Apple Event: May 7th at 7 am PT
I understand that the chances of getting thunderstrike2 is slim, and that if you have El Capitan you're immune from catching it.
My question is... If you got thunder strike 2 before upgrading to El Captian, i.e. from running Mavericks, will you still carry the bug in your SPI after the upgrade, if not, how does this work?
MacBook Pro (17-inch Late 2011), OS X El Capitan (10.11.2), Security
and thinks their iPhone or fit-bit has been hacked to become an IED
That would be the loudest appointment reminder ever! Sure would get the user's attention, though. 😀
I've checked the two links from Kurt, I'm guessing the references to
EFI
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5
Impact: A malicious application with root privileges may be able to modify EFI flash memory
Description: An insufficient locking issue existed with EFI flash when resuming from sleep states. This issue was addressed through improved locking.
I'm guessing this is the thunder strike 2 fix. I've updated my machine to El capitan so I'm guessing both fixes are now place, is that so?
Yes, that is the fix. It's how Thunderstrike got into the firmware - during a wake from sleep procedure it would copy from the drive to the firmware. That avenue is now blocked.
Thanks Kurt,
And like you say, just upgrading to El Captan re-writes the EFI to patch it completely.
thunderstrike-2 once infected always infected?
