I agree with you fully and tbh I have gone to great lengths to learn as much as I could alone over a year. I provided apple with constant sysdiagnosis over a year as well and honestly felt pretty bad for contacting support and having it escalated to the engineers.
That being said one of my responses from the engineers was "How to reinstall an OS" which gave me the impression they didn't read the report or best I could do in summarizing my findings. I was attempting some pretty advanced stuff trying to provide them what I thought they might need to investigate. I offered to do as much groundwork for them as possible if they could just explain to me what I needed to gather or test.
The problem is Apple is somewhat a blackbox when it comes to security and for someone who works in IT I realize they cannot do everything and frankly they probably don't care for older models that soon will be obsolete. I also know it's 99% likely I am wrong and they are correct but here is the problem or the issue I had with them.
99% of their users call about god knows what and I don't blame them for not taking it seriously. But what seemed to happen is I sort of fell into a group they just don't support. I know enough to test and learn at a pretty granular level but that is very different from understanding the OS or security framework in any depth. I am able to identify stuff I know for sure is malicious or at least very abnormal but not enough to confirm my suspicions or what evidence I have. I understood this and went out of my way to try to do as much as I could on my end to be sure before I reported it and offered to test or provide anything they needed. I have all the data preserved across 4 drives now removed.
I couldn't even get an answer from the engineering team. Anyone I could reach by phone would assure me what I am talking about is impossible but that's just because they don't know about this stuff and they just go with what they have heard. I don't blame them but as I tried many times to just talk with with someone in the engineering team to just basically say "are you positive this is nothing?" and ask for a very high level explanation of what I would need to learn in order to verify that on my end.
Searching logs and trying to learn about how persistence would work at the hardware level one of my searches lead me to a github repo of a security researcher who literally describes something that is almost exactly as I described it in my first support ticket to apple. He had reported it to the FBI and they gave him some info on it and confirmed it was indeed malware even though Apple says it isn't.
rickmark commented on Oct 10, 2017
To be utterly overt, the FBI has confirmed MojoKDP / Thor and Loki as malware. I have received permission to publish from the San Francisco division, and you can plainly see that this is an old version of the firmware vs. your repository for that model.
rickmark commented on Dec 4, 2019
This is in fact an internal tool used by Apple developers that has been weaponized. MojoKDP provides a kernel debugger on the same box, and has no purpose on consumer machines
source: https://github.com/rickmark/mojo_thor/issues/1
source: https://github.com/rickmark/mojo_thor
The problem is this, if this is indeed what I have would apple even acknowledge it publicly or to me? From what I understand there may not be a fix for this once the loophole has been exploited so if that is the case I assume their policy would be patch it moving forward and stay a quiet about it as possible if it cannot be fixed.
Ok I understand that is the approach that actually makes sense to take for them as a company. But then what is the user who has this supposed to do while being hacked and asking for some help identifying if this is indeed on their system. I haven't been able to confirm anything yet as it's beyond my skill set but if their engineers were aware of this based on my reporting and they told me I have nothing to worry about but they knew that not to be the case that is really leaving their better customers out to dry and exposed. Once I realized this I tried to ask what they can even disclose and if they would indeed tell me if it hadn't or wasn't able to be patched and no one could even give me an answer. I then realized how big of a problem this sort of closed environment security policy is going to be once really bad malware gets widely distributed via a leak or a team publishing it.
Sure my case I'll assume I'm wrong but that doesn't mean cases like this won't come up and when they do in mass I cannot see apple being able to handle the damage control. I'm actually very interested to see their approach to this issue.
I did learn about remote jailbreaking espionage 0 click malware that is out in the wild and from what I know Apple was able to patch for it in 10 days which I have to say is absolutely unheard of. Maybe they will be able to pull it off. I hope so.
