CHARLIE (ABAlmeida) Mac OS
Two well-known Mac hackers are updating a widely used hacking toolkit, making it easier to take control of a Macintosh computer.
Miller has also written a Mac OS X tool that will generate a random password and store it in a battery's firmware—preventing future hacks, but also preventing future firmware updates—which. Link 1: 2: support.apple.com/downloadsHey guys! This is Charlie from Charlie's T.
Over the past few days, the researchers have been quietly adding new software to the Metasploit toolkit, used by security researchers and criminals alike. Metasploit already supported Mac attacks, but until recently the Mac code hadn’t been as good as Metasploit’s Windows and Linux tools, said Dino Dai Zovi, an independent security researcher who talked about the new tools with his collaborator Charlie Miller at the CanSecWest conference. “Our goal was to make Mac OS X a first-class target for Metasploit.”
Metasploit is an open-source toolkit that makes it easy for hackers to launch a barrage of attacks against a computer system.
Miller and Dai Zovi earned fame in previous years for hacking Macintosh computers at CanSecWest’s annual Pwn2Own hacking contest. On Wednesday, Miller, a researcher with Independent Security Evaluators, won $5,000 and a Mac laptop by using a previously unknown Safari vulnerability to hack into a Mac system.
The hack was done before contest organizers. In an interview, Miller said he had hoped to demonstrate it before an audience at CanSecWest, but was prevented from doing so because of Pwn2Own contest rules, which prohibit public discussion of bugs exploited in the contest.
Miller and Dai Zovi say their work is designed to bring attention to serious security problems in the Mac platform, which has largely avoided the wide-scale attacks that have plagued Windows for years. Dai Zovi said he considers the Mac safe, but not secure. “There’s a difference between safety and security,” he said. “It’s like leaving your door unlocked. … Leaving your door unlocked is always insecure, but it may or may not be safe.”
At the show, the researchers demonstrated several payload programs they have developed for Metasploit, including one called “Pic the Vic,” which can be used to snap a photograph of a Mac user who has been hacked, using the computer’s camera.
They have also ported a Windows tool, called Meterpreter, to the Mac. Meterpreter is a stealth tool that can be used to gain information from and import more software onto a hacked computer.
In the next few days they plan to add exploit code to Metasploit for a handful of previously patched Mac software bugs. Exploit code must be used to first hack into the computer before any payload software can be installed.
Although there are still many more exploits available for Windows software than for Macs, the new payload code means there is now “more or less the same functionality if you want to target a Mac box or a Windows box,” Miller said.
A security 'noob' mistake has left the batteries in Apple's laptops open to hacking, which could result in a bricked battery or, in a worst case scenario, fire or explosion. This was revealed on Friday after Accuvant Labs security researcher Charlie Miller disclosed that he plans to detail the hack at the annual Black Hat security conference in early August.
We were curious as to how Miller, known for repeated hacks of Apple's Safari Web browser at the annual Pwn2Own hacking competition, stumbled upon this hack in the first place—after all, it is somewhat obscure and doesn't fall into what most people consider to be his typical focus area (browsers). Miller took time to answer our questions about what the hack is and how he found it, as well as what he plans to do when Black Hat rolls around.
The vulnerability
Laptop batteries include microcontrollers which constantly monitor charging voltage, current, and thermal characteristics, among other properties. These microcontrollers are part of a standardized system called the Smart Battery System, designed to improve the safety of Li-Ion and Li-Poly cells used in these batteries.
According to Miller, these controllers can be hacked in a fairly straightforward manner. By reprogramming the microcontroller's firmware, a battery could report a much lower internal voltage or current, causing the charger to overcharge the battery. In Miller's testing, he was only successfully able to turn a series of seven $130 MacBook Pro batteries into expensive bricks, but he told Ars that it may be possible to cause fire or even an explosion.
Charlie (abalmeida) Mac Os Update
'Lithium-ion batteries are potentially dangerous, and it's possible that futzing with the parameters could cause the battery to fail at best, or explode at worst,' Miller said. 'I know there are internal fuses and other safeguards to prevent that from happening, and I never did it myself, but there's certainly potential to get some malware to rewrite the smart battery firmware and cause some catastrophic failure.'
AdvertisementAs Miller noted, Smart Battery Systems include fuses which can disable cells if they reach dangerous internal voltages. But even these safeguards occasionally fail, resulting in toasted laptops.
Miller also told Ars that the battery firmware hack could be used to create a sort of 'permanent' malware infection. Such malware, or a least a portion of it, could be installed in the microcontroller's flash memory. Even if an infected computer's drive were replaced and the operating system re-installed, it's possible that an exploit could allow the malware to be reloaded from a laptop's Smart Battery System firmware.
The discovery
While the threat of un-installable viruses that cause laptop batteries to explode is highly unlikely, the truth is that the vulnerability exists in the first place because of a blunder on Apple's part. While researching potential vulnerabilities in the MacBook Pro's power management system, Miller inadvertently discovered that Apple used default passwords described in publicly available documentation on the Smart Battery System, which allows rewriting the firmware itself.
Miller began by trying to determine if it was possible to manipulate or control the battery charging system. He downloaded a battery firmware update that Apple released a couple years ago, and dug through its code to see how the system communicates with the Smart Battery System. Inside the firmware updater, he found a password and a command to 'unseal' the microcontroller, which allowed the firmware updater to change some of the battery's parameters.
This particular updater, according to Miller, merely told the battery to always keep a slightly higher minimum charge in order to keep the battery from becoming unable to hold a charge after being unused for an extended period of time. But searching for the unseal command led Miller to the Smart Battery Charger Specifications. Digging through the documentation, Miller learned that the password Apple used to unseal the microcontroller was the default used in the specifications.
AdvertisementOn a whim, Miller tried the default password to switch the microcontroller into 'full access mode,' sort of like an administrator account on your Mac. 'Unlike the unsealed mode, in full access mode, I could change anything: recalibrate the battery, access the controller at a really low level, including getting the firmware or changing it,' Miller said.
Miller downloaded the firmware and reverse engineered the microcontroller's machine code, bricking several batteries in the process. Eventually he was able to change the firmware to 'always lie, like to say it wasn't fully charged even when it was.'
The fact that Apple never bothered to change the default password is disconcerting, especially considering the effort Apple has made to beef up security in Mac OS X Lion. Lion's implementation of address space layout randomization (ASLR) is now 'complete,' according to Miller, making it nearly impossible to know where the OS has loaded system functions into memory. Furthermore, Safari—Miller's preferred exploit vector—is now divided into two sandboxed processes, one for the GUI and one for rendering Web content.
'That second process is sandboxed; it can't access your files and other stuff,' Miller explained. 'Even if you have browser exploits, the only way to do anything [useful] is to get out of the sandbox.' Miller said that would mean finding a bug in the kernel itself. 'That's not impossible... but it's definitely much harder with a sandbox than without.
Charlie (abalmeida) Mac Os Catalina
'It's certainly going to be a lot harder to own a Mac at Pwn2Own next year,' Miller admitted.
Miller speculated that Apple assumed that the battery would never be a target for hackers, and so kept the default passwords described in the documentation as a convenience. Unfortunately, that convenience has resulted in a potential headache for Apple laptop users. If other vendors stuck with the default passwords, those machines could be vulnerable as well, though Miller did not verify a successful hack on non-Apple hardware.
Charlie (abalmeida) Mac Os X
Miller handed his research over to Apple a few weeks ago to give the company time to come up with its own workaround before he presents his findings at the Black Hat conference on August 4. Miller has also written a Mac OS X tool that will generate a random password and store it in a battery's firmware—preventing future hacks, but also preventing future firmware updates—which will be released when he gives his talk at Black Hat.