[IP] Apple keyboard firmware hack demonstrated [RISKS] Risks Digest 25.76

[David Farber <dave@farber.net>]

Begin forwarded message:


Date: Mon, 3 Aug 2009 08:17:54 -0400
From: Monty Solomon <monty@roscom.com>
Subject: Apple keyboard firmware hack demonstrated

Charlie Demerjian at Defcon 17, 31 Jul 2009: Apple needs to patch it  
ASAP

Apple keyboards are vulnerable to a hack that puts keyloggers and  
malware
directly into the keyboard. This could be a serious problem, and now  
that
the presentation and code is out there, the bad guys will surely be
exploiting it.

The vulnerability was discovered by K. Chen, and he gave a talk on it at
Blackhat this year. The concept is simple, a modern Apple keyboard has  
about
8K of flash memory, and 256 bytes of working ram. For the intelligent,  
this
is more than enough space to have a field day.

K. Chen demonstrated the hack to S|A at Defcon today and it worked quite
well. You start out by running GDB, and set a breakpoint in Apple's
HIDFirmwareUpdaterTool. This tool is meant to update the firmware in  
human
interface devices, hence the name. The tool is run, a breakpoint set,  
and
then you simply cut and paste the new code into the firmware image in
memory. That's it.

Nothing is encrypted, decrypted, and the process is simple. You then  
resume
HIDFirmwareUpdaterTool, and in a few seconds, your keyboard is
compromised. Formatting the OS won't do you any good, the code is in
keyboard flash. There are no batteries to pull, no nothing, the  
keyboard is
simply compromised. ...

http://www.semiaccurate.com/2009/07/31/apple-keyboard-firmware-hack-demonstrated/

Reversing and Exploiting an Apple Firmware Update
http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Chen



-------------------------------------------