0

As lowendmac in February 2018 reported, the Thunderstrike Mac Malware had been patched in 10.10.2, but it effectively has to be checked as some users and Macbook (Pro) models "never had the protective EFI updates installed". I am wondering which other best-practices are there to check for EFI infection and other Malware on OSX.

I am specifically searching for self-verifiable things (not third party program), such as lists of known malware, EFI checksums and shell scripts.

Is there actually some USB-ISO to test if the EFI is okay?

  • What is a USB-ISO? – Allan Feb 21 at 12:53
  • Sorry if this was not entirely clear: i wanted to know if there are open source tools which i could use to verify the apple EFI, firmware and other information on different Apple machines (similar to the software that 'Apple Authorized Service Providers' are using, but that is open source). – kub7 Feb 21 at 13:49
1

There are several tools available from Howard Oakley’s site that I would recommend that you look at.

SilentKnight – a new generation with fully automatic security checks

[C]heck whether your Mac is up to date automatically. Checks EFI firmware, security settings and data files, and has both a summary Help page and a detailed reference. Update handles firmware checks in Sierra more leniently now it is unsupported.

silnite – a command tool which performs the same checks as SilentKnight

If you’re managing Macs on a network, this is an invaluable way of checking EFI firmware, security settings including SIP and FileVault, and security data file updates. A choice of two levels of detail, which can include checks against my database of current versions, and reports to stdout in either text or JSONised XML. Can also download and install waiting updates. Update improves firmware checking.

LockRattler – a quick check of your security systems

LockRattler checks your Mac’s basic security systems are active, reports version numbers of security configuration files which are active, the latest updates installed, and makes it easy to check for and install updates. Ideal for checking that SIP is enabled, and it has Apple’s latest silent security updates.

Those three tools can be found at https://eclecticlight.co/lockrattler-systhist/.

All are available for free.

He has other free tools which can all be found linked to https://eclecticlight.co/downloads/.

I realize these are 3rd-party tools, but they are also the best ways that I know of to actual accomplish your goal of checking to make sure things are up-to-date.

  • This is amazing! Thank you very much for these, exactly what i was searching for. I hope to get more input, as this helps me learn about the internals of the Macbook/Pros. – kub7 Feb 21 at 16:24
  • Thanks again for these great apps, i tested them all in the meanwhile and i can suggest to use LockRattler and SilentKnight for diagnosis. Especially old (and thus unpatched) EFI versions can be found this way. – kub7 Feb 21 at 19:52
  • Glad to help! 👍 – TJ Luoma Feb 22 at 6:50
0

It's not clear what you are wanting that the origianal article and it's links don't already provide.

I am specifically searching for self-verifiable things (not third party program), such as lists of known malware, EFI checksums and shell scripts.


Known Malware.

There isn't any.

To the best of our knowledge there are no Mac firmware bootkits in the wild and Thunderstrike is only a proof-of-concept that does not have any malicious payload.


EFI Checksums

Any checksums, to be of any use must come from Apple. Would you trust it from another source (even from this site which is quite reliable)? Apple doesn't post checksums on their download page:

MacPro Firmware Download Page

As you can see, there's no checksum details. So, to be certain that you're getting genuine Apple firmware, download it directly from Apple.

Self Verifiable Things

Update your macOS

The easiest way to ensure you have the latest firmware is to keep macOS **updated! The update will automatically download and install the latest firmware.

Tests

  • Since this was only a Proof of Concept threat and was fixed by Apple in the 2015-001 Security Update, there's nothing to test for.

  • High Sierra actually tests your Firmware weekly already.

Bottom Line

This was a threat that was discovered and patched in 2015. There's no known uses of this exploit in the wild and the best prevention is keeping your Mac updated.

  • Thanks for the great response! As stated in the article: there are various machines which have not been patched, so this was the intention of my question, as I (and my whole family as well) have various older Apple Macbooks, Airs and Pros. So I wanted to know if there is a way of (for example) flashing the EFI to the 'official' version. – kub7 Feb 21 at 13:46
  • Yes. There are two ways: update your macOS or manually download the firmware. As to your other comment, why are you looking for 3rd party (even though you didn't want 3rd party) open source tools? What does "open source" bring to the table that Apple and/or other "3rd parties" don't? I think you're over complicating things. – Allan Feb 21 at 13:55
  • I am searching for a verifiable and documented way on making sure the Apple computers from me and my family are not compromised. We are all traveling a lot: China, US, India, etc. With '3rd party tools' i meant all sorts of 'click and forget' tools, which i don't trust. Newer T2 based Apples have Secure Boot, but i am asking for older models (pre-2015), in times where the firmware could have been easily modified. References: arstechnica, securityaffairs, laptopmag, etc. – kub7 Feb 21 at 14:20
  • I don't know what else to tell you. You're asking for things that don't exist - in this case tests for a threat that never materialized. Apple has a documented and verified way to prevent this, but if I understand you correctly, you've chosen not to implement any of this for the last 5 years. For the record, anyone who creates something other than the original mfg, open source or not, is 3rd party. Help me understand how to communicate that you need to keep your computers updated. – Allan Feb 21 at 14:31
  • I am quoting arstechnica here: "An alarming number of Macs remain vulnerable to known exploits that completely undermine their security and are almost impossible to detect or fix even after receiving all security updates available from Apple, a comprehensive study released Friday has concluded." - so how does 'keeping computers updated' change anything? Or am i misunderstanding something? – kub7 Feb 21 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .