High Sierra validates Mac firmware weekly, alerts users to possible security issues

AppleInsiderAppleInsider
Posted:
in macOS
A new routine in High Sierra runs automatically weekly and checks the firmware of the Mac that is installed on to check for modifications that may jeopardize the security of the machine.




First spotted by The Eclectic Light Company blog on Sunday the "eficheck" routine in High Sierra compares the computer's ID and the installed firmware against Apple's database of known-good firmware revisions. Should the checksum fail, the user will be invited to send a report to Apple.

The new utility was coded by was coded by Apple engineers Corey Kallenberg, Xeno Kovah, and Nikolaj Schlej. Kovah issued a series of Tweets about the feature that have since been deleted.

The report sent to Apple excludes data stored in NVRAM. Apple will then look at the transmitted data to evaluate if there has been a malware attack -- but what happens after that is not clear. Also unclear is what impact that this may ultimately have on 4,1 Mac Pro owners who have flashed the firmware on the computer to make it appear to be the 5,1 Mac Pro or for Hackintosh owners -- but it appears at present that the dialog is no more than a one-time hassle.

According to Kovah's thread, the message will only be displayed once and not impact usability in any way. Should a user choose to send the report or dismiss the message, it will not be presented again unless the firmware changes.

AppleInsider has confirmed that the routine exists in the "gold master" of macOS High Sierra. Additionally, we have spoken to sources within Apple not authorized to speak for the company that the reports disseminated by the engineer over the weekend are accurate.

Apple's macOS 10.13 High Sierra update will debut on Monday. The update contains a number of improvements like Apple File System (APFS) implementation, migration from H.264 to H.265, and Metal 2, alongside other refinements.

Comments

  • Reply 1 of 15
    maestro64maestro64 Posts: 5,043member
    That is kind of interesting, did not know you could hack the Firmware EFI without user intervention and rebooting the computer. I am curious to understand why Apple all of sudden decide to do a checksum on the Firmware.
    doozydozen
  • Reply 2 of 15
    Rayz2016Rayz2016 Posts: 6,957member
    This sounds reasonable to me, but I imagine that a few posts down from this one, Apple will be cast as the Antichrist. 
  • Reply 3 of 15
    longpathlongpath Posts: 393member
    maestro64 said:
    That is kind of interesting, did not know you could hack the Firmware EFI without user intervention and rebooting the computer. I am curious to understand why Apple all of sudden decide to do a checksum on the Firmware.
    This sounds precautionary to me; but it's possible that this is response to recent WikiLeaks dumps.
    doozydozenfastasleepjony0
  • Reply 4 of 15
    maestro64maestro64 Posts: 5,043member
    longpath said:
    maestro64 said:
    That is kind of interesting, did not know you could hack the Firmware EFI without user intervention and rebooting the computer. I am curious to understand why Apple all of sudden decide to do a checksum on the Firmware.
    This sounds precautionary to me; but it's possible that this is response to recent WikiLeaks dumps.

    That is probably true...
    doozydozen
  • Reply 5 of 15
    MacProMacPro Posts: 19,727member
    Sounds very smart.
  • Reply 6 of 15
    SpamSandwichSpamSandwich Posts: 33,407member
    High Sierra is a no-go for me. I’m not updating my iMac just to lose functionality of all of my older Adobe software. I hate the rentware model and Adobe gets no monthly pay out of me or my business.
    doozydozendysamoria
  • Reply 7 of 15
    jpellinojpellino Posts: 697member
    SpamSandwich said:
    High Sierra is a no-go for me. I’m not updating my iMac just to lose functionality of all of my older Adobe software. I hate the rentware model and Adobe gets no monthly pay out of me or my business.
    Adobe for me is in the "break glass in case of emergency" folder.  There are alternatives.  Many free or cheap.  
    doozydozenjony0
  • Reply 8 of 15
    bcodebcode Posts: 141member
    SpamSandwich said:
    High Sierra is a no-go for me. I’m not updating my iMac just to lose functionality of all of my older Adobe software. I hate the rentware model and Adobe gets no monthly pay out of me or my business.
    An adobe.com forum post indicates that the issue is with APFS and not with High Sierra itself -- just opt not to upgrade your filesystem when you upgrade and apparently you're all good (can't confirm, haven't tried personally).

    https://forums.adobe.com/thread/2299158

    EDIT: Adobe posted these instructions for old CS installs under 10.12: https://helpx.adobe.com/creative-cloud/kb/install-creative-suite-mac-os-sierra.html
    edited September 2017 doozydozen
  • Reply 9 of 15
    MacProMacPro Posts: 19,727member
    Am I right in thinking the great unwashed get the 10.13 update today?  If so is it just in the US or all over ? I have people I know asking me in the EU colonies ;)  I didn't get to watch all of the presentations as I was hiding from a hurricane in northern Maine :)
    edited September 2017
  • Reply 10 of 15
    MacProMacPro Posts: 19,727member
    SpamSandwich said:
    High Sierra is a no-go for me. I’m not updating my iMac just to lose functionality of all of my older Adobe software. I hate the rentware model and Adobe gets no monthly pay out of me or my business.
    I feel for you.  Can you not make a secondary boot partition or even an external boot SSD with Sierra and just for Adobe use  till the retards fix their over priced software?  Or is there no hope they never will on older stuff? BTW is it an APFS issue only or something deeper?  Even the 2017 PS can't access an APFS volume as a scratch.  Unbelievable at this stage of the development.
    doozydozen
  • Reply 11 of 15
    indiekidukindiekiduk Posts: 381member
    There was a gold master candidate but no actual gold master was released yet, strange given the launch is supposed to be today.
  • Reply 12 of 15
    auxioauxio Posts: 2,727member
    I'm not certain what this is designed to protect against.  I mean, if a hacker has somehow gained the ability to rewrite the firmware on a machine, would they not also have the ability to rewrite the eficheck utility so that the firmware check always passes?
    doozydozen
  • Reply 13 of 15
    appexappex Posts: 687member
    "Apple will then look at the transmitted data to evaluate if there has been a malware attack". Does it mean that such macOS High Sierra automatic checks of Mac's EFI firmware against Apple's database will detect any malware, or only the ones modifying EFI?
    edited September 2017 doozydozen
  • Reply 14 of 15
    jabohnjabohn Posts: 582member
    bcode said:
    High Sierra is a no-go for me. I’m not updating my iMac just to lose functionality of all of my older Adobe software. I hate the rentware model and Adobe gets no monthly pay out of me or my business.
    An adobe.com forum post indicates that the issue is with APFS and not with High Sierra itself -- just opt not to upgrade your filesystem when you upgrade and apparently you're all good (can't confirm, haven't tried personally).

    https://forums.adobe.com/thread/2299158

    EDIT: Adobe posted these instructions for old CS installs under 10.12: https://helpx.adobe.com/creative-cloud/kb/install-creative-suite-mac-os-sierra.html
    As far as I know, you can't opt out of the conversion to APFS. An SSD drive will be converted automatically.

    Adobe CS6 seems to be working for me, more or less.
    edited September 2017
  • Reply 15 of 15
    dysamoriadysamoria Posts: 3,430member
    MacPro said:
    SpamSandwich said:
    High Sierra is a no-go for me. I’m not updating my iMac just to lose functionality of all of my older Adobe software. I hate the rentware model and Adobe gets no monthly pay out of me or my business.
    I feel for you.  Can you not make a secondary boot partition or even an external boot SSD with Sierra and just for Adobe use  till the retards fix their over priced software?  Or is there no hope they never will on older stuff? BTW is it an APFS issue only or something deeper?  Even the 2017 PS can't access an APFS volume as a scratch.  Unbelievable at this stage of the development.
    Adobe wont be fixing their older software. That's the point he's making. He's using CS6 or such, and not willing to pay Adobe for a subscription to the current version. I don't blame him. I will never subscribe to software, and certainly not Adobe's bloated stuff. Their products used to be the best. Not so any more. It's all about squeezing continued revenue from people, to support perpetual growth of business (something pathological capitalism doesn't understand is unsustainable).
    tallest skil
Sign In or Register to comment.