Food and discussion begin at 12:30 pm. Open to current Princeton faculty, staff, and students. Open to members of the public by invitation only. Please contact Jean Butcher at if you are interested in attending a particular lunch.

This talk describes Thunderstrike, an attack that installs persistent firmware modifications into the boot ROM of Apple’s popular MacBooks. The bootkit can be installed by an evil-maid via the externally accessible Thunderbolt ports. Alternatively, a remote SW attack can amplify root privileges yielding the same result. Once installed, 1) it can prevent software attempts to remove it, 2) it can survive reinstallation of the operating system as well as hard drive replacement, and 3) it can spread virally across air-gaps by infecting additional Thunderbolt devices.

Thunderstrike exploits several “features” of modern laptops. The Thunderbolt connection exposes the PCI bus to external devices, and external Thunderbolt devices contain flash memory which store option roms containing code that is executed early in the boot process. Unfortunately, current Macbooks lack full hardware or software cryptographic checks of firmware validity. Once malicious code has been flashed to the ROM, the attack controls the system from the very first instruction and can hide from attempts to detect it. Since Thunderbolt devices’ Option ROMs can be rewritten by software, the bootkit can write copies of itself to new Thunderbolt devices. And since the devices remain functional, a stealthy bootkit may spread across air-gap security perimeters through shared Thunderbolt devices.

Thunderstrike is the first firmware worm for Macintosh systems built upon several previously disclosed vulnerabilities that were ported from Windows systems to Apple’s firmware. Our research shows that vulnerabilities targeting the these firmwares may transcend operating systems as they share millions of lines of code in their common root ancestor, Intel’s reference implementation. We explain the vulnerabilities enabling the attack, how they were uncovered, mitigation strategies, and fixes by Apple.

Additional links and bio:
https://trmm.net/Thunderstrike_31c3
https://trmm.net/Thunderstrike2_details
https://trmm.net/About