Apple’s upcoming OS X 10.10.2 update for Mac will reportedly contain a fix for the so-called “Thunderstrike” hardware exploit targeting Thunderbolt equipped Macs. iMore reports Apple will fix the security hole in order to prevent the Mac’s bootrom being replaced or rolled back to a state in which it could be attacked.
To secure against Thunderstrike, Apple had to change the code to not only prevent the Mac’s boot ROM from being replaced, but also to prevent it from being rolled back to a state where the attack would be possible again. According to people with access to the latest beta of OS X 10.10.2 who are familiar with Thunderstrike and how it works, that’s exactly the deep, layered process that’s been completed.
Thunderstrike was discovered earlier this year by security researcher Trammell Hudson. The serious vulnerability allows an attacker to replace a Mac’s bootrom with malicious code without a user’s knowledge.
No public instances of the attack have been found, and any such attack would be limited in scope as the attack requires physical access to a Mac, or requires the social engineering skills to trick a user into attacking their own Mac.
Apple’s latest Macs, including the iMac with 5K Retina Display and the new Mac mini, are already protected against the attack.
Apple’s OS X 10.10.2 update has been in beta testing for over two months, with the most recent beta seed being made available to developers last Wednesday. The update should soon be made available to the public.
(Via MacRumors)
