Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.fsmpi.rwth-aachen.de!newsfeed.straub-nv.de!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Jolly Roger Newsgroups: comp.sys.mac.system Subject: Re: Is this real Date: 12 Jan 2015 20:27:17 GMT Organization: People for the Ethical Treatment of Pirates Lines: 31 Message-ID: References: X-Trace: individual.net v80k3hUZiqOTetLQLKA2LQnxTiPRE9Z52XRrwrTm0yYWcnapby Cancel-Lock: sha1:P8OapDVzwiQPcRxuAuNSRCBiEQo= X-Face: _.g>n!a$f3/H3jA]>9pN55*5<`}Tud57>1Y%b|b-Y~()~\t,LZ3e up1/bO{=-) User-Agent: slrn/1.0.1 (Darwin) Xref: csiph.com comp.sys.mac.system:68317 On 2015-01-12, Kurt Ullman wrote: > > Macs vulnerable to virtually undetectable virus that "can't be removed" > Summary:A security researcher has discovered a way to infect Macs with > malware virtually undetectable, that 'can't be removed,' and which can > be installed using a modified Apple gigabit Ethernet Thunderbolt adapter. > > http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi > rus-that-cant-be-removed/ > > As best I can tell, someone has to get hold of your Mac, open it up > and do something to the thunderbolt adaptor, put everything back > together and then do it to it. > Seems even to me, to be hardly worth the time or effort and > definitely not going to do any damage for 99.999999999% of us. Sure, it's real. It's also not Mac-specific. The researcher chose Macs for the publicity. To be compromised, you have to allow a stranger to plug a malicious Thunderbolt device into a Thunderbolt port on your computer. This is similarly to the way you can be compromised if you allow someone to plug a malicious USB device into the USB port on your computer. And that's been known for many years now. The same smart computing principle applies: Don't leave your computer where strangers can have unsupervised physical access to it, and don't plug strange USB/Thunderbolt things into your computer. ; ) -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR