Apple's T2 security chip has an "unpatchable" vulnerability

Exploiting the checkm8 and blackbird flaws can grant attackers control over a macOS-powered device

The lid of a MacBook device partially opened while the device is turned on, in a dark room

The sophisticated T2 security module embedded in Mac computers can be hijacked by combining two existing vulnerabilities that can allow hackers to successfully “jailbreak” Macs and MacBooks.

The operating system run by the T2 security chip, sepOS, suffers from an exploit first identified in the iPhone X, dubbed checkm8, which can be used to circumvent activation lock, allowing stolen handsets to be reset and sold illegally. 

Researchers with Iron Peak have demonstrated how it’s possible to combine this flaw, which is also present in the T2 chips embedded in some Mac devices, with the blackbird vulnerability, first identified by Pangu researchers

When hit with checkm8, the T2 chip on macOS devices normally exits with a fatal error if it’s in Device Firmware Update (DFU) mode and detects a decryption call. Exploiting blackbird, however, could allow a hacker to bypass this check.

“Apple left a debugging interface open in the T2 security chip shipping to customers, allowing anyone to enter Device Firmware Update (DFU) mode without authentication,” Iron Peak said in a blog post. “Using this method, it is possible to create an USB-C cable that can automatically exploit your macOS device on boot.

“Once you have access on the T2, you have full root access and kernel execution privileges since the kernel is rewritten before execution. 

Apple’s T2 security chip is a co-processor that sits alongside the CPU and harbours data and functions pertinent to the security of the device, including boot operations, and includes features such as audio processing.

The hardware-enabled security component, which runs bridgeOS, is a custom Arm processor based on the A10 CPU found in the iPhone 7. Modern Macs run more recent iterations of the T2 chip based on A12 architecture, and bridgeOS firmware, although a huge portion of current devices still use the A10 and sepOS.

The T2 chip performs a set of predefined tasks in macOS including functioning as a hardware security module for features such as Apple KeyChain or two-factor authentication. Other functions may include accelerating media playback, whitelisting kernel extensions, and cryptographic operations.

The flaw currently affects the devices shipped with Intel CPUs and may not affect Mac devices that are manufactured with Arm-based processors in the next hardware cycle, although the researchers added there was no guarentee.

Alarmingly, Iron Peak researchers claim the core vulnerability is unpatchable because sepOS/BootROM is read-only memory for security reasons, and therefore it cannot be fixed without hardware revisions. 

The better news is that if users deploy FileVault2 as disk encryption, potential hackers won’t have access to data stored on the device immediately. They can, however, inject a keylogger in the T2 firmware since it manages keyboard access, storing any passwords for retrieval or transmission, in the event of a malicious hardware attachment.

IT Pro approached Apple for a statement on the two vulnerabilities.

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Recommended

Microsoft spearheads industry-wide charter against AI cyber attacks
Security

Microsoft spearheads industry-wide charter against AI cyber attacks

23 Oct 2020
Weekly threat roundup: Chrome, Citrix and WordPress
Security

Weekly threat roundup: Chrome, Citrix and WordPress

23 Oct 2020
IT services giant Sopra Steria falls victim to Ryuk ransomware
Security

IT services giant Sopra Steria falls victim to Ryuk ransomware

23 Oct 2020
CMS platforms succumb to KashmirBlack botnet as businesses rush online
Security

CMS platforms succumb to KashmirBlack botnet as businesses rush online

22 Oct 2020

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

5 Oct 2020
IT services giant Sopra Steria falls victim to Ryuk ransomware
Security

IT services giant Sopra Steria falls victim to Ryuk ransomware

23 Oct 2020
How to wipe a laptop easily and securely
Security

How to wipe a laptop easily and securely

5 Oct 2020