According to a recent security presentation, attackers were able to infect Macintosh systems with a special type of malware using the computer's Thunderbolt port. The attack, dubbed Thunderstrike, was presented by security researcher Trammell Hudson at the Chaos Communications Congress in Germany. Hudson is well-known in the security community, particularly for his reverse engineering of various devices and systems. MacBook Thunderstrike Thunderstrike
You can watch Hudson's entire presentation below or read an annotated version of his talk, but the gist of it is that the attack exploits a flaw in the Thunderbolt that allows custom code – such as a bootkit – to be injected into the system using the port.
The Thunderstrike vulnerability exploits the Thunderbolt Option ROM, first described in 2012. Hudson's PoC, however, goes several steps further (attempts to exploit the flaw in the past to write new code to the ROM at boot time frustrated many researchers).
Ultimately, Hudson's PoC shows how an attacker could use the Thunderbolt port to install a custom bootkit. This bootkit could replicate itself to any other Thunderbolt-connected device, meaning it could spread across entire networks.
The scary thing is that, because this code uses its own separate ROM, the attack cannot be stopped by reinstalling OS X or swapping the hard drive.
Hudson also showed that he could replace the encryption keys Apple uses to sign firmware with a new key, which prevents future system updates.
The good news
Hudson's project is both impressive and scary for Apple device owners, although they don't need to fear Thunderstrike for now. Hudson says that there are no Mac firmware bootkits being released, and that they exist only as a proof of concept (PoC).
Apple has already patched part of the vulnerability in the latest Mac mini and iMac with 5K Retina display.
It should also be noted that this type of attack requires physical access to a machine. You cannot download the malware through other software.
https://www.youtube.com/watch?v=5BrdX7VdOr0
Source: secnews.gr
