← Back to context

Comment by porphyra

2 days ago

There are also shops in China that will upgrade the SSD in a mac mini for cheaper and they will do all the work of the DFU restore etc.

26 comments

porphyra

Reply
ttul  2 days ago

And when the machine arrives back in the States, it even has a fresh CPC ROM soldered onto the back of the SOC!

  • hollerith  2 days ago

    I'm not a security researcher, but I get the distinct impression that Apple's hardware security is good enough that if you actually had an evil-maid attack on the M4 Pro Mac mini, it would instantly become the hottest news in the security community.

    • adrian_b  2 days ago

      I would not be so sure that Apple's hardware security is good enough, taking into account that for several years it has been possible to take complete control remotely and undetectably over any iPhone, because of a combination of hardware and software bugs.

      The Apple Mx CPUs had some secret test registers that allowed the bypassing of all hardware memory protections and which could be accessed by those who were aware of their existence, because they were not disabled after production, as they should have been. Combined with some software bugs in some Apple system libraries, this allowed an attacker to obtain privileged execution rights by sending an invisible message to the iPhone.

      It is unknown whether the same secret test registers were also open in the laptop versions of the Apple Mx CPUs. There the invisible message attack route would have been unavailable, but malicious Web pages might have been able to use the same exploit.

      This incredible security failure has been hot news for a couple of weeks, together with the long list of CVEs associated with it, and it has been also discussed on HN, but after that it has been quickly forgotten. Now most people still think that the Apple devices have good security, despite their history showing otherwise. I do not think that any other hardware vendor except Apple has been caught with a security bug so dumb as those unprotected hardware test registers.

      This was not a theoretical security failure, but it was discovered because some unknown attackers had used it for a long time to spy on some iPhone owners. The attack had been discovered by studying the logs of WiFi access points, which had shown an unusually high outbound traffic coming from the iPhones, which were exfiltrating the acquired data.

      4 replies →

    • FireBeyond  2 days ago

      It is mindboggling simple to override Apple MDM and device enrollment for MBPs. In a manner that is one and done, survives upgrades etc.

      Two minutes or less, 4 DNS entries.

      I'm a lot less convinced than you are of the hardiness of Apple's security.

      2 replies →