Hacker News new | ask | show | jobs
by jpillora 2080 days ago
Demo shows root shell. So an attacker could simply install a RAT into /Library/LaunchDaemons and it's permanent.
1 comments

It's not that easy since the T2 chip runs a derivative of iOS which requires codesigning. The only problem is that the T2 rarely reboots which means that erasing any modifications from it might be difficult (as far as I am aware long pressing the power button for 10 seconds should be enough to reset both the T2 and Intel though).

It is impossible to untethered persist a modified version of MacEFI without another exploit on the T2 since it has to be signed by Apple and the signature is properly checked.

> It's not that easy since the T2 chip runs a derivative of iOS which requires codesigning.

I mean, you can just ad-hoc sign?