Jerome Morrow]

So the security is they can ruin hardware?

Good morning.

 

[munkery]

Also, realiasing that ASLR can be bypassed in Windows, this may be a just a repeat on the Mac.

Bypassing ASLR in Lion will be more like bypassing ASLR in x86_64 Linux distro that uses a full compliment of security mitigations, such as Ubuntu.

Find an article about bypassing ASLR in x86_64 Linux for more info.

Edit: Below is probably the most relevant and recent article.

http://www.blackhat.com/presentatio...Europe-2009-Fritsch-Bypassing-aslr-slides.pdf

 

[baryon]

Since when can hackers actually cause your computer to explode and kill you? Well here in the future, you can do that too!

 

[tone*]

1) Until Vista, the admin account in Windows did not implement DAC in a way to prevent malware by default. Also, Windows has a far greater number of privilege escalation vulnerabilities that allow bypassing DAC restrictions even if DAC is enabled in Windows.

Is it a fair comparison though? XP is over 10 years old and Lion is not even 10 days old.

 

[munkery]

Is it a fair comparison though? XP is over 10 years old and Lion is not even 10 days old.

Each example applies to Windows 7.

#1 just overviews how DAC has always been weak in Windows. This is much of the reason why Windows has always had a disproportionately large amount of malware.

 

[Tucom]

Windows 8 still uses the NT kernel. Windows 8 still uses the registry.

The only big change in Windows 8 is added support for more hardware types, such as ARM.

ARM Windows 8 will not have an emulation layer. Legacy binaries will not run on ARM Windows 8. Existing binaries will have to be recompiled to run on ARM.

Intel Windows 8 will continue to have a compatibility mode for legacy apps.

Apps developed after Windows 8 is released will most likely be universal binaries, much like during Apples PPC to Intel transition.

Unless MS splits the two platforms similar to the split between iOS and OS X.

Really? I did not know that. Thank you very much.

Where did you find that info?

Actually there's talk that Win 8 may ditch the registry all together. And NT kernel? That, like any other kernel, can be improved upon if I'm not mistaken and become a very stable backbone of a potentially very secure OS, the doubts being that the NT Kernel would have anything to do with being more prone to security if MS were to really buckle down, right?


I know there's talk of a new file system that's spec'd to be as good if not better than HFS+ , called Protogon (props to MS if it comes to fruition).

And I know that it's been more or less confirmed that Windows 8 will feature such a deeply rewritten core and/or be very unified and the API's and frameworks will be on the same level OS X in terms of the quality of integration and be very clean and efficient, examples being having all graphics of an app adhere to a certain, clean, consistent layout inherently from a very organized graphics accelerated desktop, ala Aqua, but MS has the skill to pull of something very respectable, I mean, Aero, while more resource hungry is a very respectable and well designed accelerated desktop, shout outs to MS for that and proving they can make their own unique style of the aspect of what Aqua is, right?


Ofcourse it goes far deeper (there was a very, very indepth and reliably sourced article about all the aspects of what will potentially make Windows 8 almost a new IP when it comes to OS's. OK, not quite a new IP, but some very big changes may take place for Windows 8, and for the sake of having another choice for an excellent OS, like MS proved they can make more or less with Windows 7 imo, I hope it comes to reality.

Pretty psyched to see what MS has to deliver after what Lion just put on the table, then again, even Windows 7 has some unique, impressive aspects vs. OS X, but ofcourse OS X still is the superior OS for various reasons I think.

 

[blackburn]

There are plenty of ways to brick an pc or an mac by messing with the firmware on different chips. This vulnerability isn't new, people that swap cells already messed up with the firmware in the battery chip (macs and pcs).

You can also corrupt the edid of a monitor (it should be read only according to specs, but I successfully corrected a bad edid on an replacement lcd). You can also brick ram sticks by just filling the eeprom with FF and them blowing the fuse (by software of course) that prevents reprogramming the eeprom.

Now great to hear that apple has done something good about the security of the os.

 

[ScottishDuck]

Actually there's talk that Win 8 may ditch the registry all together. And NT kernel? That, like any other kernel, can be improved upon if I'm not mistaken and become a very stable backbone of a potentially very secure OS, the doubts being that the NT Kernel would have anything to do with being more prone to security if MS were to really buckle down, right?


I know there's talk of a new file system that's spec'd to be as good if not better than HFS+ , called Protogon (props to MS if it comes to fruition).

And I know that it's been more or less confirmed that Windows 8 will feature such a deeply rewritten core and/or be very unified and the API's and frameworks will be on the same level OS X in terms of the quality of integration and be very clean and efficient, examples being having all graphics of an app adhere to a certain, clean, consistent layout inherently from a very organized graphics accelerated desktop, ala Aqua, but MS has the skill to pull of something very respectable, I mean, Aero, while more resource hungry is a very respectable and well designed accelerated desktop, shout outs to MS for that and proving they can make their own unique style of the aspect of what Aqua is, right?


Ofcourse it goes far deeper (there was a very, very indepth and reliably sourced article about all the aspects of what will potentially make Windows 8 almost a new IP when it comes to OS's. OK, not quite a new IP, but some very big changes may take place for Windows 8, and for the sake of having another choice for an excellent OS, like MS proved they can make more or less with Windows 7 imo, I hope it comes to reality.

Pretty psyched to see what MS has to deliver after what Lion just put on the table, then again, even Windows 7 has some unique, impressive aspects vs. OS X, but ofcourse OS X still is the superior OS for various reasons I think.

Windows 8 is a lighter, more optimised version of windows 7 with an optional metroui on top. It boots faster and runs more efficiently, there are builds floating about that anyone can check out.

You seem to be entirely forgetting that Windows is largely for the business market, they are not going to abandon that.

 

[silentnite]

It's like Fort Knox but in your computer this alone is a reason to upgrade to Lion. Apple security has always been a major concern with me. This helps to put my mind at ease.

 

[jonnysods]

Battery firmware with passwords? Wow, who knew they had those?

I want Lion - still waiting a little first. Don't want any apps breaking.

 

[cube]

#1 reason to demand Rosetta in Lion

 

[the8thark]

*LTD*, you mad?

You enjoy personally offending people?

 

[gnasher729]

For the battery vulnerability to be exploited, an attacker has to run software on your computer that is capable of doing a firmware update. An attacker who can run such software on your computer can do anything. This is like saying that your Mac is vulnerable because anyone who can drive a tank into your home could drive over your Mac and destroy it. Or saying that someone could empty my fuel tank by stealing my car, driving it until the tank is empty, and putting the car back into its parking spot. This attack is purely hypothetical.

There are much easier ways to destroy a battery, for example taking a large hammer to the Mac.

 

[supercooled]

I don't understand how a hacker could access my batteries password and through that, access my computer. WOuld't they need to access my root password in order to gain access to the battery bios which is what I'm assuming is enabling this exploit? It's like breaking into a house through the windows then unlocking the door then re-enter that same house through the unlocked door.

I must be really off base here so please enlighten me.

 

[KnightWRX]

There are much easier ways to destroy a battery, for example taking a large hammer to the Mac.

Except that's kind of hard to do over the Internet. With this vulnerability, someone can now "take a large hammer to the Mac" directly from a web server thousands of miles away.

 

[roadbloc]

*LTD*, you mad?

Unlikely he will be, however you've got to admit, this is a significant security flaw.

 

[KnightWRX]

I don't understand how a hacker could access my batteries password and through that, access my computer. WOuld't they need to access my root password in order to gain access to the battery bios which is what I'm assuming is enabling this exploit? It's like breaking into a house through the windows then unlocking the door then re-enter that same house through the unlocked door.

I must be really off base here so please enlighten me.

It's all in the article guys : Yes, before someone can manipulate the battery firmware, they need to have super-user access to the computer. This means either a remote root vulnerability or a combination of a remote code execution and a local privilege escalation vulnerabilities.

Once they have this you say, what's the point of the battery vulnerability ? Well, there are a few points to it :

- Store code in the battery firmware that will survive a OS reinstall and continue causing mischief. With the password changed, this code can never be removed unless the hacker's password is guessed or released online. It remains to be seen what type of code this could be and what are the limits on what it can do.

- Mess with the battery itself, either bricking it and rendering useless (requiring a fix by Apple for the laptop in question) or removing its fail safes, causing it to overheat on charge or maybe even pump too much juice into the machine.

So yes, it's pretty serious. This is akin to the hard drives not having any head parking and failsafes back in the 80s/early 90s where with a bit of assembly, you could force the hard drive head to smash into the walls of the casing by sending it a few choice "addresses" to read. This is good old "DOS days mischief" type vulnerabilities, which shouldn't exist in 2011 (ie, all hardware access should be limited to the OS Kernel, with user space programs not having this kind of control).

 

[charlituna]

Miller plans to officially announce his discoveries at next month's Black Hat conference, and he will also be releasing a new "Caulkgun" tool to allow Mac notebook users to change their batteries' default passwords to randomized strings. That move would help keep hackers out of the batteries, but also prevent Apple from issuing its own upgrades and fixes for the battery firmware.

Miller has also said that you have to get into the OS itself before you can muck with the firmware. Sounds to me like his 'fix' which will actually potentially brick your battery since the OS updates would need that password that it now doesn't know, does more harm than good. And yet with his FUD, he'll be able to get past the OS security cause folks will install his program for him. Social hacking at its best

Mind you, now that he said that he did it, Apple will be able to beat him to the punch with a security update that 'blocks access to battery firmware' before he can prove his concept works. So he'll be using an outdated version of the software to ensure he can do what he says. Begging the question does it still work. Just like the 'big' safari exploit that was fixed the day before it was shown to the world.

For Apple's sake and the sake of the product, shout outs for the person behind finding and talking about this severe security hole.

Its not that severe given that first folks have to get past many layers of OS security and get root access to install anything.

 

[gnasher729]

Except that's kind of hard to do over the Internet. With this vulnerability, someone can now "take a large hammer to the Mac" directly from a web server thousands of miles away.

No, they can't. They'd have to break into the operating system first. Since breaking into Windows is a lot easier, I'd fear more with a Windows laptop (which isn't any safer, but finding this vulnerabiltity in a Windows laptop wouldn't even be worth a mention). And if you take just USA and Europe, there are let's say 400 million people who would have the technological knowledge necessary to destroy your Mac with a hammer, and one who would know how to do it in software.

 

[HyperX13]

My copying is abysmal now. It's probably half the speed it was. I am copying a 400 meg file to a USB stick for 4 minutes now. On a high end Mac Pro. I smell an update coming soon.

 

[Iam9376]

No, they can't. They'd have to break into the operating system first. Since breaking into Windows is a lot easier, I'd fear more with a Windows laptop (which isn't any safer, but finding this vulnerabiltity in a Windows laptop wouldn't even be worth a mention). And if you take just USA and Europe, there are let's say 400 million people who would have the technological knowledge necessary to destroy your Mac with a hammer, and one who would know how to do it in software.

Seems like this type of problem would be a bigger concern for Windows users given the number of local privilege escalation vulnerabilities that would allow this type of attack to take place.

 

[cozmot]

A password on a battery? Who knew?