Thunderstrike 2 Mac Malware and other serious Apple exploits: how to effectively check?

Question

As lowendmac in February 2018 reported, the Thunderstrike Mac Malware had been patched in 10.10.2, but it effectively has to be checked as some users and Macbook (Pro) models "never had the protective EFI updates installed". I am wondering which other best-practices are there to check for EFI infection and other Malware on OSX.

I am specifically searching for self-verifiable things (not third party program), such as lists of known malware, EFI checksums and shell scripts.

Is there actually some USB-ISO to test if the EFI is okay?

Answer 1

There are several tools available from Howard Oakley’s site that I would recommend that you look at.

SilentKnight – a new generation with fully automatic security checks

[C]heck whether your Mac is up to date automatically. Checks EFI firmware, security settings and data files, and has both a summary Help page and a detailed reference. Update handles firmware checks in Sierra more leniently now it is unsupported.

silnite – a command tool which performs the same checks as SilentKnight

If you’re managing Macs on a network, this is an invaluable way of checking EFI firmware, security settings including SIP and FileVault, and security data file updates. A choice of two levels of detail, which can include checks against my database of current versions, and reports to stdout in either text or JSONised XML. Can also download and install waiting updates. Update improves firmware checking.

LockRattler – a quick check of your security systems

LockRattler checks your Mac’s basic security systems are active, reports version numbers of security configuration files which are active, the latest updates installed, and makes it easy to check for and install updates. Ideal for checking that SIP is enabled, and it has Apple’s latest silent security updates.

Those three tools can be found at https://eclecticlight.co/lockrattler-systhist/.

All are available for free.

He has other free tools which can all be found linked to https://eclecticlight.co/downloads/.

I realize these are 3rd-party tools, but they are also the best ways that I know of to actual accomplish your goal of checking to make sure things are up-to-date.

Answer 2

It's not clear what you are wanting that the origianal article and it's links don't already provide.

I am specifically searching for self-verifiable things (not third party program), such as lists of known malware, EFI checksums and shell scripts.

Known Malware.

There isn't any.

To the best of our knowledge there are no Mac firmware bootkits in the wild and Thunderstrike is only a proof-of-concept that does not have any malicious payload.

EFI Checksums

Any checksums, to be of any use must come from Apple. Would you trust it from another source (even from this site which is quite reliable)? Apple doesn't post checksums on their download page:

As you can see, there's no checksum details. So, to be certain that you're getting genuine Apple firmware, download it directly from Apple.

Self Verifiable Things

Update your macOS

The easiest way to ensure you have the latest firmware is to keep macOS **updated! The update will automatically download and install the latest firmware.

Tests

• Since this was only a Proof of Concept threat and was fixed by Apple in the 2015-001 Security Update, there's nothing to test for.

• High Sierra actually tests your Firmware weekly already.

Bottom Line

This was a threat that was discovered and patched in 2015. There's no known uses of this exploit in the wild and the best prevention is keeping your Mac updated.