Your Mac Is Vulnerable to Thunderbolt Hacks and You Can't Do Anything About It – Video

That should be a bit of a wake up call to all those Apple users who inanely believe that because they use a Mac they are immune from malware and the like...but will they listen?  I very much doubt it...LOL.

A bit more information on Thunderstrike.
 
Sunday, January 04, 2015 Swati Khandelwal
 
http://4.bp.blogspot.com/-OGCo1VXX5d0/VKpl0Euz76I/AAAAAAAAhXw/Zpr4NHzNcCM/s728/Thunderstrike-Attack.jpg                         A security researcher has discovered an easy way to infect Apple’s Macintosh computers with an unusual kind of malware using its own Thunderbolt port. The hack was presented by programming expert Trammell Hudson at the annual Chaos Computer Congress (30C3) in Hamburg Germany. He demonstrated that it is possible to rewrite the firmware of an Intel Thunderbolt Mac. The hack, dubbed Thunderstrike, actually takes advantage of a years-old vulnerability in the Thunderbolt Option ROM that was first disclosed in 2012 but is yet to be patched. Thunderstrike can infect the Apple Extensible Firmware Interface (EFI) by allocating a malicious code into the boot ROM of an Apple computer through infected Thunderbolt devices. Full Article 

By Eduard Kovacs on January 08, 2015
 
Highly persistent Mac OS X firmware bootkits can be installed on Apple computers, giving attackers full control of the device, a researcher has warned.
At the Chaos Communication Congress (31C3) that took place in Germany in late December, researcher Trammell Hudson demonstrated the capabilities of an experimental piece of malware that can be installed on the EFI (Extensible Firmware Interface) boot read-only memory (ROM) of Apple MacBooks through the Thunderbolt port.
Dubbed "Thunderstrike" by the expert, the bootkit can be installed within minutes by an attacker who has physical access to the targeted device (i.e. an “evil maid” attack). The threat is also capable of copying itself to Thunderbolt devices connected to the initially infected machine, which enables it to easily spread to other computers.
Thunderstrike doesn’t have a malicious payload, but the researcher says a weaponized version of the bootkit would be highly dangerous. First of all, it would be difficult to detect because there are no systems in place for identifying firmware rootkits on OS X. Furthermore, the malware is stealthy because it can hide by leveraging the system management mode (SMM).
 
full article

8 Jan 2015 at 06:02, Darren Pauli
 
Reverse engineer Trammell Hudson has created an attack dubbed Thunderstrike which can quietly, persistently and virally compromise Apple Macs from boot.
The Thunderstruck attack uses 35 year-old legacy option ROMs to replace the RSA keys in a Mac's extensible firmware interface (EFI) to allow malicious firmware to be installed and lock out attempts to remove it.
 
It works against all Macbooks released since Thunderbolt's 2011 introduction, Hudson said, noting that he successfully tested seven machines.
"When we boot the machine the Thunderstrike exploit runs in the recovery mode boot replacing firmware and Apple's update routine flashes its RSA key onto the motherboard - and once that is done, we own the system and we can flash whatever we want using Apple's own update tools," Hudson told an applauding audience at the Chaos Communications Congress.
"Because we replaced the key this bootkit can't be removed through software alone because we control the key the firmware is going to use.
"There is no official channel to remove it."
 
full article