Laptop Batteries May be Backdoor for Hackers

Recommended Videos

When it comes to securing your laptop against intrusion, it’s likely that you gave little thought to its onboard battery. But security researcher Charlie Miller believes that laptop batteries, particularly those found in Apple machines, could be exploited to cause all sorts of unpleasantness.

It turns out that laptop batteries are not the inert chunks of various metals like AAs or D-cells. On Apple laptops, the lithium-ion batteries include a microcontroller which performs numerous functions from monitoring charge levels to regulating heat. This controller is protected by two default passwords, which allow Apple to occasionally push software fixes and tweaks on battery performance through their normal system update process. One such update occurred in 2009, which Miller sifted through to recover the passwords.

With this in hand, Miller has shown that he can gain access to the battery’s micorcontroller and send whatever information he likes to the computer, “bricking” the battery so it cannot be recognized by the computer, or even rewriting the firmware entirely. This last point is particularly interesting, since Miller believes that with a little more tinkering it would be possible to load malware onto the battery which would launch at startup and force the computer to do whatever he wanted. He even suggested that remote overheating or physical damage to the battery — and we’re talking fire or explosions here — could possibly be done remotely.

Now before you call the bombsquad to carry off your laptop there are some major caveats here. First off, while Miller does believe that batteries could be physically damaged with malicious battery firmware, he has not proved that it could be done. Secondly, Miller admits that while he has found a way to load code onto the battery controller, he has yet to find a way to execute that code on the computer. To do so, he’d need to find a second vulnerability in how the battery and computer communicate. He did tell Forbes, however, “Presumably Apple has never considered that as an attack vector, so it’s very possible it’s vulnerable.”

Last, and more importantly, for any of this to actually matter, someone would have to have physical access to your battery. It’s unlikely that they could simply slip a malware-laden battery into your computer while you were distracted, although any battery purchased from a non-Apple retailer could be vulnerable to the activities of ne’r-do-wells.

Miller, for his part, has sought to close what he thinks is a dangerous loophole. He says he’s sent his battery research to Apple, as well as other companies whose products he investigated, along with a tool he calls CaulkGun. CaulkGun replaces the default battery microcontroller passwords with random strings, which would solve the problem at the cost of Apple’s ability to push updates to the battery. Miller also intends to publicly provide his findings at August’s Black Hat security conference.

With any luck, this issue will be patched up quick before anyone sees what else it can do.

(Forbes via Hacker News, image via Kenneth Gaerlan)


The Mary Sue is supported by our audience. When you purchase through links on our site, we may earn a small affiliate commission. Learn more
related content
Read Article ‘Mamma Mia!’ Star Sara Poyzer Says a BBC Production Replaced Her With AI
Sara Poyzer performs at the Magic at the Musicals event in 2019
Read Article In Moment of Unbelievable Irony, Midjourney Accuses Stability AI of Image Theft
Spider-Man pointing at another Spider-Man, who is pointing back.
Read Article Elon Musk May Be the Lesser of Two Evils in This Legal Battle With OpenAI
Elon Musk at the 2022 Met Gala
Read Article A.I. Scammers Are Impersonating Real Authors to Sell Fake Books
A robotic hand holds a pencil.
Read Article Sexist Trolls Drive Away Twitch’s Top Female Streamer After 10 Years
Imane "Pokimane" Anys at the 2023 Green Carpet Fashion Awards
Related Content
Read Article ‘Mamma Mia!’ Star Sara Poyzer Says a BBC Production Replaced Her With AI
Sara Poyzer performs at the Magic at the Musicals event in 2019
Read Article In Moment of Unbelievable Irony, Midjourney Accuses Stability AI of Image Theft
Spider-Man pointing at another Spider-Man, who is pointing back.
Read Article Elon Musk May Be the Lesser of Two Evils in This Legal Battle With OpenAI
Elon Musk at the 2022 Met Gala
Read Article A.I. Scammers Are Impersonating Real Authors to Sell Fake Books
A robotic hand holds a pencil.
Read Article Sexist Trolls Drive Away Twitch’s Top Female Streamer After 10 Years
Imane "Pokimane" Anys at the 2023 Green Carpet Fashion Awards
Author