Unpatched vulnerability found in Apple T2 Security Chip.
Your MacBook is not Safe?
Apple T2 Security Chip Unpatchable Vulnerability to an exploit that could allow a hacker to gain access from your Macbook disk encryption, firmware passwords and whole T2 security verification chain, as per security researchers said.
What is T2 Chip?
The Apple T2 Security Chip is Apple’s second-generation, custom silicon for Mac. By redesigning and integrating several controllers found in other Mac computers—such as the System Management Controller, image signal processor, audio controller, and SSD controller—the T2 chip delivers new capabilities to your Mac.
For example, the T2 chip enables a new level of security by including a secure enclave coprocessor that secures Touch ID data and provides the foundation for new encrypted storage and secure boot capabilities. And the T2 chip’s image signal processor works with the FaceTime HD camera to enable enhanced tone mapping, improved exposure control, and face-detection–based autoexposure and auto white balance.
What is the security issue?
According to iron peak, the mini operating system on the T2 (SepOS) suffers from a security vulnerable also found in the iPhone 7 since it contains a processor based on the iOS A10.
So using the checkm8 exploit originally made for iPhones, the checkra1n exploit was developed to build a semi-tethered exploit for the T2 security chip, exploiting a flaw. This could be used to e.g. circumvent activation lock, allowing stolen iPhones or macOS devices to be reset and sold on the dark web.
Normally the T2 chip will exit with a fatal error if it is in DFU mode and it detects a decryption call, but thanks to the blackbird vulnerability by team Pangu, we can completely circumvent that check in the SEP and do whatever we please.
Since sepOS/BootROM is Read-Only Memory for security reasons, interestingly, Apple cannot patch this core vulnerability without a new hardware revision. This thankfully also means that this is not a persistent vulnerability, so it will require a hardware insert or other attached component such as a malicious USB-C cable, as said.
Impact of this vulnerability?
Once you have access on the T2, you have full root access and kernel execution privileges since the kernel is rewritten before execution. Good news is that if you are using FileVault2 as disk encryption, they do not have access to your data on disk immediately.
They can however inject a keylogger in the T2 firmware since it manages keyboard access, storing your password for retrieval or transmitting it in the case of a malicious hardware attachment.
The functionality of locking an Apple device remotely (e.g. via MDM or FindMy) can be bypassed (Activation Lock).
A firmware password does not mitigate this issue since it requires keyboard access, and thus needs the T2 chip to run first.
Any kernel extension could be whitelisted since the T2 chip decides which one to load during boot.
If the attack is able to alter your hardware (or sneak in a malicious USB-C cable), it would be possible to achieve a semi-tethered exploit.
What you do now?
For user
If you suspect your system to be tampered with, use Apple Configurator to reinstall bridgeOS on your T2 chip. If you are a potential target of state actors, verify your SMC payload integrity and don’t leave your device unsupervised. You could try resetting your SMC with a keyboard combination.
For mac sysadmin
Contact your Apple rep and wait for official news from Apple. Don’t use the T2 chip for any sensitive credentials for now such as MFA. Raise awareness to your users to not leave their device unattended.
All recent macOS devices are no longer safe to use if left alone, even if you have them powered down, according to ironpeak.
- The root of trust on macOS is inherently broken
- They can bruteforce your FileVault2 volume password
- They can alter your macOS installation
- They can load arbitrary kernel extensions
- Only possible on physical access
We are hopping the apple security team will be found patch for this vulnerability as soon as possible. We will keep updating you.
