OS X 10.10.2 Includes Fix for 'Thunderstrike' Hardware Exploit Affecting Macs

Apple is readying a fix in OS X 10.10.2 for the so-called "Thunderstrike" hardware exploit targeting Macs equipped with Thunderbolt ports, iMore has learned. According to the report, Apple patched the vulnerability by making code changes in the upcoming software update that prevent a Mac's bootrom from being replaced or rolled back to a previous state in which it could be attacked.

To secure against Thunderstrike, Apple had to change the code to not only prevent the Mac's boot ROM from being replaced, but also to prevent it from being rolled back to a state where the attack would be possible again. According to people with access to the latest beta of OS X 10.10.2 who are familiar with Thunderstrike and how it works, that's exactly the deep, layered process that's been completed.

Thunderstrike is a serious vulnerability discovered earlier this year by security researcher Trammell Hudson, enabling an attacker to replace a Mac's bootrom with malicious code without a user knowing. Since the malicious code is stored in a low level inaccessible to the user, the problem would remain even if the bootrom was replaced.

macbook_air_pro_yosemite
The proof-of-concept attack is limited in scope, however, as an attacker would require physical access to the Mac or savvy social engineering skills in order to trick a user into attacking his or her Mac themselves. Apple has already addressed the issue in its latest hardware, including the iMac with Retina 5K Display and new Mac mini.

OS X 10.10.2 has been in pre-release testing for over two months and should be made available to the public in the coming days. The most recent OS X 10.10.2 beta was seeded to developers for testing last Wednesday. In addition to the Thunderstrike fix, the upcoming software update addresses security vulnerabilities exposed by Google's Project Zero security team last week.

According to 9to5Mac, the latest OS X Yosemite release will also add iCloud Drive in Time Machine and resolve issues related to Wi-Fi, VoiceOver and security. In particular, a recently identified glitch causing Spotlight on OS X to expose system information to spammers through remote content loading will reportedly be patched. Safari will also gain improved performance and security.

No public instances of Thunderstrike attacks have yet to be reported.

Related Forum: OS X Yosemite

Top Rated Comments

steve333 Avatar
84 months ago
Apple had better improve performance to at least where my Mini was under mavericks.
Safari stinks as well under Yosemite.
Start-up time is 10 times longer than before as well
Closed system under Apple is supposed to prevent stuff like this from happening and until Yosemite it was pretty much true.

Keep Ivy away from the Operating System!
After seeing what he did to the Mini I wouldn't mind seeing him take a long hike permanently
Score: 5 Votes (Like | Disagree)
redheeler Avatar
84 months ago
EXCELLENT. I've been hoping I would eventually be able to go to a cloud based backup.

I'd rather see them increase the free storage amount to 10 GB to be more in line with other cloud backup services. Not everyone has the incentive or need to pay for more storage.
Score: 5 Votes (Like | Disagree)
zombiecakes Avatar
84 months ago
just release it already, Im so sick of the wifi disconnects
Score: 4 Votes (Like | Disagree)
citi Avatar
84 months ago

To what extent have you tried to solve this problem?

[LIST=1]
* Have you switched to a 5GHz network?
* Have you ensured only essential wireless networks are set up in your home? (ie. Turn off any that aren't needed)

Come on now, these are all things that you shouldn't have to do. I have dozens of devices, all types of macs (meaning non-yosemite) macs that haven't had a single problem. Don't blame the user....
Score: 3 Votes (Like | Disagree)
MacsRgr8 Avatar
84 months ago
We salute .........Apple

For Those About to Update.... We Salute You! :cool:
Score: 3 Votes (Like | Disagree)
Daalseth Avatar
84 months ago
the latest OS X Yosemite release will also add iCloud Drive in Time Machine

EXCELLENT. I've been hoping I would eventually be able to go to a cloud based backup.
Score: 3 Votes (Like | Disagree)

Top Stories

Top Stories 63 Feature

Top Stories: Beats Studio Buds Announced, Apple Watch Series 7 Rumors, and More

Saturday June 19, 2021 6:00 am PDT by
The Apple news cycle started to move beyond WWDC this week, but that doesn't mean there still wasn't a lot to talk about, led by the official debut of the much-leaked Beats Studio Buds that might give us a hint of what to expect for the second-generation AirPods Pro. With no hardware announcements at WWDC, we also took a look at when we might finally see the long-rumored redesigned MacBook...
ios wifi settings

iOS Bug Causes Specific Network Name to Disable Wi-Fi on iPhones

Sunday June 20, 2021 4:15 am PDT by
A wireless network naming bug has been discovered in iOS that effectively disables an iPhone's ability to connect to Wi-Fi. Security researcher Carl Schou found that after joining a Wi-Fi network with the name "%p%s%s%s%s%n" his iPhone's Wi-Fi functionality was left "permanently disabled." Changing a hotspot's SSID did nothing to correct the problem, with even a reboot failing to make a...
macbook air orange

Apple Developing a Whole New Kind of MacBook Air

Monday June 21, 2021 2:15 am PDT by
Apple is believed to be working on a completely new, high-end version of the MacBook Air, according to recent reports. Bloomberg's Mark Gurman, who often reveals accurate insights into Apple's plans, has repeatedly discussed the company's work on a high-end MacBook Air. Apple analyst Ming-Chi Kuo and leaker Jon Prosser have also referred to a similar MacBook Air model. The high-end...
YouTube Picture in Picture Feature

YouTube Says iOS Picture-in-Picture Coming to All US Users

Friday June 18, 2021 9:41 am PDT by
After a long wait, YouTube for iOS is officially gaining picture-in-picture support, allowing all users, non-premium and premium subscribers, to close the YouTube app and continue watching their video in a small pop-up window. In a statement to MacRumors, YouTube says that picture-in-picture is currently rolling out to all premium subscribers on iOS and that a larger rollout to all US iOS...
maxresdefault

Video: 20 Annoyances Apple Fixed in iOS 15 and macOS Monterey

Friday June 18, 2021 11:36 am PDT by
With iOS 15 and macOS Monterey, Apple is adding several quality of life improvements, which are designed to address some of the complaints that people have had with these operating systems for years now. Subscribe to the MacRumors YouTube channel for more videos. In our latest YouTube video, we're highlighting some of our favorite "fix" features that address long-running problems in iOS and...
iOS 15 Users Underwhelmed Feature

Users Underwhelmed by iOS 15 and iPadOS 15, Survey Suggests

Monday June 21, 2021 7:17 am PDT by
Users appear to be underwhelmed by Apple's upcoming iOS 15 and iPadOS 15 updates, according to the findings of a new survey by SellCell. The survey asked 3,000 iPhone and iPad users, evenly split between men and women, aged 18 or over in the United States, what they thought of iOS 15, iPadOS 15, and the naming of the upcoming iPhone 13 lineup. Over 50 percent of all of the survey's...
purple iphone 12 and 12 mini

iPhone 12 Mini Production Reportedly Ended Earlier Than Expected Due to Relatively Low Sales

Monday June 21, 2021 7:07 am PDT by
Following widespread reports that the iPhone 12 mini has experienced poor sales performance, at least relative to other iPhone 12 models, Taiwanese research firm TrendForce today claimed that production of the device has already ended. According to TrendForce, the iPhone 12 mini "reached End-of-Life ahead of time" during the second quarter of 2021, suggesting that Apple will focus on selling ...
primeday2020 feature3

Amazon Prime Day: The Best Apple Deals

Monday June 21, 2021 6:15 am PDT by
Amazon's annual Prime Day event has officially kicked off today, beginning 48 hours of discounts, offers, and tons of savings across Amazon's storefront. This includes everything from home electronics to clothing, jewelry, video games, movies, and much more. Note: MacRumors is an affiliate partner with these vendors. When you click a link and make a purchase, we may receive a small payment,...
16 inch macbook pro m2 render

When Can We Expect the Redesigned MacBook Pros Now?

Wednesday June 16, 2021 7:11 am PDT by
With no sign of redesigned MacBook Pro models at this year's WWDC, when can customers expect the much-anticipated new models to launch? A number of reports, including investor notes from Morgan Stanley and Wedbush analysts, claimed that new MacBook Pro models would be coming during this year's WWDC. This did not happen, much to the disappointment of MacBook Pro fans, who have been...
space gray magic accessories trio

Apple Stops Selling Magic Accessories in Space Gray

Friday June 18, 2021 9:16 am PDT by
Apple this week stopped selling its Magic Keyboard with Numeric Keypad, Magic Mouse 2, and Magic Trackpad 2 accessories for the Mac in a Space Gray color, around three months after discontinuing the iMac Pro, which also came in Space Gray. Last month, Apple listed the Space Gray accessories as available while supplies last, and the company has now removed the product pages from its website...