Major vulnerability in Apple T2 security chips - Page 1
Forum section: electronics / general

author: Halcyon
author_rank: Unknown
timestamp: October 07, 2020, 08:14:57 am
content: https://ironpeak.be/blog/crouching-t2-hidden-danger/Ouch

author: I wanted a rude username
author_rank: Frequent Contributor
timestamp: October 07, 2020, 08:26:53 am
content: So ... a system intended to make Apple PCs more secure, made them less secure?Louis Rossman weighs in:

author: Halcyon
author_rank: Unknown
timestamp: October 07, 2020, 11:25:42 am
content: Quote from: I wanted a rude username on October 07, 2020, 08:26:53 amApple only give a token regard to security when it comes to the bulk of its users. It's "good enough" for the average consumer. For example, anything running iOS has been vulnerable (from a general perspective) for years, provided you can get your hands on the physical device; Cracking a PIN and downloading its entire contents is rather trivial. If you are serious about security, you wouldn't be using an Apple product.

author: Mr. Scram
author_rank: Super Contributor
timestamp: October 07, 2020, 12:31:43 pm
content: Quote from: Halcyon on October 07, 2020, 11:25:42 amWhat would you use?

author: Cerebus
author_rank: Super Contributor
timestamp: October 07, 2020, 08:06:43 pm
content: Quote from: Halcyon on October 07, 2020, 08:14:57 amSo what actually is this "Major vulnerability"? The page you link to rambles on saying things like "The mini operating system on the T2 (SepOS) suffers from a security vulnerable also found in the iPhone 7 since it contains a processor based on the iOS A10." but it doesn't actually say what the vulnerability is, it doesn't even say what class of vulnerability it belongs to.The general tenor of that webpage doesn't look like it's been written by grown-ups. e.g. lines like "Be angry at news websites & Apple for not covering this issue, despite attempts from me and others to get them to report this matter."Generally with this sort of thing you at least expect to see the names of the researchers responsible, usually with affiliations, not a list of Twitter handles and nothing else.I'd want to see something a little more cogent than this before concluding that there's anything to worry about here.

author: Halcyon
author_rank: Unknown
timestamp: October 07, 2020, 09:32:41 pm
content: Quote from: Mr. Scram on October 07, 2020, 12:31:43 pmHonestly, in terms of the mobile phones, the ones I have the most issues with are the more obscure or unpopular brands. There is no one brand which will be completely impenetrable (including the old Blackberry devices, contrary to popular belief), but I've had certain models of LG running their weird version of Android that I haven't been able to get an extraction out of (without resorting to hardware-based teardown methods). Some of those re-branded candybar phones like ZTE are also a pain (especially if the flash is encrypted by default).On the flip-side, Apple and Samsung arevery well"supported" in the digital forensics community (because they are so popular and a lot of R&D money goes into reverse engineering them).Security of data is multi-faceted -- Not one thing will keep you secure. It's a combination of efforts. Using strong, unique passwords for each device/service will give you a good head start.

author: SilverSolder
author_rank: Super Contributor
timestamp: October 07, 2020, 11:27:06 pm
content: Security through obscurity is supposed to be a "bad thing"... but I agree, if you use uncommon products that you just know someone is going to have to spend blood, sweat, and tears to figure out, they might decide to spy on someone else with a more popular device first!

author: andersm
author_rank: Super Contributor
timestamp: October 08, 2020, 12:49:06 am
content: Quote from: Cerebus on October 07, 2020, 08:06:43 pmCode injection in the T2 coprocessor, which in turn allows injecting code into the main processor. The exploit is done via USB DFU mode and requires physical access, so the real-world risk is maybe not so dramatic.

author: SilverSolder
author_rank: Super Contributor
timestamp: October 08, 2020, 03:04:27 am
content: Quote from: andersm on October 08, 2020, 12:49:06 amBad guys can leave compromised USB sticks, flash drives etc. around, ready to be picked up by unsuspecting users thinking they made a lucky find...

author: Halcyon
author_rank: Unknown
timestamp: October 08, 2020, 05:53:47 am
content: Quote from: andersm on October 08, 2020, 12:49:06 amThis is true, in real-world terms, the impact is likely to be minimal (how often does a regular user boot off a USB drive anyway?). However what will be interesting will be the tools and methods which will be developed to exploit DFU mode for cyber security, digital forensics, law enforcement and national security organisations. Currently, the only way you can get data from a T2-based Mac is by either knowing the password or using some kind of attack/brute force to discover the password.

author: Cerebus
author_rank: Super Contributor
timestamp: October 08, 2020, 02:24:07 pm
content: Quote from: SilverSolder on October 08, 2020, 03:04:27 amBooting from a USB stick != running device in USB DFU mode. First the device has to be explicitly put into DFU mode, then you need to have an active host device connected to it to run the host side of DFU.

author: Marco
author_rank: Super Contributor
timestamp: October 08, 2020, 02:39:12 pm
content: Every one of Intel's ring minus X has been broken too, it's not a big deal. Just a question of physical security.

author: Mr. Scram
author_rank: Super Contributor
timestamp: October 09, 2020, 07:22:37 pm
content: Quote from: Halcyon on October 07, 2020, 09:32:41 pmNow I know what you won't use, but still not really what you would or actually do. What's your daily driver, for instance?

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: October 09, 2020, 11:03:10 pm
content: Quote from: Mr. Scram on October 09, 2020, 07:22:37 pmI'm guessing Maxwell Smart shoe phone.

author: Bud
author_rank: Super Contributor
timestamp: October 09, 2020, 11:15:05 pm
content: Quote from: SilverSolder on October 08, 2020, 03:04:27 amNot only USB sticks can be left. Phones themselves can be left. They also can be given as "gifts", given away or lended.

author: Mr. Scram
author_rank: Super Contributor
timestamp: October 09, 2020, 11:32:04 pm
content: Who says the supply chain wasn't compromised somewhere and your phone or computer was delivered to you brand new and already compromised? It could be the manufacturer or one of its many subcontractorsvand suppliers, the seller, shipper or a number of others. We've seen real life examples of all of the above.

author: Halcyon
author_rank: Unknown
timestamp: October 09, 2020, 11:56:42 pm
content: Quote from: Mr. Scram on October 09, 2020, 07:22:37 pmMy daily driver is actually still a Samsung Galaxy S8. With secure start enabled and a strong password, it's still extremely secure.