Last year, if anyone had told me to make sure I changed the password on my battery, I would have thrown an energizer bunny at them. Today though, attackers could be targeting your Macbook’s battery.
These new high tech batteries are controlled and regulated by microprocessors. The microprocessors perform functions like telling the computer when the battery is done charging and how much power is left.
Security researcher Charlie Miller has discovered a way to access and control these processors by using the factory default password.
Our system admins, power users, computer companies, and local hackers have all been grooming us for years to change default passwords.
Some of the best hackers on the planet got into their craft playing pranks on neighbors who didn’t change their default router passwords. At this point it’s really just common sense. Why oh why, then, would the factory default password be left on such a critical component? The answer is quite simple: manufacturers figured no one would screw around with them.
We can assume that the manufacturers figured that since the battery can’t really be accessed until after a system has been compromised, since the battery is not a point of entry, then why would anyone target them?
Charlie Miller is quick to point out the severity of this problem, and how it can be used maliciously.
Attacking the firmware of these batteries means an attacker doesn’t have to install anything on the hard drive, thus making removal near impossible. Every time you reload your OS, or install a new hard drive, the malware can reinstall itself automatically. He also warned about the dangers of an attacker potentially detonating batteries, by overloading them until they explode.
Shooting from the hip, I’d think this exploit would be best served operating autonomously. Could you imagine if a piece of malware looked for in-flight Wi-Fi mac addresses and were timed to detonate in flight?
If Charlie Miller is correct, this issue needs to be addressed by Apple and Texas Instruments, who manufacturers the exploited microcontrollers.
Mr. Miller plans to unveil his research and findings at the Black Hat Hacker Conference in Las Vegas next month. He will also be releasing a fix independently, though he says he has notified Apple and Texas Instruments about the flaw.
Source: The Mac Observer
