Apple Battery Firmware Default Password
Last Updated: 2011-07-23 02:10:14 UTC
by Johannes Ullrich (Version: 1)
Yesterday, I wrote about all the great things Apple did to improve security in its new operating system. Today however, we got a new, and quite different, vulnerability. It turns out that the firmware in Apple's laptop batteries is secured with a default passwords. An attacker would be able to use this password to change the battery firmware or settings, permanently ruining the battery. So its more of a denial of service attack. Persistent malware should be possible but it is not clear how much access it would have to the system.
It is always amazing what devices have firmware which may be manipulated by an attacker. I remember a while back a firmware update for the display port to VGA addapter. If there is a firmware update, there is always a change for a malicious firmware install. Recently, we talked about thunderbolt, Intel's new interface standard that provides direct bus access similar to Firewire. Thunderbolt cables are fare removed from "pairs of copper" we are used to. Instead, each thunderbolt cable has active circuits, and you guessed it, firmware embedded in the connector.
A malicious thunderbolt cable could potentially have direct access to system memory and disk.
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
I'm a lot more concerned about the possibility an attacker could intentionally make logic changes to cause a thermal overrun of the battery during charging, resulting in possible explosion of the battery or laptop fire.
We have a case where a firmware vulnerability discovered could actually be a safety issue, if exploited.
Since the microcontroller is responsible for controlling charging and discharging of the battery, and one of the reasons these batteries have firmware in the first place -- lithium ions are volatile, and require the microcontroller to actually monitor the charging and discharging cycles of the cells in order to keep the cells stable, and avoid catastrophic eruption of the battery.
Jul 25th 2011
1 decade ago
Jul 27th 2011
1 decade ago