It’s Black Hat season, meaning that we are getting a new batch of zero-day exploits showing how insecure our gadgets are. Xeno Kovah and Trammell Hudson found a serious zero-day vulnerability in OS X letting malware creators completely brick your Mac without any way to reset it to its factory status. Apple told The Guardian that it is working on a fix for both Yosemite and El Capitan.
This zero-day exploit dubbed Thunderstrike 2 targets your Mac’s firmware thanks to an attached Thunderbolt accessory, such as an Ethernet adaptor or an external hard drive. After receiving the code via a phishing email or a malicious web site, malware code could look for connected Thunderbolt accessories and flash their option ROMs.
If you reboot your Mac with this infected Thunderbolt accessory plugged in, the EFI will execute the option ROM before booting OS X. As this option ROM has been infected, it will execute malicious code infecting the EFI itself. For example, it could simply make your Mac’s firmware refuse to boot OS X, turning your Mac into a useless machine. And if your firmware is compromised, there is no way to boot OS X, update the firmware and remove the malicious code.
The best part of this zero-day vulnerability is that your Thunderbolt accessory remains infected. If you plug your Ethernet adaptor into a new Mac, this Mac will get infected as well when it reboots. It’s not as harmful as malware that spreads through the Internet, but it could make some serious damage in an office environment for example.
Stefan Esser found another exploit last month dubbed DYLD. This time it lets malicious developers gain root privilege. It could be used to format your hard drive, but also for more lucrative exploits.
Malwarebytes already spotted an adware creator who uses this zero-day vulnerability to get root permission and then execute a script to install a bunch of applications — the VSearch adware, the Genieo adware and the MacKeeper junkware. It also makes the Mac App Store unusable at it will endlessly prompt you to install Download Shuttle.
Apple already fixed DYLD in El Capitan’s beta but not in the current Yosemite version. It has also added applications using these exploits to its malware blacklist, but it’s just a temporary cat-and-mouse fix. The company will issue security patches for both OS X Yosemite and OS X El Capitan beta. In the mean time, be careful when you download something and unplug all your Thunderbolt devices before rebooting your Mac — just in case.