“Thunderstrike 2” rootkit uses Thunderbolt accessories to infect Mac firmware

World’s first (known) bootkit for OS X can permanently backdoor Macs        Thunderstrike allows anyone with even brief ac...

World’s first (known) bootkit for OS X can permanently backdoor Macs

       Thunderstrike allows anyone with even brief access to install stealthy malware.

Earlier this year, security engineer Trammell Hudson developed and showed off a proof-of-concept firmware called Thunderstrike. The malware could hitch a ride on Thunderbolt-connected accessories that used Option ROMs and infect any Mac it was connected to at boot. The infected Mac could then pass the malware to other accessories, which could infect other computers.
Apple (mostly) patched this exploit in OS X version 10.10.2 back in January, but Wired reports that Hudson and LegbaCore security researcher Xeno Kovah have developed a sequel.
Dubbed "Thunderstrike 2," the new proof-of-concept attack still spreads primarily through infected Thunderbolt accessories. But where the original Thunderstrike required a malicious user to have physical access to your computer to work—something sometimes referred to as an "evil maid" attack, though an evil butler could probably do the same job—the new one can be spread remotely. The malware can be delivered "via a phishing e-mail and malicious Web site," and once downloaded it can infect connected accessories that use Option ROM (Apple's Thunderbolt-to-gigabit-Ethernet accessory is a commonly cited example). Once the accessory is infected, the malware can spread to any Mac that you plug the accessory into.
The danger of firmware-level malware is that most virus scanners and other anti-malware products focus on RAM and files stored on the desk. It's difficult to detect in the first place, and it's difficult to track it back to its source. It's also tough to remove. "You can't use Thunderstrike to remove Thunderstrike" because the infected firmware patches the security hole in the original firmware.
Many of the security vulnerabilities that make Thunderstrike 2 possible are common to most EFI firmware. Researchers discovered a total of six vulnerabilities that affected PCs from Dell, HP, Lenovo, Samsung, and others. Of those, five also applied to the Mac's firmware, and of those, Apple has fully patched one, partially patched another, and failed to patch three more.
Apple has been alerted to the new vulnerabilities and will hopefully patch them using new OS X versions, new firmware updates for Thunderbolt-equipped Macs, or both. All Macs that ship with a Thunderbolt port (the bulk of new Macs introduced since 2011, with a handful of exceptions) are theoretically vulnerable to infection.


Wired, Ars Technica