A security researcher speaking at the Chaos Computer Congress in Hamburg demonstrated a hack that rewrites an Intel Mac’s firmware using a Thunderbolt device with attack code in an option ROM, reports 9to5Mac (www.9to5Mac.com).
Known as “Thunderstrike,” the proof of concept (http://tinyurl.com/nla6jqt), infects the Apple Extensible Firmware Interface (EFI) in a way he claims can’t be detected, nor removed by reinstalling Mac OS X. According to researcher Trammel Hudson, it’s a “a vulnerability that allows the installation of persistent firmware modifications into the EFI boot ROM of Apple’s popular MacBooks. The bootkit can be easily installed by an evil-maid via the externally accessible Thunderbolt ports and can survive reinstallation of OSX as well as hard drive replacements. Once installed, it can prevent software attempts to remove it and could spread virally across air-gaps by infecting additional Thunderbolt devices.”
Apple has already implemented an intended fix in the latest Mac mini and iMac with Retina display. Hudson says it will soon be available for other Macs, but appears to provide only partial protection.