Apple's T2 security chip has verified vulnerabilities that can't be easily patched because hardware flaws require firmware workarounds that degrade performance or need full hardware replacement. The speaker explains why security lives in hardware, why that makes flaws catastrophic, and what consumers should demand from manufacturers.
Chapters
What are the challenges for Apple's security chip vulnerability? Well, recent verified reports have indicated that there are a number of vulnerabilities in Apple's T2 security chip, which could be exploitable. In fact, these are so severe, the initial indications are they're unfixable, which creates a problem for many Apple users out there. Now, this isn't the first hardware-based vulnerability in chips. In fact, many companies have had some pretty severe vulnerabilities that could be exploited in their computer chips. So you kind of have to ask yourself, well, why would you put security controls in the computer chip? Well, it kind of makes sense. There's significant benefits to put security in hardware versus anywhere else in the stack. But there are also, again, equally severe drawbacks if a vulnerability is discovered that can be exploited. If we look at the entire stack of a computer system, in fact, and you think at the top you have data and then applications, and under that you've got virtual environments or containers, and operating system is a big part of that, and beneath that you've got firmware, and finally You've got the hardware, the computer chips. Now, the further you go down this stack, the more benefit you have from a security perspective, right? No matter where you are, you can see everything for the most part above you. You can't see anything that's going on below you. So the farther you are down, the more visibility you have, and the less chance somebody is gonna be able to go in and evict you. Now, at the very bottom there is the hardware, and that's a very coveted place to be. And if you've got security controls in there, again, you can see the entire stack above you, very, very difficult for bad things to hide. But it's also a problem if there's an actual vulnerability that attackers can exploit down at that low level, because down in the hardware, it becomes very difficult to patch. And in some cases, you simply can't, it's embedded in the silicon. So that creates both an opportunity for the hackers, but a bigger opportunity if security is done right. In this particular case, a vulnerability was discovered that was exploitable, or is exploitable, and so Apple now has to kind of deal with that. In most cases, when there is a problem with hardware where there's a vulnerability, normally a vendor will either work with the firmware or with the operating system to put in controls to either bypass that function, turn it off, redirect it somewhere else that, well, it really wasn't designed to begin with, but those things can either cause severe performance issues, hopefully not, but in many cases they do, or it could even open up other types of vulnerabilities to the platform. Neither are good options. So in general, you wanna avoid those. But if you can't, you try and find a patch, a workaround, but ultimately the only way to really fix it is to replace the hardware. Now, if I had to guess, I would assume that Apple engineers are working feverishly right now to understand in the silicon where the vulnerability exists and how to fix it, maybe even to design something different. Knowing Apple, they're probably not stopping there. They're probably looking for vulnerabilities in other areas in the silicon as well, especially in that security chain. To make sure that there isn't another surprise very soon. And again, we've seen this with other major vendors with their silicon products where vulnerabilities have come out, and sometimes some very severe vulnerabilities, time and time and time again. So as consumers, we really need to pay attention. We really need to put our faith in companies that have the right leadership, that are taking the right forward stance, that are being proactive to make sure that they're reducing, greatly reducing, the number of vulnerabilities and possible exploitations in their silicon before it gets out to products, because again, it's really tough to fix after the fact. Uh, the end user will typically suffer in some way, shape, or form. So that becomes our responsibility. But for Apple right now, I'm sure they're working on some type of patch or fix. For all the Apple owners out there that are concerned about this vulnerability, keep a very close eye out. And as Apple releases a new patch or fix, please don't wait, get it updated, make sure your system is not vulnerable. Vulnerabilities tend to be chained and pulled together, so it's not just one, right? There are many others that may combine to make something even worse. So keep an eye, and for all of us, let's make sure that we're holding accountable the companies that are manufacturing these incredibly high-technology pieces of silicon and other pieces of hardware. Because that's the bottom of that stack, and it has to have the most trust compared to anything above it.
