The Apple of Your EFI: An Updated Study of EFI Security
summary
Duo Labs extracts every Apple OS/security update from OS X 10.10 through macOS 10.13, catalogs build number + board ID + EFI version, and compares that to telemetry from ~73,000 real Macs; it finds silent failures, regressions and many models never receiving updates (16 models with no EFI updates, 18 stuck on factory firmware). Bundled mitigations include an Apogee API and client plus Apple’s EFI check; real-world mismatch rates average ~4.2% in one dataset and ~20% in live API queries.
AI-written summary · about
chapters (26)
- 0:00Introduction and context
- 1:54Research goals and methodology
- 4:26Why focus on Apple
- 5:57Roadmap of the talk
- 6:31EFI 101
- 7:42Apple's adoption of EFI
- 8:50EFI as an attack vector
- 13:14Historical EFI research
- 16:10How Apple patches firmware
- 18:57Identifying hardware models
- 21:45New developments in 10.13
- 24:46Research hypothesis and questions
- 26:43Data collection methodology
- 30:13Building the analysis model
- 31:44Real-world data analysis
- 33:19Key research findings
- 34:28Measuring non-compliance
- 36:07Software secure vs firmware vulnerable
- 37:06The deprecation cycle
- 39:20CVEs and patch coverage
- 41:35EFI orphans and QA issues
- 43:04Regression and rollback protection
- 44:32Mitigations and recommendations
- 49:23Effigy tooling introduction
- 52:24API insights and results
- 58:08Conclusion
related talks
01h 13mIs there an EFI monster inside your apple?
44mBehind the scenes of iOS and Mac Security
45mInside the Apple T2
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints
40mAll Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices
49mEstablishing and Maintaining Device Trust: A Case Study
53mResearching New Attack Interfaces On iOS And OSX
37mThe Firmware Supply-Chain Security Is Broken: Can We Fix It?