Study Finds Significant Number of Macs Running Out-of-Date Firmware Susceptible to Critical Exploits

belvdr · Sep 29, 2017

For those interested in the EFI firmware, some standalone updaters are available:

https://support.apple.com/en-ph/HT201518

If you don't see a firmware version listed in this article, it means that either a firmware update is only available as an automatic update, or no firmware update is needed.

mlody · Sep 29, 2017

sos47 said:
it hurts me. update to High Sierra not possible. iMac 2011

I have 2010 iMac 27" and it updated to High Sierra just fine.

mmcneil · Sep 29, 2017

sos47 said:
it hurts me. update to High Sierra not possible. iMac 2011

Perhaps you can

macOS 10.13.1 beta supports:

MacBook or iMac: Late 2009 or newer
- MacBook Air, MacBook Pro, Mac mini, or Mac Pro: 2010 or newer

Kavok · Sep 29, 2017

sos47 said:
it hurts me. update to High Sierra not possible. iMac 2011

I have a mid-2010 iMac and High Sierra installed fine.

rizzo41999 · Sep 29, 2017

Codeseven said:
Yup, me too, 2008 MacBook Pro, but then again, it’s friggin’ ancient hardware that I should’ve ditched long ago. ( unbelievable how long Apple products keep trudging along! )

Good for you for not falling into the "need to upgrade hype." I genuinely mean that!

Solamar22 · Sep 29, 2017

rpmurray said:
In response to the research paper, Apple said it appreciates the research on the industry-wide issue and noted that ONLY macOS High Sierra automatically validates a Mac's EFI on a weekly basis to ensure it hasn't been tampered with. Anyone running Macs with an earlier OS (like Sierra or the ancient El Capitan) or a Mac that can't be updated to run High Sierra are SOL.

Nuts. I have to stay at El Capitan. I cannot use Sierra because with my model (2013 MacBook Pro 15"), there is a bug in Sierra that always logs debug that fills the disc. I don't know if I can go to High Sierra. (In case anyone cares, native 2013 MBP 15" with native clean install of Sierra (nothing else) logs to /tmp/wifi_YYMMDD at rate of 4Mb/sec. Bug reported to Apple.)

Poisednoise · Sep 29, 2017

PTVMan said:
How is 4.2% a “significant number?”

Strictly speaking, it isn't, as it's a percentage... but given there are about 100 million active Mac users (https://www.theverge.com/2017/4/4/15176766/apple-microsoft-windows-10-vs-mac-users-figures-stats) that means that there are about 4,200,000 computers with out-of-date firmware.

Obviously it depends on the context, but I think most would agree that 4 million+ is a "significant number", or at the very least "sizeable".

stainless · Sep 29, 2017

Here is the Link to APPLE'S actual updates on firmware: https://support.apple.com/en-us/HT201518
[doublepost=1506710302][/doublepost]

jackson01442 said:
Tool's down for now, we'll have to wait for them to fix a bug then it should be back up.

Here is the link to Apple's actual update firmware: https://support.apple.com/en-us/HT201518 https://support.apple.com/en-us/HT201518

Nixie1972 · Sep 29, 2017

sos47 said:
it hurts me. update to High Sierra not possible. iMac 2011

Yes you can:

Schermafbeelding 2017-09-29 om 20.38.28.png

Soba · Sep 29, 2017

ApfelKuchen said:
If 95.8% of the Macs tested have an up-to-date EFI, I'd consider Apple's current distribution methods to be pretty effective. Hardly perfect, but "profoundly foolish" may be overstating things. I doubt they were getting higher levels of updating prior to moving the EFI updates into the OS distributions.
[...]
Now, sometimes the fix is broken (that 4.2%), and with the attention given to this issue, I'm sure Apple will fix the fix, too... Considering the existence of the EFI checker in High Sierra, part of that fix is already in motion.

I don't disagree, but I'm of the opinion that they should have taken a "belt and suspenders" approach from the beginning. Distribution with major upgrades, point releases, and standalone security fixes is a fine approach (and probably superior to the old way, as you pointed out), but there should also have been some kind of independent check to ensure the firmware updates actually occur.

If I understood the report correctly, the firmware updater is run as one of the last steps of the security update installer. There are a lot of situations where such updates are delivered through means other than an Apple installer. System imaging software, drive cloning, etc. Quite a few cracks for the new firmware to slip through, hence my disbelief at the fact there's no follow-up check that runs independent of an update. These situations are not edge cases; it is the norm in a business environment full of managed, centrally deployed systems. It's not possible to plan for every case of how software will be installed, but it is possible for the OS to check after the fact and ensure the update was complete.

Further, you keep referring to Apple limiting EFI updates to "major macOS upgrades," when that's not necessarily the case; bundling them into an update (let's say a dot-1 to dot-2) or security patch is also possible. The real difference is that instead of issuing machine-specific updates, they're bundling them into a wider distribution.

You're correct, as corroborated by the report. Apologies!

The report is somewhat long, so I'll be reading the whole thing as soon as I'm able.

puckhead193 · Sep 29, 2017

if software developers got their stuff together and made software compatible/update i'd be more then happy to update but until then... i'm stuck on 10.12.3..

PSSSST i'm talking to you Sony... get your crap together!

JohnR · Sep 29, 2017

sos47 said:
it hurts me. update to High Sierra not possible. iMac 2011

2008 iMac here

SnarkyBear · Sep 29, 2017

rpmurray said:
...Anyone running Macs with an earlier OS (like Sierra or the ancient El Capitan) or a Mac that can't be updated to run High Sierra are SOL....

Ancient El Capitan, which was the main OS all of 13 months ago. These OS's grow so quickly these days....

mr.steevo · Sep 29, 2017

Sasparilla said:
If you can, sell and upgrade to a newer iMac while your old one still has value. Mac's keep their value much better than PC's but once they stop getting the latest OS versions the value starts to decline faster - once security updates aren't coming its through the floor (couple of more years).

My in-law's 2007 iMac got a security update about a month or two ago.

Larry-K · Sep 29, 2017

Sounds "EFI'd up" to me.

justperry · Sep 29, 2017

belvdr said:
For those interested in the EFI firmware, some standalone updaters are available:

https://support.apple.com/en-ph/HT201518

Those are not (all) latest updates, my md 2012 MBP 13" is on a later and newer firmware. (MBP91.00D7.B00)

dwaltwhit · Sep 29, 2017

So what's the solution? Auto updates would be met with serious pushback, especially in the professional market. A notification of some kind?

Pike R. Alpha · Sep 29, 2017

rjohnstone · Sep 29, 2017

ApfelKuchen said:
If 95.8% of the Macs tested have an up-to-date EFI, I'd consider Apple's current distribution methods to be pretty effective.

The sample pools for this report were from managed systems in corporate environments.

The security firm analyzed 73,324 Macs used in production environments

Home users tend to be a lot more "relaxed" in maintaining their computer's software.
I suspect the consumer market would yield different results.

Eklund66 · Sep 29, 2017

rjohnstone said:
Depends on the 2011 model.
My mid-2011 iMac runs it just fine.

I got a iMac mid 2010 that works smooth with High Sierra, when posting.
[doublepost=1506720867][/doublepost]

sos47 said:
it hurts me. update to High Sierra not possible. iMac 2011

I got a iMac mid 2010, no issues. Works like a charm.

Soba · Sep 29, 2017

Pike R. Alpha said:
Here's the official list from macOS High Sierra with the latest EFI firmware versions:

-----------------------------------------------------------------------
efiver.py v1.0 Copyright (c) 2017 by Pike R. Alpha
-----------------------------------------------------------------------

Thanks for posting this! Are you sure it's complete? I believe the 2010/2012 classic Mac Pro (MacPro5,1) also receives an update to work with APFS, but I don't see that listed here.

JamesPDX · Sep 29, 2017

sdwaltz said:
Eh, Windows is trash software. Two PC's at my office have just flat-out had master boot records go missing amongst a myriad of other issues.

Q: Does the Windows 10 Pro edition have this issue, or just the Home edition?

sdwaltz · Sep 29, 2017

JamesPDX said:
Q: Does the Windows 10 Pro edition have this issue, or just the Home edition?

Both were W10 Pro, in my case.

JamesPDX · Sep 29, 2017

Soba said:
Thanks for posting this! Are you sure it's complete? I believe the 2010/2012 classic Mac Pro (MacPro5,1) also receives an update to work with APFS, but I don't see that listed here.

But... Can you go back? If you want to revert to Sierra or Mavericks, etc. later, will that new firmware allow it? Or is it Borked to High Sierra?
[doublepost=1506725504][/doublepost]

puckhead193 said:
if software developers got their stuff together and made software compatible/update i'd be more then happy to update but until then... i'm stuck on 10.12.3..

PSSSST i'm talking to you Sony... get your crap together!

Avid says what? Every GD time. Really, nobody at these companies can get a Beta and start working on their next release? https://www.sweetwater.com/sweetcare/articles/high-sierra-macos-10-13-compatibility-information/

BeforeTheMeds · Sep 29, 2017

JamesPDX said:
Q: Does the Windows 10 Pro edition have this issue, or just the Home edition?

The wife and stepson both have windows 10 home that they have had since it came out, the wife knows nothing about maintaining a system and I do it for her. I pretty much have to do nothing. I have a mac that I have had several years and now I have a windows laptop with pro. I was running windows windows pro on the mac bootcamp for several years before that. I rate windows 10 on par with mac, even faster. The reason I went with the windows laptop was I can no longer see the 1500.00 more it would have cost me for a "comparable" MacBook pro with less ssd and memory.

People should go with what they like and I DO like osx, not going to knock it and will be keeping the mac, but windows 10 is a whole new ballpark compared to the old windows. I had a ton of problems with my mac until I dumped the spinner for the ssd. The mac WILL be going to a kids homework computer and media station.

This is from a guy that has all apple stuff. Phone, ipad, atv, mac. I DO have an open mind and do not worship brands though.

Study Finds Significant Number of Macs Running Out-of-Date Firmware Susceptible to Critical Exploits

macrumors 603

macrumors 68000

macrumors regular

macrumors member

macrumors 6502a

macrumors member

macrumors regular

macrumors member

macrumors newbie

macrumors 6502

macrumors G3

macrumors regular

macrumors regular

macrumors 65816

macrumors 68000

macrumors G5

Contributor

macrumors 6502

macrumors 68040

macrumors newbie

macrumors 6502

Suspended

macrumors 65816

Suspended

macrumors 6502

Our Staff