Apple's Core Is Secure
Researchers now say they used a third-party drive to facilitate infamous MacBook hack at Black Hat
After all the kerfuffle over Apple Inc. (Nasdaq: AAPL)'s device driver security, precipitated by a demo of a MacBook hack at the recent Black Hat Inc. security conference, it turns out that the researchers weren't using Apple software but exploiting a weakness in a third-party driver.
At the show, SecureWorks Inc. researchers Jon Ellch and David Maynor showed a video demo of a hack using wireless drivers to quickly access a MacBook computer. The two researchers demonstrated how the drivers could be used to establish a connection and seize control of a laptop, even if the laptop was not associated with any WiFi access point. (See Users Eye New 802.11 Security Issues .)
When the hack was unveiled, Maynor told The Washington Post that they showed it on an Apple because of the "Mac user base aura of smugness on security." The researchers, however, have now put a notice on their Website to clarify that the hack used a third-party USB driver, which they are not naming until a patch is available.
"The video presentation at Black Hat demonstrates vulnerabilities found in wireless device drivers. Although an Apple MacBook was used as the demo platform, it was exploited through a third-party wireless device driver -- not the original wireless device driver that ships with the MacBook."
The researcher's admission, however, is unlikely to calm the frazzled nerves of enterprise users fretting about 802.11 security. Some higher-ups have already said that they will advise users to ensure that, until fixes are found, their WiFi radios are switched off when not in use. The hack also works against Windows machines. Intel Corp. (Nasdaq: INTC) has issued some patches but said that users should contact their laptop manufacturers for brand-specific updates. (See Intel's Centrino Vulnerability.)
— Dan Jones, Site Editor, Unstrung
About the Author(s)
You May Also Like
Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024Why Effective Asset Management is Critical to Enterprise Cybersecurity
May 21, 2024Finding Your Way on the Path to Zero Trust
May 22, 2024Extending Access Management: Securing Access for all Identities, Devices, and Applications
June 4, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024