Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #68314 > unrolled thread

Is this real

Back to article view | Back to comp.sys.mac.system

Contents

  Is this real Kurt Ullman <kurtullman@yahoo.com> - 2015-01-12 14:49 -0500
    Re: Is this real Barry Margolin <barmar@alum.mit.edu> - 2015-01-12 15:26 -0500
    Re: Is this real Jolly Roger <jollyroger@pobox.com> - 2015-01-12 20:27 +0000
      Re: Is this real Lloyd Parsons <lloydp21@live.com> - 2015-01-12 14:29 -0600
        Re: Is this real Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-01-12 16:52 -0500
          Re: Is this real John <Man@the.keyboard> - 2015-01-13 06:29 +0000
            Re: Is this real Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-01-15 15:11 -0500
        Re: Is this real John <Man@the.keyboard> - 2015-01-13 06:27 +0000
        Re: Is this real billy@MIX.COM - 2015-01-15 18:48 +0000
          Re: Is this real nospam <nospam@nospam.invalid> - 2015-01-15 14:04 -0500
            Re: Is this real JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-01-15 16:58 -0500
          Re: Is this real Jolly Roger <jollyroger@pobox.com> - 2015-01-15 19:22 +0000
          Re: Is this real Lloyd Parsons <lloydp21@live.com> - 2015-01-15 13:34 -0600
    Re: Is this real Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-01-12 16:39 -0500
      Re: Is this real John McWilliams <jpmcw@comcast.net> - 2015-01-15 20:21 -0800
        Re: Is this real Your Name <YourName@YourISP.com> - 2015-01-16 18:26 +1300
        Re: Is this real Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-01-16 09:19 -0500
    Re: Is this real Kevin McMurtrie <mcmurtrie@pixelmemory.us> - 2015-01-14 00:10 -0800
      Re: Is this real android <here@there.was> - 2015-01-14 11:09 +0100
        Re: Is this real dempson@actrix.gen.nz (David Empson) - 2015-01-15 00:54 +1300
      Re: Is this real Jolly Roger <jollyroger@pobox.com> - 2015-01-14 14:53 +0000
    Thunderstrike "malware" (was Re: Is this real) Your Name <YourName@YourISP.com> - 2015-01-15 18:33 +1300
    Re: Is this real Jolly Roger <jollyroger@pobox.com> - 2015-01-24 15:53 +0000

Page 2 of 2 — ← Prev page 1 [2]

#68411

On 2015-01-14, Kevin McMurtrie <mcmurtrie@pixelmemory.us> wrote:
> In article <X_KdnRi6G6epuCnJnZ2dnUU7-RednZ2d@earthlink.com>,
>  Kurt Ullman <kurtullman@yahoo.com> wrote:
>
>> Macs vulnerable to virtually undetectable virus that "can't be removed"
>> Summary:A security researcher has discovered a way to infect Macs with 
>> malware virtually undetectable, that 'can't be removed,' and which can 
>> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>> 
>> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
>> rus-that-cant-be-removed/
>> 
>>    As best I can tell, someone has to get hold of your Mac, open it up 
>> and do something to the thunderbolt adaptor, put everything back 
>> together and then do it to it. 
>>     Seems even to me, to be hardly worth the time or effort and 
>> definitely not going to do any damage for 99.999999999% of us.
>
> Probably already in use for government espionage.  Hackers won't be far 
> behind.
>
> According to mentioned article, the hack is as simple as plugging in a 
> modified Thunderbolt device and rebooting the computer.  The computer 
> runs ROM code on the Thunderbolt device while booting with no security 
> restrictions.  The Thunderbolt device, at that moment, is free to modify 
> firmware on your computer.  Another article has mentioned that the hack 
> can be extended to spread through other Thunderbolt devices that don't 
> protect their onboard firmware.

My gosh!! Next they'll do the same for USB devices! Oh, wait...

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#68423 — Thunderstrike "malware" (was Re: Is this real)

In article <X_KdnRi6G6epuCnJnZ2dnUU7-RednZ2d@earthlink.com>, Kurt
Ullman <kurtullman@yahoo.com> wrote:
> 
> Macs vulnerable to virtually undetectable virus that "can't be removed"
> Summary:A security researcher has discovered a way to infect Macs with 
> malware virtually undetectable, that 'can't be removed,' and which can 
> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
> 
> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> rus-that-cant-be-removed/
> 
>    As best I can tell, someone has to get hold of your Mac, open it up 
> and do something to the thunderbolt adaptor, put everything back 
> together and then do it to it. 
>     Seems even to me, to be hardly worth the time or effort and 
> definitely not going to do any damage for 99.999999999% of us.


Yet another storm in a thimble that no Mac user with any sense will
ever get on their computer ...


    Why you shouldn't panic about Thunderstrike Mac virus
    -----------------------------------------------------
    Heard of the "undetectable, unremovable" Mac rootkit? 
    This is why you don't need to worry.

    Scare stories about a vulnerability in Mac OS X that 
    can be used to deliver undetectable, unremovable
    malware to your computer have started doing the rounds
    today, but if you're a Mac user, there's no reason to
    start quaking at your keyboard just yet.

    First things first, Thunderstrike is a real, and 
    potentially serious vulnerability. Discovered by 
    programmer and researcher Trammell Hudson, the 
    vulnerability in the Mac's ROM could allow a hacker to
    launch malware on the computer and completely avoid 
    detection by any security software.

    But there's one important proviso - the attacker 
    needs to physically get their hands on your computer
    first.

    Most vulnerabilities are executed remotely by an 
    attacker who could be sat over the other side of the 
    world from their victim making use of a hole in the
    computer's software (including its operating system).
    However, because these attacks are software based, 
    they can be thwarted once the vulnerability been 
    detected.

    In memory attacks, like Thunderstrike, are more 
    difficult to detect, avoid and mitigate because they 
    make use of vulnerabilities in the way the hardware
    works. But because they require real-world contact 
    with the device, they're also harder to carry out.

    That's not to say such an attack has never happened,
    though. It's thought the Stuxnet worm, which shut
    down Iran's nuclear power stations by making their
    Siemens centrifuges spin out of control, was 
    introduced by infected USB, as the computers in the
    facilities were not connected to any public network.

    In the end, it's unlikely you will fall victim to 
    such a complex attack, but that's not to say you 
    should be reckless with your devices. "While it is 
    unlikely that an 'evil maid' will fiddle with your
    machine while you're in the hotel lobby, it's 
    entirely open to plain old theft or accidental 
    damage which I'd be more concerned about," Chris 
    Boyd, malware intelligence analyst at security firm
    Malwarebytes told PC Pro.

    "As with so many causes of infection, good 
    old-fashioned user awareness will help head off this
    threat and prevent someone dongling around your Mac
    ports," he added.


    This article originally appeared at pcpro.co.uk
<http://www.pcpro.co.uk/security/1000277/why-you-shouldnt-panic-about-th
understrike-mac-virus>

[toc] | [prev] | [next] | [standalone]

#68866

On 2015-01-12, Kurt Ullman <kurtullman@yahoo.com> wrote:
>
> Macs vulnerable to virtually undetectable virus that "can't be removed"
> Summary:A security researcher has discovered a way to infect Macs with 
> malware virtually undetectable, that 'can't be removed,' and which can 
> be installed using a modified Apple gigabit Ethernet Thunderbolt adapter.
>
> http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable-vi
> rus-that-cant-be-removed/
>
>    As best I can tell, someone has to get hold of your Mac, open it up 
> and do something to the thunderbolt adaptor, put everything back 
> together and then do it to it. 
>     Seems even to me, to be hardly worth the time or effort and 
> definitely not going to do any damage for 99.999999999% of us.

So much for that:

<http://www.imore.com/thunderstrike-attack-also-fixed-os-x-10102>

The Thunderstrike haters will have to move on to something else to
giggle about now. Maybe they can jump on the BadUSB bandwagon instead:

<http://www.inferse.com/18282/usb-badusb-vulnerability-next-hacker-frontier/>

: )

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.sys.mac.system

csiph-web