Apple Laptops Vulnerable To Battery Firmware Hack

[JDay]

https://threatpost.com/en_us/blogs/apple-laptop-batteries-can-be-bricked-firmware-hacked-072211

Security researcher Charlie Miller, widely known for his work on Mac OS X and Apple's iOS, has discovered an interesting method that enables him to completely disable the batteries on Apple laptops, making them permanently unusable, and perform a number of other unintended actions. The method, which involves accessing and sending instructions to the chip housed on smart batteries could also be used for more malicious purposes down the road.

The basis of Miller's research, which he plans to present at the Black Hat conference in Las Vegas next month, is the battery that's used in most Apple laptops. The battery, like many others in modern laptops, has a chip on it that contains instructions for how the battery is meant to behave and interact with the operating system and other components. Inspired by Barnaby Jack's ATM hacking talk at last year's conference, Miller was interested in seeing what would happen if he could get access to the chip and start messing with the instruction set and firmware.

A lot, as it turns out.

Apple is terrible when it comes to security.

[WTSGDYBBR]

It will be the next big hack as well now that everyone knows about it.

[Librarian]

Is there a purpose to your monotonic reports on Apple products?

I'll grant there are 'fanbois' who overstate the wonders.

But like guns, if you don't want one, don't buy one.

[MontClaire]

My macbooks have never caught a virus where my home pc is always in and out of coma. I'd say apple is pretty good with security. you only hate apple cause you can't afford one......

[JDay]

Is there a purpose to your monotonic reports on Apple products?

I'll grant there are 'fanbois' who overstate the wonders.

But like guns, if you don't want one, don't buy one.

Well considering how this is a new exploit I would say this news in relevant in here.

My macbooks have never caught a virus where my home pc is always in and out of coma. I'd say apple is pretty good with security. you only hate apple cause you can't afford one......

That's because virus writers for the most part do not care about an OS that has very little market share. However, MacOS is always the first to fall at hacking contests, it's security is a joke compared to the security in current versions of Windows. Most Windows infections are also due to user ignorance/stupidity, many people just click OK on every popup without thinking about it. And I can more than afford a MacBook Pro, however I decided to go with something that is more functional than shiny and put the rest of my money into upgrades such as a SSD, travel charger set, Ultrabay HDD (replaced my optical drive with the stock hard drive) and used the money I saved on ammo. I also do not have to worry about getting burnt by my laptop, unlike the MacBook line which are known for getting quite hot. Just because something is expensive doesn't mean it is a good value.

[Librarian]

Well considering how this is a new exploit I would say this news in relevant in here.



That's because virus writers for the most part do not care about an OS that has very little market share. However, MacOS is always the first to fall at hacking contests, it's security is a joke compared to the security in current versions of Windows. Most Windows infections are also due to user ignorance/stupidity, many people just click OK on every popup without thinking about it. And I can more than afford a MacBook Pro, however I decided to go with something that is more functional than shiny and put the rest of my money into upgrades such as a SSD, travel charger set, Ultrabay HDD (replaced my optical drive with the stock hard drive) and used the money I saved on ammo. I also do not have to worry about getting burnt by my laptop, unlike the MacBook line which are known for getting quite hot. Just because something is expensive doesn't mean it is a good value.

I quite agree. Nor does low cost mean that the product is a bargain.

No, my question was more why it's always negative (or, since I have not read all your posts, it seems to be so in the ones I have read). In the other thread where you just posted a table of lenovo vs mac prices and features, that was a genuine service, and answered the question posed. If macs come off second best, well, there we are.

It just seems like you actually care, when it's just hardware and money, no more important than the Glock/1911, 9mm/.45 discussions.

[JDay]

No, my question was more why it's always negative (or, since I have not read all your posts, it seems to be so in the ones I have read).

I have posted about non-Apple vulnerabilities in the past.

[ocabj]

No, my question was more why it's always negative

I thought I was the only one that noticed this.

[Rhythm of Life]

I quite agree. Nor does low cost mean that the product is a bargain.

No, my question was more why it's always negative (or, since I have not read all your posts, it seems to be so in the ones I have read). In the other thread where you just posted a table of lenovo vs mac prices and features, that was a genuine service, and answered the question posed. If macs come off second best, well, there we are.

It just seems like you actually care, when it's just hardware and money, no more important than the Glock/1911, 9mm/.45 discussions.

What are the pro's?

Over priced?
Under performing?
Limited software available?
Minimal customization available?

If you dual boot OK but most MAC users don't even know what that is.

______

In my mind buying a MAC is like paying $50 for a 6oz beef round and throwing half away.

[Librarian]

What are the pro's?


In my mind buying a MAC is like paying $50 for a 6oz beef round and throwing half away.

Who cares? I'm not trying to persuade anyone to buy anything.

And of course, if you feel that way, you won't buy one, and I'm OK with that. It's your money.

[badfish2]

I don't own a mac, but I did notice the other day that mac os upgrades only cost about $30 :-/

[r3dn3ck]

oh good... so someone can brick the battery if they have PHYSICAL ACCESS to my laptop. Yay! You know that that means exactly NOTHING. 1, I'm fully capable of bricking the thing on my own far easier and 2, honestly that's not a righteous hack as it's missing a key component. First off you're still missing a usable exploit at the OS level that would allow you to use the battery hack so the whole point is FAIL. Just because it's got a "chip" in it and some dude figures out that he can use said chip all the techknownothings crawl out of the woodwork in panic mode.

As for security, mac's got PC beat by a mile and if you don't know why, that sorta frames the rest of the discussion.

[Ralgha]

Actually Macs don't beat PCs at security at all, they're simply not popular with the malware crowd because their market share is so low.

One of Mac's biggest vulnerabilities is that their users think they're more secure.

[JDay]

oh good... so someone can brick the battery if they have PHYSICAL ACCESS to my laptop. Yay! You know that that means exactly NOTHING. 1, I'm fully capable of bricking the thing on my own far easier and 2, honestly that's not a righteous hack as it's missing a key component. First off you're still missing a usable exploit at the OS level that would allow you to use the battery hack so the whole point is FAIL. Just because it's got a "chip" in it and some dude figures out that he can use said chip all the techknownothings crawl out of the woodwork in panic mode.

As for security, mac's got PC beat by a mile and if you don't know why, that sorta frames the rest of the discussion.

No physical access required, if you would read the article you would see that this can be implemented in malware. He accessed the firmware the same way that an update from Apple would, i.e. through the OS.

[Librarian]

No physical access required, if you would read the article you would see that this can be implemented in malware. He accessed the firmware the same way that an update from Apple would, i.e. through the OS.

Some other article may say that, but the one linked does not. One commenter asks about that, because the access method was not clear; another replies

The article clearly states Apple has sent patches to the battery in the past. In other words, physical access is not required.

but this article is silent. I'll suggest that getting an Apple user to install such a battery patch would require social engineering or compromising Apple's update system - and we've already established that social engineering is not an Apple-specific problem.

One thing the article DOES say is

the battery that's used in most Apple laptops. The battery, like many others in modern laptops, has a chip on it that contains instructions for how the battery is meant to behave and interact with the operating system and other components.

which says to me this vulnerability is not necessarily restricted to Apple products - it may be present for other 'modern laptops'.

Perhaps there is a more detailed article available.