Apple Mac fans told: Something smells EFI in your firmware

Perhaps I can offer an explaination

Perhaps I can offer an explaination as to why this is so, especially in SMBs and corporates.

And that explaination is Deploy Studio. Deploy Studio offers a very fast, easy, and efficient way to image and distribute a standard installation over an internal network

However Deploy Studio is basically a cloner. It’s a bit more advanced than that in that it’s able to fully update the system while doing the clone, but it does not update the EFI.

In order to update the EFI you need to run the actual system installer, which can take upwards of thirty minutes, or longer. A Deploy Studio clone takes around 5 minutes to complete, if not less. So for a Mac admin it’s a no brainer to use Deploy Studio. OK, at least it was when firmware updates were still offered over the Mac App Store.

These days EFI updates are only provided at the point of installing, or upgrading, a system using the official Apple installer (App or pre prepared media), which given the install times means that a lot of Mac admins are going to bypass that in favour of cloning a system.

Even I’m guilty of this when put in time pressure situations, like when we have just a Sunday to roll out an update to 300 seats.

Apple - trying to make it too easy

First off 'what version of EFI / SMC (might as well check both) firmware am I running?

Click the Apple icon (top left), About This Mac, System Report, Hardware (very top in left hand menu) look for Boot Rom Version, SMC Version. Not that hard....

And where, where are the current versions now that this article has 'raised awareness' ?

Apple has this deprecated article: https://support.apple.com/en-ph/HT201518

BUT apparently is bundling the updates automagically. So now we don't truly know. Very Strange apple.

Can one remotely (over a network ...say with ...nmap/nessus etc) determine the firmware version?

Notice the depth of information...systems over 8 yrs old are still supported. And largely function!

Hmmm

Old page on Apple's site:

https://support.apple.com/en-us/HT201518

this seems to list an awful lot of EFI updates. It's no longer updated, though. However, there is this:

https://www.macobserver.com/news/macos-high-sierra-performs-efi-security-check/

It seems that if you install High Sierra, you will get a system which checks your EFI and updates it if necessary. Furthermore, HS will, apparently, check your EFI on a weekly basis. Those who can't or won't update to HS may want to have a look at the Apple support page referenced earlier.

Desktop IT

Desktop IT departments like to install lots of junk on desktops in the name of security - virus scanners, remote control, remote wipe, IP and licensing scanners (disguised as backup software), helpdesk tools, obfuscated authentication tokens, etc. These fragile hacks break with OS upgrades so the IT department blocks them.

Yes, I'm talking about MacOS. The Windows experience is now multi-platform.

First of all, it has been UEFI since 2005. EFI is the old 2002 name for Unified Extensible Firmware Interface.

Second is the whole point of security is that an automatic update of UEFI is not supposed to be allowed. If the boot firmware can be automatically updated from the outside, then ANYONE can do it.

It should never be allowed.

I have seen hackers reflash the boot code, and there really is no way to ever recover from that. All the hacker has to do is rewrite the boot code to prevent reflashing. Then the only way to recover is to physically replace the eprom.

Interesting that Apple have made firmware version checking a critical part of the upgrade to High Sierra.