The Patching Friars' AlmanacA calendar of CVE saints

January 30

ThunderstrikeHoly card for thunderstrike, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 EFI Thunderstrike FULGUR IN FIRMWARE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Thunderstrike, Lightning of the Mac

Patron of Thunderbolt ports, EFI firmware, and people who lend their Mac for five minutes.

Life

Presented by Trammell Hudson at the Chaos Communication Congress at the end of 2014 and fixed by Apple in January 2015, he showed how a malicious Thunderbolt device could rewrite a Mac's firmware during boot. The code landed in the motherboard's flash memory and survived reinstalling the system and even replacing the disk: lightning that leaves its mark.

Prayer

O Saint Thunderstrike, who strikes through the fastest port, protect our firmware from anyone passing by with an adapter in hand. Amen.

How to celebrate

Celebrated by updating macOS and distrusting every Thunderbolt adapter abandoned in a meeting room.

Lightning in the firmware, storms forever after.

Technical record

Disclosed on
January 30 2015
CVE
CVE-2014-4498

The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware during the EFI update process by inserting a Thunderbolt device with crafted code in an Option ROM, aka the "Thunderstrike" issue.

Sources: trmm.net

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.