T2 chip in iMac Pro & 2018 MacBook Pro controls boot, security functions previously manage...
Apple's new T2 chip in the iMac Pro and 2018 MacBook Pro is far more than a refinement of the family of sub-processors that launched in the 2016 MacBook Pro, with expanded responsibility encompassing FaceTime camera image quality, drive security, and total control over the boot process.
Editor's note: AppleInsider first published this in January following the iMac Pro debut. Given the volume of questions surrounding the chip following the release of the 2018 MacBook Pro, we have revised the article slightly and republished it to reflect the new hardware
The inclusion of the processor in Apple hardware has been known for some time, with reports in December discussing some features of the T2 in the iMac Pro. At the time, we knew that the T2 regulated boot safety, and had some level of control over boot security, but also at the time, there wasn't a lot of knowledge about how deeply integrated the chip was, nor how far the security implemented by the chip penetrated.
Jason Snell from MacWorld delved deeper into the T2 chip in a report in January, beyond just describing what it does. He elaborates upon the T2's role as mass storage controller, and notes that the T2 has "complete control" over the array of flash storage banks inside the iMac Pro.
The T2 encrypts "every bit" of data sent to the flash storage array in the iMac Pro, wrote Snell, and is responsible for decrypting it for the user. As a result, should the flash array be pulled from the iMac Pro, the data is irretrievable outside of the unit.
Another feature of the T2 is the boot process. Again on the fly, the T2 validates the boot process from start to finish, including verification of a legitimate and properly cryptographically signed bootloader, before the rest of the process is handed off to the rest of the iMac Pro's hardware for completion.
This is all managed by the previously described Startup Security Utility, which is invoked by the user with Command-R during the startup cycle.
Snell reports that by default, security is set to Full -- which requires a network connection to verify the operating system's legitimacy during install -- including the latest version of Windows 10 through Boot Camp. Medium eliminates the need for a network connection, with the feature also able to be completely disabled.
The T2 also has hooks in the FaceTime camera on both computers. Integrated into the T2 is a new image signal processor that alters all parameters of the FaceTime camera, very similar to the image adjustments that the iPhone makes automatically.
Apple's T2 governs more. It also controls and secures the computer's microphones, governs fan speeds, and controls the speakers in the iMac Pro as well.
Editor's note: AppleInsider first published this in January following the iMac Pro debut. Given the volume of questions surrounding the chip following the release of the 2018 MacBook Pro, we have revised the article slightly and republished it to reflect the new hardware
The inclusion of the processor in Apple hardware has been known for some time, with reports in December discussing some features of the T2 in the iMac Pro. At the time, we knew that the T2 regulated boot safety, and had some level of control over boot security, but also at the time, there wasn't a lot of knowledge about how deeply integrated the chip was, nor how far the security implemented by the chip penetrated.
Jason Snell from MacWorld delved deeper into the T2 chip in a report in January, beyond just describing what it does. He elaborates upon the T2's role as mass storage controller, and notes that the T2 has "complete control" over the array of flash storage banks inside the iMac Pro.
The T2 encrypts "every bit" of data sent to the flash storage array in the iMac Pro, wrote Snell, and is responsible for decrypting it for the user. As a result, should the flash array be pulled from the iMac Pro, the data is irretrievable outside of the unit.
Another feature of the T2 is the boot process. Again on the fly, the T2 validates the boot process from start to finish, including verification of a legitimate and properly cryptographically signed bootloader, before the rest of the process is handed off to the rest of the iMac Pro's hardware for completion.
This is all managed by the previously described Startup Security Utility, which is invoked by the user with Command-R during the startup cycle.
Snell reports that by default, security is set to Full -- which requires a network connection to verify the operating system's legitimacy during install -- including the latest version of Windows 10 through Boot Camp. Medium eliminates the need for a network connection, with the feature also able to be completely disabled.
The T2 also has hooks in the FaceTime camera on both computers. Integrated into the T2 is a new image signal processor that alters all parameters of the FaceTime camera, very similar to the image adjustments that the iPhone makes automatically.
Apple's T2 governs more. It also controls and secures the computer's microphones, governs fan speeds, and controls the speakers in the iMac Pro as well.
Comments
Does Full security mean no internet connection, no boot, and nothing that you can do about it?
In other words, if your ISP craps your, is your iMac Pro a brick?
For most of us, we're not trying to install from an external drive or an air gapped LAN; we're getting our OS installations from Apple's servers, even when booting into Recovery Mode, so we're already connecting to the Internet.
That said, I think I could have written a security plan for classified computing on an iMac Pro with internal SSDs that wouldn’t have to be locked in a vault or repository. Can’t steal the SSDs and get any data and can’t boot from external drives (disabling ports already a requirement and T2 handles this by default). Just make sure booting works to off-Internet validation server (MDM system) and it should be easy. Of course I don’t have to write these anymore but OTS OS and HW handling all this with no third-party additions makes it a slam dunk for government systems even for Windows-biased IT managers and security officers.
The T2 encrypts "every bit" of data sent to the flash storage array in the iMac Pro, and is responsible for decrypting it for the user. As a result, should the flash array be pulled from the iMac Pro, the data is irretrievable outside of the unit.
The T2 encrypts everything, and because its not the CPU there is no performance hit as there usually is with encryption/decryption. That’s pretty nifty.
It amuses me that VRing conflates UEFI with BIOS. UEFI is far more advanced in what it does compared to outdated BIOS.
I knew the moment that Windows PC manufacturers started making their systems using UEFI that people would continue to lazily and confusingly use the term BIOS in systems where it’s absent.
It will be interesting this year to see how the new machines roll out. That is will T2 be universal or not. Also how much more can T2 like chips take on, in laptops that could be very interesting.
By taking on more of the housekeeping, they can bleed more performance out of Intel’s stagnating chip line.
They probably were really pissed off when they found that Intel firmware on the Thunderbolt controller meant that a specially crafted TB dongle could pwn a Mac. They were also not happy to be beholden to Intel’s chipset plans (which have been behind the times - to one point where Apple once used nVidia chipsets in Mac portables). Remember Intel Centrino? That was Intel’s ploy to get PC makers to buy their crappy chipset and crappy wireless cards. You needed all three to be Intel to get that flashy sticker.
But switching to nVidia chipsets (most power efficient, includes GPU) and Atheros wireless (best radios) got them screwed when nVidia penny-pinched on the chip’s packaging, causing thermal issues (cracked solder joints) that resulted in massive recalls.
None of the big vendors seem to have their head on straight, so Apple regretfully has to make everything. It’s not like they want to throw R&D behind Desktop CPUs when all the money is in Mobile. Oh well!
They ship like 37 million iPhones a quarter, which are effectively a hardware legacy-free system (what’s a headphone jack?), so they probably can make a full desktop at some point. They’d probably rather not, though. Lots of R&D to get x64 code running perfectly on an ARM. I mean, even subtle details like Meltdown and Spectre have to be looked into.
I said: "Class 3 or 3+ devices (Surface Book, etc.) expose only UEFI at runtime."
You said: "The Surface Book uses only UEFI."
You should read that again. We're saying the same thing with regards to Class 3 devices, the BIOS interface is no more at that level.