![\"Apple](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2020\/10\/Apple-T2-chip-with-yellow-warning-sign-exclamation-emoji-292x300-1.png\")
<\/p>\n<\/p>\n
The majority of Mac models released since 2018 to date have contained a T2 security chip.<\/p>\n
Apple makes a number of security claims about this chip, stating<\/a> that “the T2 chip enables a new level of security by including a secure enclave coprocessor that secures Touch ID data and provides the foundation for new encrypted storage and secure boot capabilities.”<\/p>\n Little did Apple know that the T2 chip also contains flaws that inadvertently make Macs less secure<\/em> and more susceptible to serious local attacks. Apple cannot fix these flaws via a firmware update, so affected Macs are unpatchable and will remain vulnerable.<\/p>\n Belgian cybersecurity consulting firm ironPeak, which wrote a detailed overview<\/a> of the problem, summarizes several of the ways an attacker could leverage the T2’s design flaws:<\/p>\n TL;DR: recent Macs (2018-2020, T2 chip) are no longer safe to use if left alone and physical access was possible, even if you had them powered down.<\/strong><\/p>\n \u2022 The root of trust on macOS is inherently broken A team of security researchers discovered that it’s possible to borrow exploits used for iPhone jailbreaking to attack the T2 chip. This is possible in part because the T2 is based on the A10 chip in the iPhone 7 and 7 Plus, two iPad models (6th and 7th generation), and the current iPod touch (7th gen).<\/p>\n By leveraging the checkm8 exploit and blackbird vulnerability, a local attacker can gain full root access and kernel execution privileges on any Mac with a T2 chip.<\/p>\n Since the flaw resides in read-only memory (ROM), Apple cannot simply release a firmware patch to protect affected Macs. According to researchers, Apple would need to physically replace hardware to fix the issue.<\/p>\n Thankfully, FileVault 2 full disk encryption isn’t completely broken; an attacker still needs your password to access a FileVault-encrypted disk. However, an attacker could obtain that password by injecting a keystroke logger into the T2 firmware.<\/p>\n It’s also noteworthy that the flaw does require an attacker to have physical access to a Mac.<\/p>\n As scary as they may seem, most Mac users probably don’t need to worry too much about the T2 flaws.<\/p>\n If you’re a politician, activist, journalist, government employee, someone with access to highly sensitive information or trade secrets, or if you travel internationally to certain countries, you’re more likely to be targeted by a sophisticated threat actor. Most other Mac users probably shouldn’t lose sleep over T2 exploits.<\/p>\n However, if you’re concerned about such attacks<\/span>, there are a few things you can do to help protect your Mac from exploitation.<\/span><\/p>\n https:\/\/twitter.com\/i\/status\/1291857948600221696<\/p>\n For many more technical details about the T2 flaws, you can refer to ironPeak’s write-up: Crouching T2, Hidden Danger<\/a>.<\/p>\nHow T2 makes Macs insecure<\/h3>\n
\n\u2022 [An attacker] can bruteforce your FileVault2 volume password
\n\u2022 [An attacker] can alter your macOS installation [i.e. install malware]
\n\u2022 [An attacker] can load arbitrary kernel extensions<\/p><\/blockquote>\nThe technical stuff<\/h3>\n
How to protect your Mac from T2’s vulnerabilities<\/h3>\n
\n
How can I learn more?<\/h3>\n
![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile-150x150.png\")
<\/a>We discussed the T2 flaws\u00a0on episode 158<\/a> of the Intego Mac Podcast<\/strong><\/a>. Be sure to subscribe<\/a> to make sure you don\u2019t miss any episodes. You\u2019ll also want to subscribe to our e-mail newsletter<\/strong> and keep an eye here on The Mac Security Blog<\/strong> for the latest Apple security and privacy news.<\/p>\n