Keyboard hack could leave your Mac completely vulnerable

Written by Joe Aimonetti

While most of the attention for Apple fans during the recent security conventions in Las Vegas was centered on the SMS vulnerability uncovered last month, another hack surfaced--taking advantage of keyboard flash memory--allowing for the hacker to gain complete control of the system.

George Ou at Digital Society reports after interviewing security researcher "K. Chen":

"This would instantly connect the computer to the attacker's computer and instantly give the attacker full control of the computer at which point additional rootkits could be installed. While this process would be visible to the human user while it's happening, that risk would be minimized by waiting through an hour of no keyboard inactivity and a simple "Open Apple M" key stroke would minimize the console shell hiding its actions further.

What all this basically means is that this keyboard can betray any computer it attaches to by:

1. Recording your password keystrokes
2. Deliver your computer into the attacker's hands
3. Re-infect your computer if your computer's hard drive was completely wiped

To infect your keyboard, the attacker only needs to exploit one of the many weaknesses in Mac OS X and Apple applications. Once exploited, the attacker only needs to drop less than 100 KB of payload to infect the keyboard and the attack takes less than 18 seconds."

While there is no official firmware update from Apple regarding this vulnerability, "K. Chen" has worked with the Cupertino computer makers, suggesting they release an update soon. He also released a 190-page slideshow documenting how to implement the hack. Of course, we will keep you updated with any news from Apple.

Experiencing problems? Have feedback? Let us know!
Follow MacFixIt on Twitter!

Resources

Digital Society

Let us know!

Twitter!

More from Late-Breakers