Hackers crack Apple T2 security chips

Security researchers have discovered that they can combine two previously developed iPhone exploits to crack Macs and MacBooks. The jailbreak is even possible for the new T2 security chips.

Applying the exploit is quite complicated. The technique has appeared on Twitter and Reddit in recent weeks. Some of the top Apple security experts have tested the exploit and confirm it works.

De Apple T2 chips

T2 is a special co-processor installed alongside the Intel CPU on modern Apple desktops and laptops. The chips come standard with all Apple devices sold since 2018. The chips act as a separate auxiliary CPU, providing audio processing and several simple I / O functions to take some pressure off the main CPU.

In addition to being a co-processor, the T2 chip also as a security chip that processes sensitive data such as cryptographic activities, KeyChain passwords and TouchID authentication. The chips therefore play an important role in every new Apple desktop.

How does the jailbreak work?

According to the Belgian security company ironPeak, a user / hacker must use the Jailbreak T2 security chip connect to a Mac or MacBook via USB-C. Next, he must run version 0.11.0 of the Checkra1n jailbreak software during the Mac’s boot-up process.

IronPreak indicates that the hack works because Apple left a debugging interface open in the T2 security chip. This allows anyone to compromise Device Firmware Update (DFU) without authentication.

It is possible to create a USB-C cable that automatically corrupts a macOS during boot. This allows an attacker to gain root access to the T2 chips and take control of everything running on the device and even retrieve encrypted data.

How great is the danger?

Any Mac or MacBook left unattended can be hacked to someone by connecting a USB-C cable, rebooting the device and then running Checkra1n 0.11.0. This can happen, for example, to travelers during security checks at the border crossing or to enterprises that work with a large number of Macs and MacBooks.

The jailbreak also brings (very careful) positive aspects. While investigating suspects, law enforcement officers can use the hack to access their Macs and MacBooks and retrieve information that would otherwise be encrypted.

Due to a hardware problem, there is no patch for the T2 chips. The only way for users to mitigate the consequences of a jailbreak is to reinstall BridgeOS. This is the operating system that runs on the T2 chips.

–