Apple Acquired Firmware Security Company LegbaCore Last November

Apple acquired firmware security company LegbaCore in November 2015, according to security researcher Trammell Hudson, who revealed the acquisition in his presentation at the 32C3 conference in December. LegbaCore’s goal, according to founder Xeno Kovah, is „to help build systems that are as secure as we know how to make.“

In November, Kovah and fellow LegbaCore founder Corey Kallenberg revealed that they had joined Apple as full-time employees. Just a couple days before that, LegbaCore’s website announced that it would „not be accepting any new customer engagements“, noting that the website would remain up „to serve as a reference for LegbaCore’s past work.“

LegbaCore had collaborated with Hudson on Thunderstrike 2, the first firmware worm to affect Mac computers. The malware is impossible to remove, resistant to both firmware and software updates. LegbaCore and Hudson had alerted Apple to Thunderstrike 2’s vulnerabilities and Apple began work on fixes, issuing one in June 2015.

On Twitter, Kovah said that Apple began discussions with LegbaCore after the consultancy’s presentation in summer 2015. It soon became clear to Kovah and Kallenberg that Apple had „some *very* interesting and highly impactful work“ that the two could participate in. They were eventually convinced to wind down LegbaCore’s existing contracts and begin work at Apple.

While LegbaCore is a security consultancy firm that doesn’t own any specific technology, it’s likely Apple will use Kovah and Kallenberg’s talent and knowledge to help improve firmware and software security in future iterations of Apple’s various hardware and software products. LegbaCore’s work includes research on Thunderstrike 2, „dead code“ for BIOS attacks and more.

(Thanks, Jost!)

Tags: security, acquisitions
Discuss this article in our forums

Прочетете повече

OS X 10.10.2 Includes Fix for ‘Thunderstrike’ Hardware Exploit Affecting Macs

Apple is readying a fix in OS X 10.10.2 for the so-called „Thunderstrike“ hardware exploit targeting Macs equipped with Thunderbolt ports, iMore has learned. According to the report, Apple patched the vulnerability by making code changes in the upcoming software update that prevent a Mac’s bootrom from being replaced or rolled back to a previous state in which it could be attacked.

To secure against Thunderstrike, Apple had to change the code to not only prevent the Mac’s boot ROM from being replaced, but also to prevent it from being rolled back to a state where the attack would be possible again. According to people with access to the latest beta of OS X 10.10.2 who are familiar with Thunderstrike and how it works, that’s exactly the deep, layered process that’s been completed.

Thunderstrike is a serious vulnerability discovered earlier this year by security researcher Trammell Hudson, enabling an attacker to replace a Mac’s bootrom with malicious code without a user knowing. Since the malicious code is stored in a low level inaccessible to the user, the problem would remain even if the bootrom was replaced.

The proof-of-concept attack is limited in scope, however, as an attacker would require physical access to the Mac or savvy social engineering skills in order to trick a user into attacking his or her Mac themselves. Apple has already addressed the issue in its latest hardware, including the iMac with Retina 5K Display and new Mac mini.

OS X 10.10.2 has been in pre-release testing for over two months and should be made available to the public in the coming days. The most recent OS X 10.10.2 beta was seeded to developers for testing last Wednesday. In addition to the Thunderstrike fix, the upcoming software update addresses security vulnerabilities exposed by Google’s Project Zero security team last week.

According to 9to5Mac, the latest OS X Yosemite release will also add iCloud Drive in Time Machine and resolve issues related to Wi-Fi, VoiceOver and security. In particular, a recently identified glitch causing Spotlight on OS X to expose system information to spammers through remote content loading will reportedly be patched. Safari will also gain improved performance and security.

No public instances of Thunderstrike attacks have yet to be reported.




Прочетете повече