Xeno Kovah: macOS 10.13 EFI firmware integrity check

https://twitter.com/xenokovah/status/912011064304267264

by transpute • 9 years ago

88 21 9 years ago

twitter.com

jeffehobbs• 9 years ago

Great to see this level of transparency from Apple’s folks. (Also, hope he doesn’t get in trouble for this!)

lozenge• 9 years ago

The thread's gone.

chicago_wade• 9 years ago

http://archive.is/6IIDb

0x0• 9 years ago

In 10.12.6 (and perhaps earlier) there's already a /usr/libexec/firmwarecheckers directory. It contains an "ethcheck" binary (with some odd permissions, "-rwx--x--x"... why allow other users to execute it but not read it?).

One of the options provided is: "ethcheck --send-change-in-firmware enable: Will allow ethcheck to send unexpected change in firmware binary to Apple."

Is stuff like "Thunderstrike 2" ( https://arstechnica.com/gadgets/2015/08/thunderstrike-2-root... ) common enough that they expect to find it in the wild and are scanning for this?

gordyf• 9 years ago

I don't think something needs to be common in order to be protected against.

drivingmenuts• 9 years ago

We need a TDR (Tweeted, Didn't Read) for things that should really be a blog post, not some long rambling series of Twitter posts.

Same thing for those bullshit screen shots of news releases that get posted to Twitter. Actually, those may be worse.

/offtopic

sdfgelgh43oito32• 9 years ago

Apple doesn't like their engineers writing blogs. At best we can get a quick tweet storm before apple internal affairs finds the thread and gets it nuked.

nextos2• 9 years ago

I would like to know a related thing with regards to mac EFI firmware. Does it support low battery ACPI events? How does macOS trigger low battery alarms? By polling?

I'm running Linux on my MacBook and it is irritating I cannot use a simple udev rule on to trigger suspend. To be fair most PCs don't support this either. Only some ThinkPads. It's usually my litmus test for Linux compatibility.

foodstances• 9 years ago

Macs use the ACPI Smart Battery Subsystem. The Linux SBS driver should be polling regularly and also receive GPEs when the battery reaches certain thesholds. But the polling frequency should be in the order of seconds, providing constant battery level progress and time to suspend at a critical condition.

nextos2• 9 years ago

Thanks. I didn't know SBS was the particular kernel module responsible for this. However, lsmod reports it's loaded by default in my stock Arch kernel and I assume it has always been.

I have never been able to get events through acpi_listen when the battery reaches particular thresholds. Thus, udev rules for critical battery levels never work.

Any ideas why this is not working? I'm using a MBA 11 inch late 2012. Possibly the most Linux-compatible Mac machine ever. All stock Intel hardware.

robin_reala• 9 years ago

Huh, and it was just deleted. Anyone screencap the whole thread?

medecau• 9 years ago

https://web.archive.org/web/20170924180858/https://twitter.c...

bangonkeyboard• 9 years ago

Summary here: https://eclecticlight.co/2017/09/24/high-sierra-automaticall...

userbinator• 9 years ago

Something about that just strikes me as beyond creepy, regardless of whether it's for "security" or not.

Someone2• 9 years ago

”This will allow eficheck to send the binary data from the EFI firmware, preserving your privacy by excluding data which is stored in NVRAM”

How can they know that’s sufficient to preserve user privacy? The code sends data they don’t know of to Apple. That could contain anything, including compromising photos (not that likely) and private keys (slightly more likely)

algorithm_dk• 9 years ago

http://webcache.googleusercontent.com/search?q=cache%3Ahttps...

andr• 9 years ago

It'd be great if the message shown is a little more direct than "Your computer has detected a potential problem", because having an unknown EFI is pretty worrying. With the current wording, there's a good chance I'd ignore it.

X-Istence• 9 years ago

Until Apple can guarantee they have every single last version of EFI in their database, I think it is the best they can do. Those that know what that check is about are also generally the targets that would have to worry about it.

sdfgelgh43oito32• 9 years ago

Xeno, please don't get yourself fired from Apple for leaks! Us apple users need you behind the coal fires keeping us safe!

Xeno Kovah: macOS 10.13 EFI firmware integrity check

Related Stories