Apple’s rock-solid supply chain could produce new Macs with a serious vulnerability. With the prestige of big giant, it is strange that this would happen, but security researchers have found there is a way to hack into new Macs before users log in for the first time.
The vulnerability concerns enterprise Macs that are part of the Apple Device Registration Program (MDM) and its mobile device management platform. These tools allow companies to customize computers for their employees directly from Apple. However, a configuration error in the system could allow hackers to remotely load malware onto Macs.
This was explained by Jesse Endahl, security director of Mac Fleetsmith, together with Max Bélanger, an engineer at Dropbox, who demonstrated the failure during the Black Hat conference in Las Vegas. According to Wired, Endahl explained:
“We found a bug that allows us to compromise the device and install malware before the user logs in for the first time (….) When the user logs in to see the desktop, the computer is already compromised”.
Researchers found that if a company’s Mac computers use MDM to see which applications from the Mac App Store are installed, there is no certificate anchor to verify the authenticity of the document. In this way, hackers could launch a man-in-the-middle attack and install malicious applications to access computer data.
It could also be used to hack into the computers of the entire company. Apple has been notified of the problem and its vulnerability in macOS High Sierra 10.13.6 has been fixed, but devices shipped with earlier versions of the operating system are still vulnerable.