Apple’s T2 security chip jailbreak

https://reportcybercrime.com/hackers-jailbreak-apples-t2-security-chip-powered-by-bridgeos/

by Yeri • 6 years ago

741 380 6 years ago

reportcybercrime.com

neximo64• 6 years ago

There are so many ads on this site

loxs• 6 years ago

I didn't see any (uBlock origin + NoScript)

accountLost• 6 years ago

Any reason you don't use an ad blocker ? I see no ad with Firefox + uBlock Origin.

bayindirh• 6 years ago

Just use the reader mode? Firefox's one clears the article pretty neatly.

fit2rule• 6 years ago

And so the futility of captured computing continues. I would love to write software for the Touch Bar that runs when I shut the MacBook down .. it'd be quite useful for some things, I imagine - such as using it for a remote control for other equipment I own.

fastball8• 6 years ago

You could explain this a bit more? Not really understanding how this would be useful.

withinboredom4• 6 years ago

Just imagine opening your laptop without turning it on, and using it to unlock your front door without getting up, or turning off/on the TV, or the temperature of the house.

bilegeek• 6 years ago

Given that T2 is basically and ARM processor + other stuff, I wonder if it's possible to have a separate dump kernel, like OpenVMS. Some watchdog that runs on the chip, and either gracefully shuts down or handles a kernel crash.

californical2• 6 years ago

This is huge! Does anyone know if Apple is able to ship updated software to patch this? I thought the T2 was fairly isolated from the rest of the system. If it’s not easy to fix OTA, this will be really painful for security.

Excited to see what sorts of things people build from this though! Would be cool to run a mini OS on the touch bar when the rest of the system is powered off.

my123• 6 years ago

They cannot. Both the AP and the SEP ROMs are hacked on the T2.

javajosh2• 6 years ago

If you follow the links you'll find https://checkra.in/ which gives you a dmg download - however the release notes don't mention anything about a T2 jailbreak. I would treat this with skepticism.

austhrow743• 6 years ago

The tweet is legit though

https://twitter.com/jamiebishop123/status/130835517830794854...

and jamiebishop123 is in checkra1n's "made by" list.

californical2• 6 years ago

It does claim “partial bridgeOS support” which is the OS that runs on the T2. So maybe not as crazy. Good call though, it’s good to be aware of that sort of thing

bartvk2• 6 years ago

I wonder if this has security implications. The T2 houses the "secure enclave" and that's where your private keys, certificates and passwords are stored.

harrygeez2• 6 years ago

of course. Previously your keys are stored securely in a vault in a security facility but now the doors to the security facility is blown wide open. They still need to figure out the Secure Enclave though, which is no easy feat

saagarjha13• 6 years ago

It’s been largely figured out already. The actual work is going into A11’s enclave at the moment.

pvg3• 6 years ago

The things stored in the enclave are encrypted with a key derived from, among other things, your device password so no jailbreak is going to provide access to them.

It would be a big deal if one could, say, run 'offline' dictionary attacks against secure enclave content.

systemvoltage• 6 years ago

Same password results in a different hash if you run it again.

DaiPlusPlus4• 6 years ago

run 'offline' dictionary attacks against secure enclave content.

Isn't the T2 chip the only reason they can't do that:: because it sets a minimum time-limit and cooldown period on attempts to authenticate using the device passcode?

So presumably rooting T2 and removing the artificial time limits and/or extracting KDF data would mean game-over because brute-forcing `[0-9]{4,8}`, with even the most expensive hash function - and with a salted hash - can probably be done on a desktop within a day.

...but why can't we do that today by de-capping the T2 chip and looking at its flash storage with an electron-microscope?

poslix972• 6 years ago

I still don't understand why nobody seems to be able to answer the question that everybody would want to know the answer to, which is:

Is it possible to get at the encrypted user data of a locked MacBook or not?

Yes or no, please...

aneutron4• 6 years ago

The fact that Apple uses this chip to, among other things, block "unauthorized repair" (can't change a freaking SSD in 2020, really), makes me very happy that people are finding ways to break this chip to make repairs more accessible.

On the other hand, this could have serious implications on the iOS security model for example.

And I'm pretty sure someone is gonna run Doom on the touchbar in some months.

draugadrotten• 6 years ago

Doom on touchbar (2016) https://www.theverge.com/circuitbreaker/2016/11/21/13697058/... https://twitter.com/b3ll/status/800472338496036864?s=20

quenix• 6 years ago

That's running purely in usermode, and nothing was broken in this demonstration, the touch bar is being used "as intended"

djxfade• 6 years ago

Back in the days, we had bootsector games. In the future we will have TouchBar games running before even the OS boots.

kristofferR• 6 years ago

True, but to be fair, the same mechanism also blocks thieves from using and/or selling stolen Macs.

aneutron4• 6 years ago

Fair enough, but the problem is mainly when you are in a third world country and parts are very difficult to get, and where Mac stores are non-existent.

gspr• 6 years ago

True, but to be fair, the same mechanism also blocks thieves from using and/or selling stolen Macs.

That would be a fair excuse if the mechanism was under the control of the machine's rightful owner.

stjohnswarts6• 6 years ago

That just means apple should have done a better job securing the chip. All of these management chips have a bad history of security look up HP and Dell BMC chips as well

ksec2• 6 years ago

The fact that Apple uses this chip to, among other things, block "unauthorized repair"

I actually dont mind they block unauthorised repair, at least I believe in the Steve Jobs's Apple era he wanted the best customer experience. And they want the Data of what is failing in their Mac where their Genius Bar gain first hand experience and knowledge which leads to feedback to the Design team. ( They dont publicly announce or admit it, but the database has those problem listed. )

The goal was to aim for perfection, a machine that is so reliable it wouldn't need to repair in the first place. And if and when they fail, Genius Bar is there to help. You used to get some nice gesture from Apple Retail. Now they are simply trying gouge customers into buying a new MacBook, hopefully with AppleCare+, or replacement for the logic board. Every single problem they will just quote you to replace the logic board price. Not only are they expensive, the actual work or replacement isn't even up to Apple's standard.

I will need time to dig up some data. But MacBook Pro 2016+'s resale price has dropped quite significantly compared to MBP 2015 in the same age. And MBP 2015 second hand market is actually going strong.

aneutron4• 6 years ago

The goal was to aim for perfection, a machine that is so reliable it wouldn't need to repair in the first place.

You will have to excuse me, but that is a load of bullcrap.

Let's take the case that irritates me the most: The SSD.

By definition of the technology that is NAND storage, an SSD will be able to operate "within norm" and without bit errors for so long. Rewrite for long enough and you'll see your data waving you good-bye.

As for your other claims about recording errors and whatnot, you can EASILY achieve those (matter of fact it's already implemented in UEFI by some manufacturers), and NOT disallow people from repairing their computer.

Sure the lifespan of an SSD is ideally 5/7 years. But that is a death sentence, not a search for perfection.

Also, what happens if Apple simply refuses to fix your computer, or supply your with parts ! And yes this has happened rather publicly (Linus Sebastian's Mac Pro)

So again, apologies for the language but that is a load of bullcrap

yholio10• 6 years ago

Sorry, but the only rational consumer response to a device that actively works against you is not to purchase it, not hack it. Once millions of people pay to be imprisoned on their own devices, the long game is lost no matter how good the hackers are, the firm has the upper hand and the resources to prevail in the long run.

And I am perfectly happy to assert this as a political preference, and vote in office people that vow to protect consumers from this kind of racketeering. I understand this might not be your cup of tea, and that some people prefer unfettered capitalism, its your political right. However I fell that allowing this in our society limits my freedom and choices, because the things you buy affect me too.

fastball8• 6 years ago

Many people buy iPhones / Macs because of the (intended) security provided by things like the T2 chip.

coldtea7• 6 years ago

Sorry, but the only rational consumer response to a device that actively works against you is not to purchase it, not hack it.

"Actively works against you" is your reading. I very much appreciate what the T2 does, and hope the next update will be even more difficult to hack (aside from its other functionality).

johncolanduoni8• 6 years ago

How does me (or anyone else) buying a MacBook affect your freedom and choices? Was there some extinction of e.g. Linux-capable devices I didn’t hear about? And if I actually want the security features, who are you to say that’s not an option for me?

amelius2• 6 years ago

The main problem is that:

- on the one hand (I believe) developers would prefer owning more open devices (like Librem/Purism, Pine64 etc.)

- on the other hand they want to develop for the masses, which means they will need access to Apple hardware.

cwhiz2• 6 years ago

Some of the people here can’t understand that some people have different opinions.

I don’t care that I can’t easily change the SSD. If that were important to me, I would buy a different laptop.

I don’t consider my MacBook Pro to be working against me, at all.

Svoka• 6 years ago

For me it was conscious choice: Security ≫ Repairability.

I don't mind getting a new MacBook, but I do mind if it gets compromised. This way I know it would be a screen replacement at best.

tonyedgecombe5• 6 years ago

I’ve always thought the repairability thing is overblown, mostly I want reliability.

varispeed• 6 years ago

Lack of repairability is sort of akin to security by obscurity. This is flawed thinking and motivated by Apple's greed.

lxgr• 6 years ago

Does the T2 have any secure storage like the A12 and newer, or are all boot ROM exploits essentially unpatchable? And do we know if this specific exploit is a boot ROM exploit?

saagarjha13• 6 years ago

It’s the checkra1n BootROM exploit, yes. T2 does have a SEP processor like every modern iPhone but that’s been recently cracked too (interestingly enough because Apple tried to run some trickery to “patch the unpatchable” using it).

gigatexal• 6 years ago

how quickly will they patch this now is my question

fastball8• 6 years ago

Probably not at all. Seems like this is a ROM exploit, so can't be patched with a software update.

can16358p• 6 years ago

"How will they patch this" is another aspect, regardless of the speed of action.

aunali16• 6 years ago

Hi guys, I am part of the team working on all things T2. [1]

The checkra1n support is just in a PoC state, it will successfully exploit and boot the T2. The payload support is partially broken, but being worked on.

Additionally, we have SSH working over usbmuxd from a tethered device [2] and SSH working from macOS on device, with an SDK in the works [3].

Some key takeaways from the T2 being jailbroken:

- Custom Bootloaders (OpenCore, Coreboot, etc) are now possible as the T2 validates/sends the UEFI payload to PCH using a bridgeOS binary called MacEFIUtil, which can trivially have its signature checks patched.

- Filevault and by extension Touch ID are more or less crippled, especially in light of the recent SEP exploits. Amusingly, Apple uses a hardcoded "passcode", analogous to an iDevice's unlock pin in plain text within the UEFI firmware.

- Support for In-System Debugging of the PCH/Intel processor over USB. This works in a similar fashion to those Bonobo cable used for debugging iDevices [4]. We are working on building an accessory that you can purchase and plug into your Mac with a USB male endpoint exposing Intel's DCI debugging protocol.

- Lightweight AppleSilicon Tinkering environment. With SSH support from macOS on device, and the T2's modest specs, its a nice sandbox for messing with arm64 stuff. It's a pretty peppy chip, at times coming close to my 8th gen i7...yikes.

1. https://www.theiphonewiki.com/wiki/T8012_checkm8

2. https://twitter.com/qwertyoruiopz/status/1237904335184564224

3. https://twitter.com/su_rickmark/status/1286886010681462784

4. http://bonoboswd.com/

DaiPlusPlus4• 6 years ago

Thank you for your work!

Do you have any thoughts about what Apple's switch to own-brand ARM chips in laptops and desktops will mean for T2/T3/etc?

aunali16• 6 years ago

The T2 was more or less a stopgap solution between their current Intel-based offerings and the AppleSilicon devices in regards to their security aspirations. My understanding is that there will be no T3, as evidenced in the DTK, which makes a lot of sense considering how identical these chips will be to their mobile counterparts.

peteretep• 6 years ago

Filevault and by extension Touch ID are more or less crippled

Sorry, what does this sentence mean? That someone with physical access to my machine can now unencrypt my FileVault encrypted hard drive?

deepstack3• 6 years ago

Some one from Apple, I'm sure you read this. Please answer this ASAP. I rely on mac and FileValute for professional use at work. Need to know the state of this exploit.

plussed_reader• 6 years ago

Wouldn't this mean the 'secure' values for these two processes within are now visible/ readable with the right tool/protocol availability?

akvadrako• 6 years ago

The Secure Enclave on the T2 chip was used to store secrets that were supposed to stay inaccessible, even to someone with physical access.

If you use a strong password to encrypt your drive you should still be safe, unless Apple did something really stupid. The password is used as a one-way hash to generate the key.

However if you can login with Touch ID and they find a way to use known SE exploits, it's compromised. Your fingerprint isn't a secret that gets hashed – instead it's verified by the SE which also holds the secret key for the drive.

teruakohatu• 6 years ago

Incredible work.

It's a pretty peppy chip, at times coming close to my 8th gen i7...yikes.

Have you got any benchmarks? It is passively cooled right? I am really surprised to hear a ~2016 arm64 CPU can can beat a 2019 Intel i7 in even synthetic benchmarks.

Grazester• 6 years ago

Not to be stickler but he said come close, not beat. Not that it's any less impressive.

PragmaticPulp• 6 years ago

Some synthetic benchmarks are so simple that they almost reduce to a measure of CPU clock speed and instruction parallelism. Find a benchmark that uses a unique instruction combination on one CPU and it will heavily disadvantage the other CPU.

Add a real world workload to the mix with heavy memory access and mixed compute workloads and the chips will diverge significantly in performance.

I work with some cross-platform code that has to run on mobile devices and desktop platforms. The advances Apple has made in low power performance are incredible, but the idea that their iPhone chips are as fast as desktop computers is still far from the truth unless you’re measuring specific, heavily optimized workloads.

I’m still excited to see what Apple can do with a full desktop level power budget though.

aunali16• 6 years ago

Mostly synthetics and some program compilation (configure+make) tests. Yes, it is passively cooled. To clarify, it does not match the host Intel CPU (i7-8750H @ 2.2GHz) but in some synthetics, i.e. Coremark, the T2 does come close. I would attribute the i7's lackluster performance mainly to thermal throttling issues.

mceachen2• 6 years ago

A ~2017 i7 is only 4% slower than a ~2019 i7:

https://cpu.userbenchmark.com/Compare/Intel-Core-i7-8700-vs-...

tgma• 6 years ago

T2 was first introduced in 2018 MacBooks. 2016-7 iBridges run on T1

Causality1• 6 years ago

You guys are fighting the good fight for everything that owning hardware and being a user used to mean. Thank you.

curiousgal• 6 years ago

I never understood this sentiment, if people choose to pay their way into a walled garden, why should they still care about hardware ownership/repairabilty, etc.?

Aaargh20318• 6 years ago

I hope you have reported the issue to Apple so they can fix it ASAP ?

saagarjha13• 6 years ago

They are well aware of the issue and have been for some time. There’s not all that much they can do to fix this, although they have certainly tried.

56khole• 6 years ago

Firstly, thanks so much for your hard work. All I want is to run Arch on an MBP 15,1. I've given your repos on Github a try--do you have a functioning bootloader config? T2 just freezes GRUB for me no matter what I try. Thanks again

hlandau• 6 years ago

Custom bootloaders are now possible

This is interesting; does this mean Apple isn't enabling Intel Boot Guard, relying only on the checks enforced by MacEFIUtil?

Fantastic work, by the way.

easton3• 6 years ago

They aren’t, they’ve removed much of the Intel software that is usually included with UEFI except what is required for DRMed video. If the T2 is compromised, they say that one could compromise UEFI on the device permanently as well.

https://support.apple.com/guide/security/uefi-firmware-overv...

saberience• 6 years ago

Why do you believe it's moral for you to do work which is making people's data less secure, helping law authority crack iPhones, etc?

saagarjha13• 6 years ago

The same work allows users to have control over the hardware they own as well.

vladvasiliu• 6 years ago

It could be argued that work like this actually helps make people's data more secure.

Granted, owners of the affected hardware might not like it, but this sheds light on issues that are actually present in the hardware. Who's to say that "law authority" or some criminal organization didn't do any work on this without intention to publish their results?

If people have sensitive data and were counting the T2 chip to keep it secure, now they know there are limitations to this security model. They can now weigh the pros and cons and, if applicable, set up an alternative that will be more secure. This could also push Apple to provide better security in upcoming products.

netsharc• 6 years ago

Imagine if their "evil twins" working in the dark or for the NSA, KGB or Red Army, have cracked this but not tweeted about it. Now the Apple security is just as broken but you don't know about it. Is your data more or less secure?

hu3• 6 years ago

What makes you think state actors with inifinite budgets didn't do what this one guy is doing?

Everything he exposes will be fixed and improved. If anything he's helping make Apple devices more secure.

userbinator• 6 years ago

It's work which is enabling freedom, something that people are unfortunately giving up far too much of these days...

nix232• 6 years ago

Go back and do your homework.

Showing security problems is the opposite of making Technology less secure. Maybe ask Apple why they think it's a good idea to have closed source special chip at all.

kmeisthax4• 6 years ago

Law enforcement has been going apeshit about legally forcing Apple to build in hardware backdoors to their products. If this jailbreak didn't exist, they'd be putting a gun to Apple's head and demanding decryption tools for all iPhones.

Furthermore, the entire point of a jailbreak is to regain root access to your own device - Apple provides no way for a user to do so, which I find at least somewhat irksome. The way it currently stands, all iOS devices ship with Apple having total control over the device, and a jailbreak lets you claw back control by force if you so choose.

snarf21• 6 years ago

So only the NSA should be able to do this and then also keep it a secret?

heavyset_go5• 6 years ago

I'm glad they released their jailbreak, because otherwise, those exploits would be sold and traded on the black market or collected and used by malicious groups, and we would be none the wiser. We'd walk around believing our machines are secure, and act like it, while that clearly isn't the truth.

dstroot• 6 years ago

Hi guys, I am part of the team working on all things T2.

So there is a team working on this? What is the incentive model? Are you paid to do this work? What is the revenue model?

I woke up today learning my MacBook Pro is now substantially less secure but why? So I can run games on the touch bar? So I can use the T2 as a raspberry pi?

denis1• 6 years ago

Your MacBook Pro didn't now become less secure. It always was. We should be thankful to these people for making the vulnerability clear to us.

acolumb• 6 years ago

There is a team taking advantage (jailbreaking on iOS) of the security flaw in all A-series chips up to A11 in the hardware-level bootloader. The T2 in your 2018 or newer Mac is a variant of the A10.

The bootROM flaw allows for an exploit that can only be executed with physical access, another Mac and DFU mode. It's not persistent.

The main use of this exploit was to install unsigned code on iOS devices (jailbreaking.) The team is doing it for free, however many contributors take advantage of Apple's bug bounty program for income, therefore making newer devices more secure.

MartinNobel2• 6 years ago

The T2 Mac startup chime is located in /System/Library/PrivateFrameworks/BridgeAccessibilitySupport.framework/AXEFIAudio_VoiceOver_Boot.aiff . I think it will only be months until someone manages to change the 'bong' sound into a custom startup chime. This will be very interesting...

person_of_color2• 6 years ago

Its clear that bootROM is not the way forward.

saagarjha13• 6 years ago

There’s no alternative; something needs to bring up the chip when it comes out of reset.

person_of_color2• 6 years ago

its called storage

poslix972• 6 years ago

Bottom line, can you use this exploit to read the user data on a recent (2019+) iPhone or MacBook if you have possession of the device and it's locked? Yes or no?

dividedbyzero2• 6 years ago

I'm torn on this; on the one hand, the prospect of being able to circumvent things like unauthorized repair prevention down the line is neat, and who knows what people may be able to tease out of this (apparently quite powerful chip). So that's neat.

But it also breaks Apple's security platform in a big way, since this should make Apple's biometry scheme in their Macbooks much weaker and FileVault a lot easier to crack. That's a shame, because it's a very neat and cohesive security platform that gets out of one's way and works really well even for highly non-technical people. Their security stance is one of the things that keep me in Apple's ecosystem and I know a number of people and companies who feel alike. So, coming from that point of view, I do hope they fix this in time for their first round of ARM Macs.

saurik• 6 years ago

So, if only Apple didn't tie the ability to repair and extend the device you purchased from them to the security of your own data, you would be able to feel a more consistent emotion with regards to interest in a fix; that seems all on Apple being a bit evil :/.

floatingatoll3• 6 years ago

Can you describe a scenario where Touch ID is safe against evil maid attacks (say, a chip is installed allowing anyone to transmit a certain signal that spoofs Touch ID) while also allowing unrestricted modifications by someone with physical possession of the device (as this T2 rooting post celebrates)?

Right now, that security is provided by Apple crypto-locking the Touch ID sensor to the T2 chip so that it cannot be modified to allow unauthorized access without being disabled altogether.

With the ability to bypass the restrictions of the T2 OS, that protection is stripped away, and replaced by .. nothing, as far as I can determine.

This is akin to removing your car’s electronic anti-theft system because it requires OEM keys. Sure, you can do so, but your car is a lot easier to steal, too. Only it’s not your car here, it’s your computer and all personal data on it, and all SSH keys you use to access remote servers, too.

I’m all for repairability but it’s worrying that the tech community is so invested in removing a padlock that offends them that they set aside security and risk issues in favor of rooting without addressing it at all. If this complete lack of interest in device security is the best we can do, we don’t deserve repairability, and we don’t deserve root.

fastball8• 6 years ago

AFAIK, it's not just about the security of your data (you don't need a T2 chip to encrypt data), but also about discouraging theft of the hardware itself.

In light of that, how do you allow for components to be swapped out wholesale without breaking the security model?

Isn't the entire point that you can't just steal a Macbook, swap out the SSD, and now you have a functioning (stolen) laptop?

tinus_hn• 6 years ago

If it really matters, Apple can bring an update that blocks these attacks. If the system depends on security through obscurity, sorry, that never lasts.

saagarjha13• 6 years ago

Apple cannot update this away; the vulnerability goes down to the very lowest levels of the software to the code burned into ROM.

Benjamin_Dobell2• 6 years ago

Apple did actually screw the pooch on this one.

Typically, it's criminally illegal to circumvent DRM in the US (and 99% of the rest of the world). However, there are also certain exemptions that have been granted, within the US only (other countries are not so lucky). The right to repair is one such exemption[1].

If Apple had separated security from first-party repair enforcement, then anyone found even attempting to break the T2 chip might have been up for jail time. However, the right to repair is a valid defense.

Of course, making circumvention criminally illegal doesn't make the chip itself any more technically secure; say against criminals. It is a pretty solid deterrent though.

Daniel_sk• 6 years ago

I bet breaking DRM is legal in most parts of the world. Good luck to any company trying to sue an individual for breaking DRM. "Article 6.4 of the European Directive mandates Member States to ensure users can benefit from the copyright exceptions. This means that countries must have some kind of process in place to allow citizens to make copies of DRMed works." (https://fsfe.org/news/2019/news-20191113-01.en.html) Unfortunately in US the corporate has lobbied so hard to make EULA, DRM and others enforceable by law.

dathinab3• 6 years ago

the US (and 99% of the rest of the world)

No, that is a pretty US specific mess up.

At least in the EU braking DRM for thinks like research purpose is fully legal as far as I know.

It's a bit more complicated if it's a but distributing tools which can brake DRM.

It's no as complicated if it's about publishing a (somewhat) scientific document explaining the general concept about how to brake it.

parliament322• 6 years ago

The US is effectively the only place in the world where circumventing DRM is actually illegal and prosecute-able, every other country has various exemptions and bypasses that remove its teeth. Here in Canada for example, you can happily argue "I was doing it to learn how it worked" and fall under the education exemption, unless you're stripping DRM and actively selling the content or something similar.

You should have a skim through https://en.wikipedia.org/wiki/Digital_rights_management#Laws

chungus_khan• 6 years ago

It is a pretty solid deterrent though.

It absolutely is not. It is completely unenforceable, especially in the case of criminal circumvention, and serves no realistic or practical purpose. Anyone who commits said "crime" in any meaningfully damaging sense and is caught will already be committing the actual crime of infringement, and so tacking circumvention on is largely pointless. It only serves to deter legitimate public research.

Also, the T2 isn't in any way classifiable as "technological measures used to prevent unauthorized access to copyrighted works". This law is meant to apply to copyright-protection DRM and has nothing to do with software security measures designed to prevent unauthorized access to computer systems. Circumventing the protection of those measures is only legal to do on systems on which you are authorized to do so, and is otherwise illegal under separate law.

deepstack3• 6 years ago

More and more after over 10 years working in tech I'm convinced that there is no digital system is a secure system. Hardware and Software.

deepstack3• 6 years ago

what I mean by that is it really more about one's threat model. Give enough time and capable people, any system can be broken into.

vslira• 6 years ago

As an Apple customer I'm 100% happy with public developments like this. I really believe Apple tries to take hardware security seriously and an exploit it the open like this is surely to be addressed in the next generation of devices.

Apple consumer devices have been shown to resist state-level actor threats in the past and even if current devices won't be 100% resistant forever I trust Apple to be a couple of steps ahead every gen.

Of course, I'm jumping ship as soon as 100% open-source and verifiably secure HW+OS stack is available. But until then, it's Apple :P

Tsarbomb• 6 years ago

How did you get the information that apple devices resist state-level actor threats?

Repeatedly state actors have broken into iphones and icloud accounts, and apple laptops are frequently the first devices to fall in the Pwn2Own contests.

npongratz• 6 years ago

But it also breaks Apple's security platform in a big way, since this should make Apple's biometry scheme in their Macbooks much weaker and FileVault a lot easier to crack.

Perhaps this unsurprising, nearly predestined exploit can convince people that they should not completely rely on biometrics for security.

stjohnswarts6• 6 years ago

I think it's always best for these things to come out if there's a flaw. You can bet if these guys found it that China, the US government, and 11 eyes by extension all knew about it before that. It's best to know the truth, that the security is broken, rather than crossing your fingers and hoping the security works.

headmelted• 6 years ago

Great day to be Apple I guess.

I imagine there’s no better incentive to get people to move en masse to your new architecture than an exploit for your old architecture that completely and irreparably breaks its security model showing up weeks before it’s released.

bredren• 6 years ago

I don’t think this is the type of thing that affects broad consumer decision making on product replacement.

Maybe a slight impact if it was the only story in the news right now and the cable networks ran it regularly? Still a stretch.

mmastrac• 6 years ago

Interesting. Does this mean that companies can now use this to unlock corp laptops that ex-employees have iCloud/activation-locked to their personal accounts without Apple's help? [+]

[+] Yes, I realize that this also applies to stolen laptops, but this is an actual pain point with running fleets of Macs, from what I've heard.

nixgeek• 6 years ago

Is this a pain point when you’re using Deployment Programs, or what’s now called School Manager or Business Manager?

snazz• 6 years ago

DEP allows you to clear Activation Lock with your MDM: https://support.apple.com/en-us/HT202804

aunali16• 6 years ago

Yep, it involves the same techniques used for iDevices but with less steps. I won't go into details here for obvious reasons.

Nextgrid4• 6 years ago

Are you saying that there is a long-term way to bypass Activation Lock? My understanding was that even if you bypass it locally (through jailbreak), you will not be able to use any of Apple's online services (iMessage, App Store, push notifications, etc) because Apple will not let this device register (and get the necessary client certificates) unless the original account's credentials are provided first, and this is enforced server-side and thus immune to local exploits.

neycoda• 6 years ago

The only way to truly secure something is to make it inaccessible. You can't pick the lock of a door if it's a wall, you know.

iamcaps• 6 years ago

So as I recently got a Mac from a guy and he don’t remember the password and I’m stuck on activation lock should I keep it or should I sell it or throw it ! Thanks a lot

Apple’s T2 security chip jailbreak

Related Stories