Thunderstrike 2 is the latest in a line of OS X 10.10 Yosemite security vulnerabilities that, due to sensationalized reporting, are often a greater risk to customer stress levels than they are actual physical hardware. Still, as reported by Wired, Thunderstrike 2 is absolutely something every Mac owner should be aware of and informed about. So let's do that.
What's a firmware worm?
A firmware worm is a type of attack that targets the part of a computer responsible for booting it up and launching the operating system. On Windows machines, that can include BIOS (Basic Input/Output System). On the Mac, it's EFI (Extensible Firmware Interface).
Bugs in BIOS or EFI code create vulnerabilities in the system that, if not otherwise defended against, can be exploited by malicious programs like firmware worms, which try to infect one system and then "worm" their way onto others.
Because firmware exists outside the operating system, it's typically not scanned for or otherwise detected and isn't erased by a re-installation. That makes it much harder to find and harder to remove. In most cases, you'd need to re-flash the firmware chips to eradicate it.
So Thunderstrike 2 is a firmware worm targeting the Mac?
Yes. The story here is that some researchers decided to test whether or not previously discovered vulnerabilities in BIOS and EFI existed on the Mac as well and, if they did, whether or not they could be exploited.
Because booting up a computer is a similar process across platforms, most firmware shares a common reference. That means there's a likelihood that discovering an exploit for one type of computer means the same or similar exploit can be used on many or even most of computers.
In this case, an exploit affecting a majority of Windows computers also affects the Mac, and researchers were able to use it to create Thunderstrike 2 as a proof-of-concept. And, in addition to being downloadable, to show that it can also be spread by using the Option ROM—the accessory firmware called by the computer firmware—on peripherals like a Thunderbolt adapter.
That means it can spread without the Internet?
It's more accurate to say it can spread over the internet and via "sneakernet"—people walking around and plugging an infected Thunderbolt accessory into one or multiple machines. What makes that important is that it removes "air gapping"—the practice of keeping computers disconnected from each other and the internet—as a defense.
Has Apple fixed Thunderstrike 2 yet?
Of the six vulnerabilities the researchers tested, five were found to affect the Mac. The same researchers said that Apple has already patched one of those vulnerabilities and partially patched another. OS X 10.10.4 breaks the proof-of-concept by restricting how Thunderstrike can get onto the Mac. Whether OS 10.10.5 breaks it even more, or proves to be even more effective at preventing this type of attack altogether, remains to be seen.
Is there anything that could be done to make firmware safer in general?
Cryptographically signing both the firmware and any firmware updates could help. That way nothing would be installed that didn't have Apple's signature and the chances of fraudulent and malicious code infecting EFI would be reduced.
How worried should I be?
Not very. Attacks against EFI aren't new and using peripherals as attack vectors aren't new. Thunderstrike 2 circumvents protections put in place to prevent the original Thunderstrike and combines both internet and sneakernet attack vectors, but it's in the proof-of-concept stage right now and few if any people need to to worry about it in the real world.
In the meantime, the usual advice applies: Don't click on links, download files, or plug in accessories that you don't absolutely trust.
Nick Arnott contributed to this article
We may earn a commission for purchases using our links. Learn more.
Apple to permanently close Apple Uptown in Minneapolis, Minnesota
The store, which has been temporarily closed since March, has already been under review for closure for some time according to Apple.
Zagg launches new 'Pro Keys' wireless iPad keyboard and 'Pro Stylus'
Zagg is trying to bring some elements of the Magic Keyboard to the masses with a "pro" keyboard that comes in under $100.
iMovie for iOS updated with support for Dolby Vision HDR ahead of iPhone 12
Apple has also updated Garageband for iOS with faster ways of starting an audio recording and a new keyboard sound pack.
Keep an eye on the front door with the best HomeKit video doorbells
HomeKit video doorbells are a great way to keep an eye on those precious packages at your front door. While there are just a few to choose from, these are the best HomeKit options available.