Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #68314 > unrolled thread

Is this real

Back to article view | Back to comp.sys.mac.system

Contents

  Is this real Kurt Ullman <kurtullman@yahoo.com> - 2015-01-12 14:49 -0500
    Re: Is this real Barry Margolin <barmar@alum.mit.edu> - 2015-01-12 15:26 -0500
    Re: Is this real Jolly Roger <jollyroger@pobox.com> - 2015-01-12 20:27 +0000
      Re: Is this real Lloyd Parsons <lloydp21@live.com> - 2015-01-12 14:29 -0600
        Re: Is this real Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-01-12 16:52 -0500
          Re: Is this real John <Man@the.keyboard> - 2015-01-13 06:29 +0000
            Re: Is this real Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-01-15 15:11 -0500
        Re: Is this real John <Man@the.keyboard> - 2015-01-13 06:27 +0000
        Re: Is this real billy@MIX.COM - 2015-01-15 18:48 +0000
          Re: Is this real nospam <nospam@nospam.invalid> - 2015-01-15 14:04 -0500
            Re: Is this real JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-01-15 16:58 -0500
          Re: Is this real Jolly Roger <jollyroger@pobox.com> - 2015-01-15 19:22 +0000
          Re: Is this real Lloyd Parsons <lloydp21@live.com> - 2015-01-15 13:34 -0600
    Re: Is this real Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-01-12 16:39 -0500
      Re: Is this real John McWilliams <jpmcw@comcast.net> - 2015-01-15 20:21 -0800
        Re: Is this real Your Name <YourName@YourISP.com> - 2015-01-16 18:26 +1300
        Re: Is this real Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-01-16 09:19 -0500
    Re: Is this real Kevin McMurtrie <mcmurtrie@pixelmemory.us> - 2015-01-14 00:10 -0800
      Re: Is this real android <here@there.was> - 2015-01-14 11:09 +0100
        Re: Is this real dempson@actrix.gen.nz (David Empson) - 2015-01-15 00:54 +1300
      Re: Is this real Jolly Roger <jollyroger@pobox.com> - 2015-01-14 14:53 +0000
    Thunderstrike "malware" (was Re: Is this real) Your Name <YourName@YourISP.com> - 2015-01-15 18:33 +1300
    Re: Is this real Jolly Roger <jollyroger@pobox.com> - 2015-01-24 15:53 +0000

Page 1 of 2  [1] 2  Next page →

#68314 — Is this real

Macs vulnerable to virtually undetectable virus that "can't be removed"
Summary:A security researcher has discovered a way to infect Macs with 
malware virtually undetectable, that 'can't be removed,' and which can 
be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.

http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
rus-that-cant-be-removed/

   As best I can tell, someone has to get hold of your Mac, open it up 
and do something to the thunderbolt adaptor, put everything back 
together and then do it to it. 
    Seems even to me, to be hardly worth the time or effort and 
definitely not going to do any damage for 99.999999999% of us.
-- 
³Statistics are like bikinis. What they reveal is suggestive,
     but what they conceal is vital.²
                       ‹ Aaron Levenstein

[toc] | [next] | [standalone]

#68316

In article <X_KdnRi6G6epuCnJnZ2dnUU7-RednZ2d@earthlink.com>,
 Kurt Ullman <kurtullman@yahoo.com> wrote:

> Macs vulnerable to virtually undetectable virus that "can't be removed"
> Summary:A security researcher has discovered a way to infect Macs with 
> malware virtually undetectable, that 'can't be removed,' and which can 
> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
> 
> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> rus-that-cant-be-removed/
> 
>    As best I can tell, someone has to get hold of your Mac, open it up 
> and do something to the thunderbolt adaptor, put everything back 
> together and then do it to it. 
>     Seems even to me, to be hardly worth the time or effort and 
> definitely not going to do any damage for 99.999999999% of us.

The Thunderbolt adapter is not something in the Mac itself, it's a cable 
that you use to connect the Mac's Thunderbolt port to a device like a 
monitor or hard drive. They don't have to open up the Mac, they just 
have to plug in a cable. Look at the picture at the beginning of the 
article.

-- 
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***

[toc] | [prev] | [next] | [standalone]

#68317

On 2015-01-12, Kurt Ullman <kurtullman@yahoo.com> wrote:
>
> Macs vulnerable to virtually undetectable virus that "can't be removed"
> Summary:A security researcher has discovered a way to infect Macs with 
> malware virtually undetectable, that 'can't be removed,' and which can 
> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>
> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> rus-that-cant-be-removed/
>
>    As best I can tell, someone has to get hold of your Mac, open it up 
> and do something to the thunderbolt adaptor, put everything back 
> together and then do it to it. 
>     Seems even to me, to be hardly worth the time or effort and 
> definitely not going to do any damage for 99.999999999% of us.

Sure, it's real. It's also not Mac-specific. The researcher chose Macs
for the publicity. To be compromised, you have to allow a stranger to
plug a malicious Thunderbolt device into a Thunderbolt port on your
computer. This is similarly to the way you can be compromised if you
allow someone to plug a malicious USB device into the USB port on your
computer. And that's been known for many years now. The same smart
computing principle applies: Don't leave your computer where strangers
can have unsupervised physical access to it, and don't plug strange
USB/Thunderbolt things into your computer. ; )

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#68318

On 12 Jan 2015 20:27:17 GMT, Jolly Roger wrote:
> On 2015-01-12, Kurt Ullman <kurtullman@yahoo.com> wrote:
>>
>> Macs vulnerable to virtually undetectable virus that "can't be removed"
>> Summary:A security researcher has discovered a way to infect Macs with
>> malware virtually undetectable, that 'can't be removed,' and which can
>> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>>
>> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
>> rus-that-cant-be-removed/
>>
>>    As best I can tell, someone has to get hold of your Mac, open it up
>> and do something to the thunderbolt adaptor, put everything back
>> together and then do it to it.
>>     Seems even to me, to be hardly worth the time or effort and
>> definitely not going to do any damage for 99.999999999% of us.
>
> Sure, it's real. It's also not Mac-specific. The researcher chose Macs
> for the publicity. To be compromised, you have to allow a stranger to
> plug a malicious Thunderbolt device into a Thunderbolt port on your
> computer. This is similarly to the way you can be compromised if you
> allow someone to plug a malicious USB device into the USB port on your
> computer. And that's been known for many years now. The same smart
> computing principle applies: Don't leave your computer where strangers
> can have unsupervised physical access to it, and don't plug strange
> USB/Thunderbolt things into your computer. ; )
>
IOW, another of those 'proof of concept' thingies with no real impact
on anyone other than the very stupid.

My guess, it'll never see the light outside the 'lab' he did it in.


-- 
Lloyd

[toc] | [prev] | [next] | [standalone]

#68323

On 2015.01.12 15:29 , Lloyd Parsons wrote:
> On 12 Jan 2015 20:27:17 GMT, Jolly Roger wrote:
>> On 2015-01-12, Kurt Ullman <kurtullman@yahoo.com> wrote:
>>>
>>> Macs vulnerable to virtually undetectable virus that "can't be removed"
>>> Summary:A security researcher has discovered a way to infect Macs with
>>> malware virtually undetectable, that 'can't be removed,' and which can
>>> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>>>
>>> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
>>> rus-that-cant-be-removed/
>>>
>>>     As best I can tell, someone has to get hold of your Mac, open it up
>>> and do something to the thunderbolt adaptor, put everything back
>>> together and then do it to it.
>>>      Seems even to me, to be hardly worth the time or effort and
>>> definitely not going to do any damage for 99.999999999% of us.
>>
>> Sure, it's real. It's also not Mac-specific. The researcher chose Macs
>> for the publicity. To be compromised, you have to allow a stranger to
>> plug a malicious Thunderbolt device into a Thunderbolt port on your
>> computer. This is similarly to the way you can be compromised if you
>> allow someone to plug a malicious USB device into the USB port on your
>> computer. And that's been known for many years now. The same smart
>> computing principle applies: Don't leave your computer where strangers
>> can have unsupervised physical access to it, and don't plug strange
>> USB/Thunderbolt things into your computer. ; )
>>
> IOW, another of those 'proof of concept' thingies with no real impact
> on anyone other than the very stupid.
>
> My guess, it'll never see the light outside the 'lab' he did it in.

Travel to South Korea much?  China?  Taiwan?  Russia?

I've even had Japanese visitors here try to get me to install "just a 
video driver for our presentation".  Really?  You didn't bring your own 
laptops?  All 5 of you?  Really?  Pass.  Just tell us about your 
project.  (While they were from a defense division, their company also 
manufactured laptops - surprising they didn't bring one...).


-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#68337

On Mon, 12 Jan 2015 16:52:13 -0500, Alan Browne
<alan.browne@FreelunchVideotron.ca> wrote:

>On 2015.01.12 15:29 , Lloyd Parsons wrote:
>> On 12 Jan 2015 20:27:17 GMT, Jolly Roger wrote:
>>> On 2015-01-12, Kurt Ullman <kurtullman@yahoo.com> wrote:
>>>>
>>>> Macs vulnerable to virtually undetectable virus that "can't be removed"
>>>> Summary:A security researcher has discovered a way to infect Macs with
>>>> malware virtually undetectable, that 'can't be removed,' and which can
>>>> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>>>>
>>>> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
>>>> rus-that-cant-be-removed/
>>>>
>>>>     As best I can tell, someone has to get hold of your Mac, open it up
>>>> and do something to the thunderbolt adaptor, put everything back
>>>> together and then do it to it.
>>>>      Seems even to me, to be hardly worth the time or effort and
>>>> definitely not going to do any damage for 99.999999999% of us.
>>>
>>> Sure, it's real. It's also not Mac-specific. The researcher chose Macs
>>> for the publicity. To be compromised, you have to allow a stranger to
>>> plug a malicious Thunderbolt device into a Thunderbolt port on your
>>> computer. This is similarly to the way you can be compromised if you
>>> allow someone to plug a malicious USB device into the USB port on your
>>> computer. And that's been known for many years now. The same smart
>>> computing principle applies: Don't leave your computer where strangers
>>> can have unsupervised physical access to it, and don't plug strange
>>> USB/Thunderbolt things into your computer. ; )
>>>
>> IOW, another of those 'proof of concept' thingies with no real impact
>> on anyone other than the very stupid.
>>
>> My guess, it'll never see the light outside the 'lab' he did it in.
>
>Travel to South Korea much?  China?  Taiwan?  Russia?
>
>I've even had Japanese visitors here try to get me to install "just a 
>video driver for our presentation".  Really?  You didn't bring your own 
>laptops?  All 5 of you?  Really?  Pass.  Just tell us about your 
>project.  (While they were from a defense division, their company also 
>manufactured laptops - surprising they didn't bring one...).

 Maybe they didn't want the hassle of trying to get one through
Customs without the data being copied from it? Or the machine itself
being confiscated.
                     J. 

[toc] | [prev] | [next] | [standalone]

#68450

On 2015.01.13 01:29 , John wrote:
> On Mon, 12 Jan 2015 16:52:13 -0500, Alan Browne
> <alan.browne@FreelunchVideotron.ca> wrote:
>
>> On 2015.01.12 15:29 , Lloyd Parsons wrote:
>>> On 12 Jan 2015 20:27:17 GMT, Jolly Roger wrote:
>>>> On 2015-01-12, Kurt Ullman <kurtullman@yahoo.com> wrote:
>>>>>
>>>>> Macs vulnerable to virtually undetectable virus that "can't be removed"
>>>>> Summary:A security researcher has discovered a way to infect Macs with
>>>>> malware virtually undetectable, that 'can't be removed,' and which can
>>>>> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>>>>>
>>>>> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
>>>>> rus-that-cant-be-removed/
>>>>>
>>>>>      As best I can tell, someone has to get hold of your Mac, open it up
>>>>> and do something to the thunderbolt adaptor, put everything back
>>>>> together and then do it to it.
>>>>>       Seems even to me, to be hardly worth the time or effort and
>>>>> definitely not going to do any damage for 99.999999999% of us.
>>>>
>>>> Sure, it's real. It's also not Mac-specific. The researcher chose Macs
>>>> for the publicity. To be compromised, you have to allow a stranger to
>>>> plug a malicious Thunderbolt device into a Thunderbolt port on your
>>>> computer. This is similarly to the way you can be compromised if you
>>>> allow someone to plug a malicious USB device into the USB port on your
>>>> computer. And that's been known for many years now. The same smart
>>>> computing principle applies: Don't leave your computer where strangers
>>>> can have unsupervised physical access to it, and don't plug strange
>>>> USB/Thunderbolt things into your computer. ; )
>>>>
>>> IOW, another of those 'proof of concept' thingies with no real impact
>>> on anyone other than the very stupid.
>>>
>>> My guess, it'll never see the light outside the 'lab' he did it in.
>>
>> Travel to South Korea much?  China?  Taiwan?  Russia?
>>
>> I've even had Japanese visitors here try to get me to install "just a
>> video driver for our presentation".  Really?  You didn't bring your own
>> laptops?  All 5 of you?  Really?  Pass.  Just tell us about your
>> project.  (While they were from a defense division, their company also
>> manufactured laptops - surprising they didn't bring one...).
>
>   Maybe they didn't want the hassle of trying to get one through
> Customs without the data being copied from it? Or the machine itself
> being confiscated.


CSIS (originally when they were a branch of the RCMP) have been giving 
us security briefings every couple years on known threat vectors for 
both our visits overseas and visitors (and employees born in certain 
countries) since the 80's.  These are not theoretical.

I'd bet their laptops were in their rental car or back at the Sheraton.


-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#68336

On Mon, 12 Jan 2015 14:29:12 -0600, Lloyd Parsons <lloydp21@live.com>
wrote:

>On 12 Jan 2015 20:27:17 GMT, Jolly Roger wrote:
>> On 2015-01-12, Kurt Ullman <kurtullman@yahoo.com> wrote:
>>>
>>> Macs vulnerable to virtually undetectable virus that "can't be removed"
>>> Summary:A security researcher has discovered a way to infect Macs with
>>> malware virtually undetectable, that 'can't be removed,' and which can
>>> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>>>
>>> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
>>> rus-that-cant-be-removed/
>>>
>>>    As best I can tell, someone has to get hold of your Mac, open it up
>>> and do something to the thunderbolt adaptor, put everything back
>>> together and then do it to it.
>>>     Seems even to me, to be hardly worth the time or effort and
>>> definitely not going to do any damage for 99.999999999% of us.
>>
>> Sure, it's real. It's also not Mac-specific. The researcher chose Macs
>> for the publicity. To be compromised, you have to allow a stranger to
>> plug a malicious Thunderbolt device into a Thunderbolt port on your
>> computer. This is similarly to the way you can be compromised if you
>> allow someone to plug a malicious USB device into the USB port on your
>> computer. And that's been known for many years now. The same smart
>> computing principle applies: Don't leave your computer where strangers
>> can have unsupervised physical access to it, and don't plug strange
>> USB/Thunderbolt things into your computer. ; )
>>
>IOW, another of those 'proof of concept' thingies with no real impact
>on anyone other than the very stupid.
>
>My guess, it'll never see the light outside the 'lab' he did it in.

 And SF and spy movies, or "Die Hard 27.0.1" where plugging in the USB
device is all the explanation one ever needs for how the bad guys, or
the goodguy hacker can suddenly circumvent all your security with a
singe random keystroke.
 Even if you happen to be an alien mothership whose OS is written in
Alien.
              J. 

[toc] | [prev] | [next] | [standalone]

#68437

Lloyd Parsons <lloydp21@live.com> writes:

> IOW, another of those 'proof of concept' thingies with no real impact
> on anyone other than the very stupid.
> 
> My guess, it'll never see the light outside the 'lab' he did it in.

It was demonstrated at last summer's Defcon.

Is that outside enough for you?

You'd think, by the way, after dealing with Firewire
DMA attacks, Apple would now know better.....

Billy Y..
-- 
        sub     #'9+1   ,r0             ; convert ascii byte
	add     #9.+1   ,r0             ; to an integer
	bcc     20$                     ; not a number

[toc] | [prev] | [next] | [standalone]

#68441

In article <m9921g$3eb$2@reader2.panix.com>, <billy@MIX.COM> wrote:

> > IOW, another of those 'proof of concept' thingies with no real impact
> > on anyone other than the very stupid.
> > 
> > My guess, it'll never see the light outside the 'lab' he did it in.
> 
> It was demonstrated at last summer's Defcon.
> 
> Is that outside enough for you?
> 
> You'd think, by the way, after dealing with Firewire
> DMA attacks, Apple would now know better.....

it's still a complete non-issue. 

the attacker needs physical access to the target computer, at which
point the game is over regardless of what attack he's going to use.

[toc] | [prev] | [next] | [standalone]

#68453

On 15-01-15 14:04, nospam wrote:

> the attacker needs physical access to the target computer, at which
> point the game is over regardless of what attack he's going to use.


Updating EFI is sort of nasty because you can put EFI code that infects
the system disk before it boots.

So no matter how often you format the hard drive and re-install OS-X
from scratch, the minute you boot, EFI will re-install the pathc to
infect it.

There are ways around it at the console level to get EFI to boot from a
different drive where there is an EFI partition with an EFI program that
re-installs the EFI firmware, but that is only once you know your EFI
has been corrupted, and it would take a lot of debugging to get to that
point.

[toc] | [prev] | [next] | [standalone]

#68443

On 2015-01-15, billy@MIX.COM <billy@MIX.COM> wrote:
> Lloyd Parsons <lloydp21@live.com> writes:
>
>> IOW, another of those 'proof of concept' thingies with no real impact
>> on anyone other than the very stupid.
>> 
>> My guess, it'll never see the light outside the 'lab' he did it in.
>
> It was demonstrated at last summer's Defcon.

As similar USB attacks have been demonstrated. 

> Is that outside enough for you?
>
> You'd think, by the way, after dealing with Firewire
> DMA attacks, Apple would now know better.....

Wrong company. The problem is Intel's to fix.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#68446

On 15 Jan 2015 18:48, billy@MIX.COM wrote:
> Lloyd Parsons <lloydp21@live.com> writes:
>
>> IOW, another of those 'proof of concept' thingies with no real impact
>> on anyone other than the very stupid.
>>
>> My guess, it'll never see the light outside the 'lab' he did it in.
>
> It was demonstrated at last summer's Defcon.
>
> Is that outside enough for you?
>
> You'd think, by the way, after dealing with Firewire
> DMA attacks, Apple would now know better.....
>
> Billy Y..

Not even close.  Just another lab setup, just a little different place.
 When/if it ever actually sees the light of day outside of the lab, let
me know.

-- 
Lloyd

[toc] | [prev] | [next] | [standalone]

#68322

On 2015.01.12 14:49 , Kurt Ullman wrote:
> Macs vulnerable to virtually undetectable virus that "can't be removed"
> Summary:A security researcher has discovered a way to infect Macs with
> malware virtually undetectable, that 'can't be removed,' and which can
> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>
> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> rus-that-cant-be-removed/
>
>     As best I can tell, someone has to get hold of your Mac, open it up
> and do something to the thunderbolt adaptor, put everything back
> together and then do it to it.

Then he learned to do it via the TB port directly with a modified 
Ethernet<>Thunderbolt adapter.  No need to open the unit.  The evil-maid 
attack may apply.

Interesting attack though it has a high barrier to entry (needs physical 
access).

I wonder if Apple's mentioned fix can be applied to existing laptops?

-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#68461

On 1/12/15   PDT 1:39 PM, Alan Browne wrote:
> On 2015.01.12 14:49 , Kurt Ullman wrote:
>> Macs vulnerable to virtually undetectable virus that "can't be removed"
>> Summary:A security researcher has discovered a way to infect Macs with
>> malware virtually undetectable, that 'can't be removed,' and which can
>> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>>
>> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
>> rus-that-cant-be-removed/
>>
>>     As best I can tell, someone has to get hold of your Mac, open it up
>> and do something to the thunderbolt adaptor, put everything back
>> together and then do it to it.
>
> Then he learned to do it via the TB port directly with a modified
> Ethernet<>Thunderbolt adapter.  No need to open the unit.  The evil-maid
> attack may apply.
>
> Interesting attack though it has a high barrier to entry (needs physical
> access).
>
> I wonder if Apple's mentioned fix can be applied to existing laptops?
>
OMG! That explains why a harried looking young man came up to me in the 
airport waiting area begging to plug in his thunderbolt drive to my MBP 
in order to see an important text from his GF. (His laptop, iPad and 
iPhone had all just been stolen!!!!!!!!!)

Thank heavens my plane was called for boarding so I missed being owned.

[toc] | [prev] | [next] | [standalone]

#68462

In article <m9a3k0$adb$1@dont-email.me>, John McWilliams
<jpmcw@comcast.net> wrote:
> On 1/12/15   PDT 1:39 PM, Alan Browne wrote:
> > On 2015.01.12 14:49 , Kurt Ullman wrote:
> >> Macs vulnerable to virtually undetectable virus that "can't be removed"
> >> Summary:A security researcher has discovered a way to infect Macs with
> >> malware virtually undetectable, that 'can't be removed,' and which can
> >> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
> >>
> >> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> >> rus-that-cant-be-removed/
> >>
> >>     As best I can tell, someone has to get hold of your Mac, open it up
> >> and do something to the thunderbolt adaptor, put everything back
> >> together and then do it to it.
> >
> > Then he learned to do it via the TB port directly with a modified
> > Ethernet<>Thunderbolt adapter.  No need to open the unit.  The evil-maid
> > attack may apply.
> >
> > Interesting attack though it has a high barrier to entry (needs physical
> > access).
> >
> > I wonder if Apple's mentioned fix can be applied to existing laptops?
> >
> OMG! That explains why a harried looking young man came up to me in the 
> airport waiting area begging to plug in his thunderbolt drive to my MBP 
> in order to see an important text from his GF. (His laptop, iPad and 
> iPhone had all just been stolen!!!!!!!!!)
> 
> Thank heavens my plane was called for boarding so I missed being owned.

Wait until Thunderbolt goes wireless ... the nasty people won't even
need to plug anything into your computer.  ;-)

[toc] | [prev] | [next] | [standalone]

#68463

On 2015.01.15 23:21 , John McWilliams wrote:
> On 1/12/15   PDT 1:39 PM, Alan Browne wrote:
>> On 2015.01.12 14:49 , Kurt Ullman wrote:
>>> Macs vulnerable to virtually undetectable virus that "can't be removed"
>>> Summary:A security researcher has discovered a way to infect Macs with
>>> malware virtually undetectable, that 'can't be removed,' and which can
>>> be installed using a modified Apple gigabit Ethernet Thunderbolt
>>> adapter.
>>>
>>> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
>>>
>>> rus-that-cant-be-removed/
>>>
>>>     As best I can tell, someone has to get hold of your Mac, open it up
>>> and do something to the thunderbolt adaptor, put everything back
>>> together and then do it to it.
>>
>> Then he learned to do it via the TB port directly with a modified
>> Ethernet<>Thunderbolt adapter.  No need to open the unit.  The evil-maid
>> attack may apply.
>>
>> Interesting attack though it has a high barrier to entry (needs physical
>> access).
>>
>> I wonder if Apple's mentioned fix can be applied to existing laptops?
>>
> OMG! That explains why a harried looking young man came up to me in the
> airport waiting area begging to plug in his thunderbolt drive to my MBP
> in order to see an important text from his GF. (His laptop, iPad and
> iPhone had all just been stolen!!!!!!!!!)
>
> Thank heavens my plane was called for boarding so I missed being owned.

If you work for a high tech firm, defense firm, financial firm, energy 
firm and several others and you regularly travel to:

	South Korea
	Japan
	China
	Taiwan
	Russia
	France
	(and several others)

You are a target for espionage.  Not might be.  Not "possibly".  You 
are.  In some it is corporate, in some it is state assisting corporations.

You assume that all phone calls are recorded.  You assume that all 
e-mail and text messages are read.  And you assume that hotel staff will 
be looking for information left in your room.  In most of those 
countries a good opportunity to install spyware on your laptop will be 
taken.  Such evil-maid scenarios are very real.

Any fax received by your hotel (or sent from it) is copied.  (I still 
don't get why people are still using fax!  I laugh whenever I'm asked 
for a fax number).

The above is a major reason why BlackBerry enjoyed a strong and early 
lead in business cell phones.

I also recall using encryption for business e-mails when traveling to 
France when doing so was a criminal offense.  (Merely having the 
encryption software on the laptop was an offense.).

When I told colleagues in France what I was doing (major defense firm) 
they were seriously concerned that I would be arrested (90's).  I took 
that as exaggeration on their part - driven by fear of their own 
government when it came to state security.  Especially the right to spy 
on citizen and visitor alike.

-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#68404

In article <X_KdnRi6G6epuCnJnZ2dnUU7-RednZ2d@earthlink.com>,
 Kurt Ullman <kurtullman@yahoo.com> wrote:

> Macs vulnerable to virtually undetectable virus that "can't be removed"
> Summary:A security researcher has discovered a way to infect Macs with 
> malware virtually undetectable, that 'can't be removed,' and which can 
> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
> 
> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> rus-that-cant-be-removed/
> 
>    As best I can tell, someone has to get hold of your Mac, open it up 
> and do something to the thunderbolt adaptor, put everything back 
> together and then do it to it. 
>     Seems even to me, to be hardly worth the time or effort and 
> definitely not going to do any damage for 99.999999999% of us.

Probably already in use for government espionage.  Hackers won't be far 
behind.

According to mentioned article, the hack is as simple as plugging in a 
modified Thunderbolt device and rebooting the computer.  The computer 
runs ROM code on the Thunderbolt device while booting with no security 
restrictions.  The Thunderbolt device, at that moment, is free to modify 
firmware on your computer.  Another article has mentioned that the hack 
can be extended to spread through other Thunderbolt devices that don't 
protect their onboard firmware.

-- 
I will not see posts from astraweb, theremailer, dizum, or google
because they host Usenet flooders.

[toc] | [prev] | [next] | [standalone]

#68405

In article <mcmurtrie-A2DAE4.00104314012015@news.sonic.net>,
 Kevin McMurtrie <mcmurtrie@pixelmemory.us> wrote:

> In article <X_KdnRi6G6epuCnJnZ2dnUU7-RednZ2d@earthlink.com>,
>  Kurt Ullman <kurtullman@yahoo.com> wrote:
> 
> > Macs vulnerable to virtually undetectable virus that "can't be removed"
> > Summary:A security researcher has discovered a way to infect Macs with 
> > malware virtually undetectable, that 'can't be removed,' and which can 
> > be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
> > 
> > http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> > rus-that-cant-be-removed/
> > 
> >    As best I can tell, someone has to get hold of your Mac, open it up 
> > and do something to the thunderbolt adaptor, put everything back 
> > together and then do it to it. 
> >     Seems even to me, to be hardly worth the time or effort and 
> > definitely not going to do any damage for 99.999999999% of us.
> 
> Probably already in use for government espionage.  Hackers won't be far 
> behind.
> 
> According to mentioned article, the hack is as simple as plugging in a 
> modified Thunderbolt device and rebooting the computer.  The computer 
> runs ROM code on the Thunderbolt device while booting with no security 
> restrictions.  The Thunderbolt device, at that moment, is free to modify 
> firmware on your computer.  Another article has mentioned that the hack 
> can be extended to spread through other Thunderbolt devices that don't 
> protect their onboard firmware.

That's good to know. Lock your firmware!
/Applications/Utilities/Firmware\ Password\ Utility.app
-- 
teleportation kills

[toc] | [prev] | [next] | [standalone]

#68406

android <here@there.was> wrote:

> In article <mcmurtrie-A2DAE4.00104314012015@news.sonic.net>,
>  Kevin McMurtrie <mcmurtrie@pixelmemory.us> wrote:
> 
> > In article <X_KdnRi6G6epuCnJnZ2dnUU7-RednZ2d@earthlink.com>,
> >  Kurt Ullman <kurtullman@yahoo.com> wrote:
> > 
> > > Macs vulnerable to virtually undetectable virus that "can't be removed"
> > > Summary:A security researcher has discovered a way to infect Macs with
> > > malware virtually undetectable, that 'can't be removed,' and which can
> > > be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
> > > 
> > > http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> > > rus-that-cant-be-removed/
> > > 
> > >    As best I can tell, someone has to get hold of your Mac, open it up
> > > and do something to the thunderbolt adaptor, put everything back 
> > > together and then do it to it. 
> > >     Seems even to me, to be hardly worth the time or effort and 
> > > definitely not going to do any damage for 99.999999999% of us.
> > 
> > Probably already in use for government espionage.  Hackers won't be far
> > behind.
> > 
> > According to mentioned article, the hack is as simple as plugging in a
> > modified Thunderbolt device and rebooting the computer.  The computer
> > runs ROM code on the Thunderbolt device while booting with no security
> > restrictions.  The Thunderbolt device, at that moment, is free to modify
> > firmware on your computer.  Another article has mentioned that the hack
> > can be extended to spread through other Thunderbolt devices that don't
> > protect their onboard firmware.
> 
> That's good to know. Lock your firmware!
> /Applications/Utilities/Firmware\ Password\ Utility.app

That won't help. The firmware password prevents someone from booting
from alternative startup volumes (unless they know the password). It
doesn't have anything to do with protecting the firmware from being
modified.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.sys.mac.system

csiph-web