OS X 10.10.2 Includes Fix for ‘Thunderstrike’ Hardware Exploit Affecting Macs

Apple is readying a fix in OS X 10.10.2 for the so-called “Thunderstrike” hardware exploit targeting Macs equipped with Thunderbolt ports, iMore has learned. According to the report, Apple patched the vulnerability by making code changes in the upcoming software update that prevent a Mac’s bootrom from being replaced or rolled back to a previous state in which it could be attacked.

To secure against Thunderstrike, Apple had to change the code to not only prevent the Mac’s boot ROM from being replaced, but also to prevent it from being rolled back to a state where the attack would be possible again. According to people with access to the latest beta of OS X 10.10.2 who are familiar with Thunderstrike and how it works, that’s exactly the deep, layered process that’s been completed.

Thunderstrike is a serious vulnerability discovered earlier this year by security researcher Trammell Hudson, enabling an attacker to replace a Mac’s bootrom with malicious code without a user knowing. Since the malicious code is stored in a low level inaccessible to the user, the problem would remain even if the bootrom was replaced.

The proof-of-concept attack is limited in scope, however, as an attacker would require physical access to the Mac or savvy social engineering skills in order to trick a user into attacking his or her Mac themselves. Apple has already addressed the issue in its latest hardware, including the iMac with Retina 5K Display and new Mac mini.

OS X 10.10.2 has been in pre-release testing for over two months and should be made available to the public in the coming days. The most recent OS X 10.10.2 beta was seeded to developers for testing last Wednesday. In addition to the Thunderstrike fix, the upcoming software update addresses security vulnerabilities exposed by Google’s Project Zero security team last week.

According to 9to5Mac, the latest OS X Yosemite release will also add iCloud Drive in Time Machine and resolve issues related to Wi-Fi, VoiceOver and security. In particular, a recently identified glitch causing Spotlight on OS X to expose system information to spammers through remote content loading will reportedly be patched. Safari will also gain improved performance and security.

No public instances of Thunderstrike attacks have yet to be reported.

‘Bowling Central’ Expands Wii-Style Gaming on Apple TV [iOS Blog]

Back in 2013, Rolocule debuted Motion Tennis, an iPhone game that brought Wii-style gaming to the Apple TV via AirPlay. Using AirPlay Mirroring, users could display the game on an Apple TV while using an iPhone as a tennis racket. The setup drew natural comparisons to Nintendo’s Wii Sports, with the iPhone playing the role of the Wii Remote.

Motion Tennis wasn’t perfect, as it did suffer from minor lag and there were naturally concerns about users accidentally throwing their iPhones across the room or into their televisions, but it did serve as an interesting glimpse of both the potential of AirPlay and the possibilities for Apple TV gaming.

Rolocule is now back with an addition to its sports-themed Apple TV games, earlier this month debuting Bowling Central. The game itself is fairly simple, allowing users to bowl a classic game of 3, 6, or 10 frames, or take on a challenge mode that currently offers 30 stages with various stationary and/or moving blockers in the way of the pins.

Bowling Central is by no means the first bowling game for iOS, nor even necessarily the best or most realistic, but once again the selling point is Apple TV compatibility via AirPlay. When in AirPlay mode, the user can wave his or her iPhone side to side to set the release point and then swing the device to bowl the ball, even imparting spin depending on the trajectory of the swing.

In our testing, we found very little lag when playing via Apple TV, an important factor considering the need to accurately time throws in challenge mode. Throws also felt natural with the iPhone after a bit of practice that involved getting used to keeping a thumb on the screen during the throw rather than releasing as on Wii Sports. Rolocule co-founder Anuj Tandon notes the controls were specifically designed to keep the thumb in place during throws in order to maintain better control of the device and minimize the chances of accidentally throwing it.

We did experience some crashing problems when AirPlaying to a second-generation Apple TV, although these appear to be due more to AirPlay issues on the older set-top box than an app problem. No such issues were seen with a third-generation Apple TV.

Overall, Bowling Central is a fairly straightforward bowling game with limited gameplay options so far. For example, there is no live multiplayer option and the 30 challenge levels can be completed rather quickly, although it can take a bit longer to achieve “three-pin” ratings on each.

More challenge levels appear to be in the works, however, and the Apple TV compatibility is what makes Bowling Central an interesting concept as party entertainment. With Apple yet to allow games or any sort of App Store for the Apple TV, Rolocule’s AirPlay implementation gives a nice impression of the potential for the set-top box should Apple ultimately decide to open it up to third-party developers.

Bowling Central is available now in the App Store for $2.99. [Direct Link]