Study Finds Significant Number of Macs Running Out-of-Date Firmware Susceptible to Critical Exploits

[mikecorp]

that percentage is all old Mac pros and hackintosh. We can not update anymore. I have mac pro 1.1 running maverick.

 

[boppin]

by tue was, there was an EFI or Boot ROM update for 2011 Macbook Pros. came with Sierra, but I am back on El Capitan.

 

[Pike R. Alpha]

My $4000 obsolete Mac Pro is still faster than many Apple Macs Apple is currently selling!
Sure, tell me the Mac Mini will beat a XEON. HAHA!

Ok. The single thread speed of the new Macmini with Coffee Lake processor will crush your Xeon.

So... There you have it.
[doublepost=1506900274][/doublepost]

by tue was, there was an EFI or Boot ROM update for 2011 Macbook Pros. came with Sierra, but I am back on El Capitan.

Then your MacBook Pro should still have the EFI version that came with Sierra. In case you tried/install High Sierra, then you get the latest EFI version. You can get back to El Capitan, and still use the latest EFI version.
[doublepost=1506900406][/doublepost]

A week is an eternity!

Then run the tool from a terminal window yourself.

 

[JamesPDX]

My $4000 obsolete Mac Pro is still faster than many Apple Macs Apple is currently selling!
Sure, tell me the Mac Mini will beat a XEON. HAHA!

Let's hear it for rock-steady processing power un-throttled by insufficient cooling! And delivery formats guarded with ECC RAM.

Do have the 5,1 tower? I really wish I could have kept my 6-core w/D500's or my first one, an 8-core w/D300's. It was really sweet and silent; just not $3000 sweeter than my 2012 2.6 QC Mini for running Pro Tools 12 -but that's on Avid. But I really miss all of those Thunderbolt ports and the dual-ethernet. My reluctance and eventual return came from my experience with "Apple Engineering Support" re; the 8-core that was still under AppleCare. I just don't trust Apple to stand by their computers. Even with Applecare, who's to say they wouldn't be switching out i/o boards, etc. with used/refurbs? Maybe a Quad Core is actually the one to beat for Pro Tools. -The 3.7 Xeon.

I'm tied to my Apollo 8 which is Thunderbolt. Maybe I should have spent double for a dual/alt connection-type as offered by RME or Antelope.

I really hope that the mMP won't start at $5k and be disposable after a month.

 

[bopajuice]

A new research paper from Duo Security, shared by Ars Technica, reveals that a significant number of Macs are running out-of-date EFI versions, leaving them susceptible to critical pre-boot firmware exploits.

The security firm analyzed 73,324 Macs used in production environments and found that, on average, 4.2 percent of the systems were running the incorrect EFI version relative to the model and version of macOS or OS X installed.

The percentage of incorrect EFI versions varies greatly depending on the model. The late 2015 21.5" iMac had the highest occurrence of incorrect EFI firmware, with 43 percent of systems running incorrect versions.

EFI, which stands for Extensible Firmware Interface, bridges a Mac's hardware, firmware, and operating system together to enable it to go from power-on to booting macOS. EFI operates at a lower level than both the operating system and hypervisors, providing attackers with a greater level of control.Duo Security found that 47 models capable of running OS X Yosemite, OS X El Capitan, or macOS Sierra, for example, did not have an EFI security patch for the Thunderstrike exploit publicly disclosed nearly three years ago.

The research paper noted that there seems to be something interfering with the way bundled EFI updates are installed alongside macOS, while some Macs never received EFI updates whatsoever, but it doesn't know exactly why.While its research paper is focused on Apple, Duo Security said the same if not worse EFI issues likely affect PCs running Windows or Linux.

In response to the research paper, Apple said it appreciates the research on the industry-wide issue and noted that macOS High Sierra automatically validates a Mac's EFI on a weekly basis to ensure it hasn't been tampered with.In a related blog post, Duo Security said users should check if they are running the latest version of EFI on their Macs, and it has released a tool to help do so. It also recommends updating to the latest version of macOS High Sierra.

Article Link: Study Finds Significant Number of Macs Running Out-of-Date Firmware Susceptible to Critical Exploits

Kind of reminds me of Windows users.

 

[Winni]

Well, technically they still can't, not in the way PCs do.

Well, technically, even modern PCs running Windows 10 can't get viruses anymore. Viruses are a thing of the 1990s.

All the other forms of malware are a different story -- and your Mac is in no way more secure against those than any Linux or Windows machine out there. Rather the opposite as recent events have shown: Macs have become an attractive target while Linux PCs still aren't. So more people have begun to write malware for Macs.

 

[ReneR]

Well, technically they still can't, not in the way PCs do. But they're still a computer susceptible to hacking.

This discovery gives yet another good reason for always updating your Mac to the latest OS (if your hardware supports it, obviously). Sometimes Apple patches problems before we even know they exist.

of course technically they do, the same way as PCs, there are constantly security vulnerabilities and thus malware and virus' found in macOS, …

 

[fairuz]

I am not sure how many Hackintoshes are in production environments though. It appears that they did this study directly, not using web metrics.

I am sure there are some hackintosh computers being used commercially, though I would expect they would be excluded from such a study. Nevermind completely illegal, exposing those companies to potentially serious lawsuits.

I've seen Hackintoshes in a few recording studios. I imagine the guys got sick of outdated Mac Pro hardware.

 

[PolacMac]

Yup, me too, 2008 MacBook Pro, but then again, it’s friggin’ ancient hardware that I should’ve ditched long ago. ( unbelievable how long Apple products keep trudging along! )

I have an original Mac SE/30 - until a few years ago, my mother-in-law ran Excel on the 9" black/white screen. Cousins played Asteroids on it. No chance of it getting hacked... no internet connection. ;-)
https://9to5mac.com/2015/07/27/opinion-a-macs-longevity-is-its-biggest-unsung-selling-point/

 

[shplock]

Yeah it really comes down to know-how of computers. For those who are completely incapable of knowing what a program does, and how things work on computers, Mac is generally more safe. Less room for user error.

I know what a program is and what it does and yet that did not stop me from having to reinstall Windows 8 several times due to the incompetence of Microsoft(in my view).
It also did not stop several major issues including a couple of viruses even though I had a well known and respected AV and kept it up to date and was very careful in what did and what websites I visited and so on.
[doublepost=1507030778][/doublepost]

Nothing wrong with windows. They actually support pro users.

Nothing right with them either. I am a pro user and Windows never helped or supported me. I go back to the days of DOS, so you can't tell me diddly squat about how great you 'think' Windows is.
[doublepost=1507031171][/doublepost]

It's not supposed to be an argument. But now that we're arguing, I'll explain further; Both windows and mac users have an ignorant crowd that don't know much about computers, regardless of OS. I would argue that the average more advanced mac user may be more knowledgeable than the average advanced windows user. I would also argue though that the average less advanced windows user is more knowledgeable than the average less advanced mac user.

There are people who buy macs because they know what they are doing (small percentage, advanced users), and then there are those who buy macs because they don't know what they're doing with computers (high percentage, less advanced).

The same people who buy extremely cheap windows computers also buy cheap cars, and other things. That's a type of person, not a type of user.

I noticed that you did not answer their point. You just wandered off on a tangent.

 

[Vanilla35]

I know what a program is and what it does and yet that did not stop me from having to reinstall Windows 8 several times due to the incompetence of Microsoft(in my view).
It also did not stop several major issues including a couple of viruses even though I had a well known and respected AV and kept it up to date and was very careful in what did and what websites I visited and so on.
[doublepost=1507030778][/doublepost]

Nothing right with them either. I am a pro user and Windows never helped or supported me. I go back to the days of DOS, so you can't tell me diddly squat about how great you 'think' Windows is.
[doublepost=1507031171][/doublepost]

I noticed that you did not answer their point. You just wandered off on a tangent.

I responded to it clearly, in fact I simply restated my previous point but with more detail including both general types of people on both ends/extremes, for both OS/computer purchases.

If you considered it an off topic tangent, then I suppose you're free to think so, but it was related, and more detailed, while directly responding to the point that was made in the comment replied to.

What I didn't do was say "yes, that's what I'm saying", or "no, that's not what I'm saying. I didn't think that was required, because it was self evident from my more fleshed out points beneath.

 

[agathezol]

"The security firm analyzed 73,324 Macs used in production environments and found that, on average, 4.2 percent of the systems were running the incorrect EFI version relative to the model and version of macOS or OS X installed." From the Article"

This quote says it all, you are being watched without knowing it. This "research" and analysis requires access to these computers, so isn't it amazing they turned a hack and or privacy invasion into a legit article. Sounds a bit like self promotion.

Or maybe - just maybe - Duo is pulling their data from their agents that are voluntarily installed in the enterprise. That seems rather more likely than them exploiting a previously unpublicized vulnerability thus subjecting themselves to serious legal action.
[doublepost=1507071143][/doublepost]

Oh, and download our mystery utility from the armpit of the internet, Github.

Looks like the project is Duo's own. Duo is a reputable company and a trustworthy source for these sorts of tools and information.
[doublepost=1507071197][/doublepost]

And we should trust Duo Security to patch our systems?

Duo doesn't patch systems. Their agent can report out of date OSs, browsers, Flash/Java plugins, etc.
[doublepost=1507071305][/doublepost]

Has your Mac had a virus? Does you Mac have a virus now? No. I didn’t think so. Thanks for the FUD.

It's not about viruses, it's about vulnerabilities. Does your Mac run Flash, Java, or open source packages? Flash and Java are obvious problems and can be uninstalled, but at the very least, all OSX users are running open source packages. Apple notoriously drags their feet when it comes to updating the open source packages that are bundled with OSX.
[doublepost=1507071730][/doublepost]

I'm still running Mac OS Lion v10.7.5 on a 3.33 GHz six-core Intel Xeon Mac Pro (with no anti-virus apps installed) that I've had since June of 2012 and I've never been the victim of any intrusively exploitive attacks.

Having wasted hundreds of dollars over the years on anti-virus software for my previous Dell computer running various versions of WinDoze, I'm convinced that the millions (or billions?) of dollars made by anti-virus software companies is the direct result of successfully instilling fear in the hearts of anyone who is a potential customer of theirs. And considering the popularity of computers, that's a pretty big audience. Even my Mom asked me once if the ones writing the "bad" viruses for computers work for the ones that are selling the prevention or cure. Then I quickly surmised the possibility that they are one and the same, one entity that creates something that makes you sick so it sell you its snake-oil remedy to make you feel better again.

Although perhaps difficult to ever prove in court beyond a reasonable doubt that such a criminal conspiracy actually exists, I did find my mother's probing curiousity to at least cause me to pause and ponder why I always sent Norton that US $40 or so every year until eventually their software's inability to play in its own sandbox the way object-oriented apps coded for Macs are designed rendered my PC a worthless piece of humming buzzing metallic junk. Uninstalling the anti-virus software with the assistance of my younger brother who's wiser than me in these matters returned that shiny piece of electronic junk to a vague resemblance of its former self, anthropomorphically speaking. But after discovering I was still being auto-billed the $40 annual fee even after I had officially requested a cancellation, I decided that the real crooks weren't necessarily the ones coding the malicious malware and data-hungry trojan horses.

Although I'm not citing similar selfish motivations to those referenced in this article who are alleging they've discovered some previously hidden loophole that makes certain Macs vulnerable, I do offer one suggestion that renders their input virtually meaningless:

Don't power off your Mac unless you have to.

I've left my Mac Pro on (as in fully powered) for almost two years now with only one shutdown that occured during a brief local power outage. I don't even put the hard drives to sleep in defiance of recommendations by the so-called computer experts of the world and they (the hard drives) still do what they're supposed to do (stealthily I might add). In addition to keeping my bedroom warmer in the winter, keeping my Mac Pro on makes it impossible for anyone with access to a potentially compromised EFI on my Mac Pro to shift control over to their presumably nefarious designs since any such unwarranted transition would need to take place during if not before the process of booting kicks in unless I've simply been misguided all these years as to what takes place in the guts of any Mac once it is instructed to leave the silence of its energy-depleted state behind and venture back into the light of electron-fortified existence where it can once again meaningfully enhance the conscious existence of the one with the knowledge of the right button to press.

You are 100% correct about the worthlessness of AV. It is trivial to modify malware to bypass AV. However, not powering off your machine provides zero protection. In fact, not powering off your machine means that attackers don't need to do anything fancy to gain persistence. However, EFI can be written to while OSX is running, which is a wonderful way for persistence to be achieved.

Running such old code is a risk every time you enter any sort of sensitive data into a browser - obviously financial information, but the password to your primary email account delivers to attackers one of the richest pieces of data to be used for further exploitation. Obviously everyone needs to work out their utility vs. security equation themselves, but make no mistake - you are "asking for it" by running such old code.

 

[bjet767]

Or maybe - just maybe - Duo is pulling their data from their agents that are voluntarily installed in the enterprise. That seems rather more likely than them exploiting a previously unpublicized vulnerability thus subjecting themselves to serious legal action.

You still miss the point, legit or not, this outfit is watching what people have on their computers and people just sit back and go, ohh and hmmm, I guess it doesn’t effect me.

The computers and iPads used at the corporation I work for have the ability and right to monitor the user’s activities with those devices. Ironically Many still use those assigned devices for personal and sometimes very personal internet access.

1984 came and went.

 

[agathezol]

You still miss the point, legit or not, this outfit is watching what people have on their computers and people just sit back and go, ohh and hmmm, I guess it doesn’t effect me.

The computers and iPads used at the corporation I work for have the ability and right to monitor the user’s activities with those devices. Ironically Many still use those assigned devices for personal and sometimes very personal internet access.

1984 came and went.

I'm not sure why you're so concerned about Duo "watching us." They don't watch user behaviors - they're reporting machine states - like software versions, or if a phone is jailbroken. Do you have a Facebook or Google account? Or a phone? And use the web? THAT is what watching user behavior looks like. Considering Duo is a voluntary install - and uninstall - I'm rather baffled that that is what you're concerned about.

And yes, businesses do have the right to monitor what is occurring on their equipment and their network. That is not exactly 1984. Myself, I've never understood people who use corporate networks for personal use. But I also don't understand using the WiFi at Starbucks or a hotel either

 

[bjet767]

I'm not sure why you're so concerned about Duo "watching us."

Again you and others miss the point, you/we are being watched and if a corporation can do it so can others.

I am not paranoid nor am I really concerned about what I do on-line, but the point is we do not live in an age of real privacy. Even the highest people in our Government are now relying on their ability to communicate via the wired media.

So what's my concern? I guess it's the fact there is such a laissez-faire attitude from people about what can be done with these devices we are all plugged into. I started using a VPN this past year and now Apple has basically decided it does not like such use with its devices (see the changes in iOS).

Years ago Microsoft set up the ability for Windows to be able to inform them what kind of machine their OS was loaded on and the computing world went nuts about personal privacy issues and such. I believe the real point behind it was MS wanted to protect their OS revenue flow from pirates, but here we are a number of years later and we don't think a thing such access.

It's where we live and I guess the question is this, "Is life better being watched so closely?"

 

[agathezol]

Again you and others miss the point, you/we are being watched and if a corporation can do it so can others.

I am not paranoid nor am I really concerned about what I do on-line, but the point is we do not live in an age of real privacy. Even the highest people in our Government are now relying on their ability to communicate via the wired media.

So what's my concern? I guess it's the fact there is such a laissez-faire attitude from people about what can be done with these devices we are all plugged into. I started using a VPN this past year and now Apple has basically decided it does not like such use with its devices (see the changes in iOS).

Years ago Microsoft set up the ability for Windows to be able to inform them what kind of machine their OS was loaded on and the computing world went nuts about personal privacy issues and such. I believe the real point behind it was MS wanted to protect their OS revenue flow from pirates, but here we are a number of years later and we don't think a thing such access.

It's where we live and I guess the question is this, "Is life better being watched so closely?"

What changes re: iOS 11 and VPNs are you referring to?

I completely agree with you regarding the non-existence of privacy, however I find it bizarre that Duo releasing aggregated statistics about firmware/software versions is the one that gets you going. Duo's agent is advertised as, amongst other things, having this reporting capability. What Google, Facebook, Microsoft, and, yes, even Apple are doing with respect to killing privacy is significant and real - and yes, most users of their products don't really think about or care. Again - it's just odd that Duo reporting these things is what got you posting. It's not like Duo did something they weren't supposed to be able to do - like reporting the 10 most common filenames people use.

 

[bjet767]

however I find it bizarre that Duo releasing aggregated statistics about firmware/software versions is the one that gets you going.

We Apple fans ( yes I consider my self one) tend to think we are “special” and our product is for “creative” people who are “free” thinkers and free from all the issues of the IT world. This article is one of the few which points to how even Apple fans are really open to all who care to watch and track our lives.

In reality we Apple fans are probably more sheep like than many others.
Short version; there are rarely any articles about how Apple products are being tracked and scanned all the time and one doesn’t have to be in Starbucks or a hotel WIFI to b observed.

My VPN is: Private Internet Acess, I use it on my MBP and ever since upgrading it to the latest OS it has essentially stopped working. Additionally please refer to these articles:
https://www.macrumors.com/2017/07/14/apple-ad-blocking-app-crackdown/
https://www.macrumors.com/2017/07/31/russia-bans-vpns-apple-pulls-apps-china/

4.2 Minimum Functionality

Your app should include features, content, and UI that elevate it beyond a repackaged website. If your app is not particularly useful, unique, or “app-like,” it doesn’t belong on the App Store. If your App doesn't provide some sort of lasting entertainment value, or is just plain creepy, it may not be accepted. Apps that are simply a song or movie should be submitted to the iTunes Store. Apps that are simply a book or game guide should be submitted to the iBooks Store.

• 4.2.1 Apps should use APIs and frameworks for their intended purposes and indicate that integration in their app description. For example, the HomeKit framework should provide home automation services; and HealthKit should be used for health and fitness purposes and integrate with the Health app. Apps using ARKit should provide rich and integrated augmented reality experiences; merely dropping a model into an AR view or replaying animation is not enough.