hoakley November 7, 2022 Macs, Technology

Why is my Mac’s firmware version wrong, and what to do about it?

So you’ve checked the version of firmware in your Mac, either in System Information or using a utility like SilentKnight, and it doesn’t match that expected for that model and version of macOS installed on it. This article explains how that can happen, and what you can and can’t do about it.

For many years now, Mac firmware has only been updated when you install or update macOS on that Mac, and the version of firmware installed should match the version of macOS. The update or install doesn’t have to be to its internal storage, though: when you update or install a newer version of macOS to an external disk, that should also update your Mac’s firmware. That doesn’t apply to macOS installed in virtual machines, though, and merely downloading macOS can’t change the firmware either.

Version higher than expected

Sometimes, the mismatch in versions shows that your Mac has a higher version number than expected. That’s only going to occur for one of two reasons:

Your Mac has installed a newer version of the firmware. This often happens if you install a beta-release of macOS, or could happen after service to your Mac.
Your Mac has installed a spurious version of the firmware, such as malware. You should be able to check that in Intel Macs running High Sierra and above using eficheck as described below.

Don’t forget that when you’ve installed macOS to an external disk, that can update its firmware. If your Mac boots from Catalina on its internal disk, but you tried out Ventura on an external disk, then its firmware will have been updated to that for Ventura. With the exception of Apple silicon Macs, firmware should never be downgraded, as its installer doesn’t allow that to happen.

Lower version, Intel without T2 chip

Almost all problems with older and outdated firmware occur on Intel Macs without T2 chips, and certain models are notorious for this, like the iMac Retina 5K 27-inch Late 2015 (iMac17,1). The most common reason for failure to update their EFI firmware is because the internal storage is non-standard, either replaced, or unusual for that model. In the case of the iMac17,1, it’s largely confined to the more expensive BTO options with internal SSD storage, and in other cases it has been seen when the original internal storage has been upgraded, or replaced following failure.

Before going any further, if the Mac is running High Sierra or later, check its EFI firmware integrity using the eficheck tool. Open Terminal, and in its command line type
/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check

Once it completes, you should see a response like
EFI Version: MBP141.88Z.F000.B00.1909131925 (Boot ROM Version: 202.0.0.0.0) Primary allowlist version match found. No changes detected in primary hashes.
In the first line of the response, this gives the Mac model (MBP141 = MacBook Pro 14,1), the major version (F000), the minor version (B00), and the build datestamp of that version (= [20]19/09/13 19:25). If that reports a problem, save the result immediately and contact Apple Support soonest, ready to quote those results to them.

Fuller details about eficheck are given in this article.

Provided that eficheck is happy, your Mac isn’t in imminent danger. All you can do is install or update macOS on a disk inside or attached to it, to see if that will update its firmware. The article linked to above describes the lengths to which some have gone to try to update their Mac’s firmware. The most you’ll probably want to do is contact Apple Support or book your Mac in to an Apple store.

Lower version, Intel with T2 chip

Macs with a T2 chip have two sets of firmware: EFI firmware for the Intel processor, and iBridge or BridgeOS for the T2 chip. Although it’s now exceptionally rare for these not to update properly, when they do the T2 chip’s firmware can be revived by connecting it to another Mac running Apple Configurator 2 (free from the App Store) using a USB-C cable. This procedure is described in full detail in Configurator’s Help book, where Apple states that “A revive updates the firmware on the Apple T2 Security Chip. A revive is designed to not make any changes to the startup volume, the user’s data volume, or any other volumes. User data may be retained if recoverable.”

The eficheck tool isn’t available on these models, and I’m assured that reviving firmware using Configurator updates both EFI and T2 firmware together. However, firmware problems with T2 Macs appear to concern the iBridge firmware rather than EFI.

If your T2 Mac can’t update its firmware properly, and Configurator doesn’t help, you should contact Apple Support or book your Mac in to an Apple store.

Lower version, Apple silicon Mac

M1 and M2 Macs are completely different, and don’t have any EFI firmware at all. Although the version number of iBoot is conventionally given for their firmware, in fact iBoot isn’t actually their firmware. The Secure Boot process used in Apple silicon Macs ties firmware and iBoot together, and should ensure that the firmware installed matches the version of macOS, unless the firmware is more recent (as explained above).

Updating both firmware and recoveryOS (in its own container on the internal SSD, not paired Recovery) can be performed using Apple Configurator 2 to revive that Mac, much in the same way as for T2 models. This is described in full detail in Configurator’s Help book, where Apple states: “A revive updates the firmware and updates recoveryOS to the latest version. A revive is designed to not make any changes to the startup volume, the user’s data volume, or any other volumes. User data may be retained if recoverable.”

What is very different with Apple silicon Macs is that their firmware can be downgraded by Configurator, as well as upgraded (by installing more recent macOS). For example, if you upgraded your M-series Mac to Ventura, its iBoot version will have changed to 8419.41.10, as it will be in Monterey 12.6.1 or Big Sur 11.7.1, which install the same firmware. If you wanted to revert that Mac to Monterey 12.6, complete with its older iBoot and firmware, then you could download the IPSW image for 12.6 from Apple and restore that to your Mac using Configurator. That will return it to factory fresh condition, with 12.6 and its firmware running.

However, as Apple points out: “A restore updates the firmware, updates recoveryOS to the latest version, and erases and installs the latest version of macOS on your internal storage. When this process is complete, any data on any internal volumes is unrecoverable.” You then have to personalise the Mac as if it was new again.

If you have any problems with Apple silicon Mac firmware, contact Apple Support or book your Mac in to an Apple store.

Further investigation

More recent versions of macOS, since Big Sur, provide detailed information about what has happened during macOS updates, in the text log at /System/Volumes/Update/restore.log. If you suspect that there may have been a problem with the firmware installer during an update, you may find information and error codes that provide clues as to what happened. However, this file is very large and unwieldy. Good luck!

17Comments

Add yours

1
fd on November 7, 2022 at 4:38 pm
I have two 2014-ish MacBook Pros. One runs High Sierra; the other Big Sur.

At one time I installed Big Sur onto an external drive on the machine that currently boots High Sierra.

As described above, High Sierra’s eficheck doesn’t know about the EFI firmware on this machine:
```
$ /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check
EFI Version: MBP112.88Z.F000.B00.2208232139
Matching allowlist not found in EFIAllowListShipping. Searching in EFIAllowListAll.
This system does now allow downloading background update data. Canceling.
Primary allowlist version match not found for version MBP112.88Z.F000.B00.2208232139.
```
By copying the corresponding ealf file from the Big Sur machine[1] to a writable directory on the High Sierra machine and then telling the eficheck tool which ealf file to read (-h command-line option), High Sierra’s eficheck tool appears to be able to verify the newer firmware:
```
$ /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check -h /Users/zzzzzz/Desktop/MBP112.88Z.F000.B00.2208232139.0.ealf 
EFI Version: MBP112.88Z.F000.B00.2208232139
Primary allowlist version match found. No changes detected in primary hashes.
```
Are there any reasons not to trust this method for verifying newer efi code on a mac running an older operating system?

—
Note [1]: ealf files were found in /usr/libexec/firmwarecheckers/eficheck/EFIAllowListShipping.bundle/allowlists/

LikeLiked by 1 person
- 2
  
  hoakley on November 7, 2022 at 5:17 pm
  
  You don’t report the firmware versions in those two MBPs.
  As I have written above, if you installed Big Sur on both, then you’d expect to see a firmware version corresponding to that release of Big Sur. In the case of the MBP still running High Sierra, that means that you know why its firmware is in the “Version higher than expected”, and I don’t recommend using eficheck in those circumstances, because of this sort of problem.
  If you really want to, yes, you could perform this sort of ingenious minor surgery, but I’m not really sure of its purpose. eficheck isn’t intended to address this situation, AFAIK. If it didn’t find a match, then I’m not sure what that would mean, nor what you should do about it.
  Howard.
  
  LikeLike
3

Kevin on November 8, 2022 at 1:32 am

Have you heard that the cups printing on macs leaves a cashe version on the mac? By a security expert, he has channel on YouTube. Sun Knudsen. I image you could incorporate code like he uses many of us have sensitive info to print.

LikeLiked by 1 person
- 4
  
  hoakley on November 8, 2022 at 11:45 am
  
  Thank you.
  Well, CUPS is deprecated, and AirPrint has been fully supported for many years now, both by Apple and many printer vendors.
  So why would anyone want to print sensitive info using a deprecated driver system to an unsupported printer?
  But I suppose some ‘security’ folk make YouTube bucks from it.
  Howard.
  
  LikeLike
5

Peter Hopcroft on November 8, 2022 at 5:39 am

Many thanks for creating and making available you mac apps, like SilentKnight. I mostly come for the art and I installed SilentKnight because I saw your recent posts about it.

I also saw your post about writing a help guide for the app. I am a naive mac user and when SilentKnight shows me a red cross instead of a green tick I don’t find the help guide useful. I would have preferred to see help along the lines of ‘If you see this red cross then do this’. Even better would be for SilentKnight to tell me this itself.

Recently SilentKnight told me that there were updates to Monterey and Ventura. And that my iBoot version was too low. I was baffled by what I found on the internet. In your post above, I’m ‘Lower version, Apple silicon Mac’. I gathered from ‘The Secure Boot process used in Apple silicon Macs ties firmware and iBoot together, and should ensure that the firmware installed matches the version of macOS’ that if I updated from Monterey to Ventura then iBoot would get updated. And so it did. It would have been great if SilentKnight had suggested that this might happen.

But.

I’m a technical writer and I write help guides.You have written SilentKnight for your own use and very kindly added a help guide and made it available to me for free. I think that it would be far too much work for you to write help for SilentKnight along the lines of what I have described above.

It is very difficult to write help, because naive users want a different kind of help to what advanced users want. And then there’s the screenshots to update when the app changes. In the end nobody does all that because it’s too much effort. And, in the end, few people read it anyway.

LikeLiked by 1 person
- 6
  
  hoakley on November 8, 2022 at 11:47 am
  
  Thank you.
  I’ve been a technical writer since before 1989. SilentKnight isn’t designed for the completely naive user, who can simply follow Apple’s advice to allow fully automatic updates, and run the latest version of macOS. At most then, all they might use SK for is a quick check that everything’s in order.
  Howard.
  
  LikeLike
7

Jes on January 14, 2023 at 10:08 am

hello ,

Security Measures for DFU Mode on Apple Silicon MacBook Pros :
From my understanding, it is possible to put a MacBook Pro into DFU mode without requiring a password. Is this correct? Additionally, what measures are in place to prevent a hacker with physical access from loading malware firmware or wiping the device using this method? Specifically, I am referring to M1 Macs. In the past, with Intel-based Macs, it was possible to set a firmware password to prevent such attacks. I am curious as to what the equivalent is for Apple Silicon and why there are no safeguards in place to stop this type of attack. ?

LikeLiked by 1 person
- 8
  
  hoakley on January 14, 2023 at 10:22 am
  
  Thank you.
  Because DFU mode is run purely from the minimal true ROM, it has no support for keyboards or passwords. It’s designed so that it doesn’t rely on anything on the internal SSD, which is assumed to be unusable, hence the use of the mode.
  When in DFU mode, the only access is from Apple Configurator 2, which can install an IPSW image on the tethered Mac. So to install something malicious on there, you’d have to convince that app that your substitute was signed by Apple and passed its security checks. You’d also have to reverse engineer the IPSW format, and ensure that image could boot the Mac from its firmware. Then, before that Mac could do anything, it would have to verify with Apple during the start of its personalisation, once it was booting from the malicious IPSW installation.
  If you’d like to read Apple’s Platform Security Guide, you’ll see all those steps considered in detail, and the checks made to ensure that such attacks are practically impossible.
  It’s fairly common knowledge that Intel Mac firmware passwords can be bypassed (any Apple store will do that for you, if you need). And their EFI firmware is so easy to hack – that has been well demonstrated.
  I think you have got this completely the wrong way round: pre-T2 Intel Macs don’t have any secure boot, while Apple silicon Macs are as secure as they come.
  Howard.
  
  LikeLike
  - 9
    
    Jes on January 14, 2023 at 11:02 am
    
    at least with Intel Macs you could use disable-reset-capability.
    I find the dfu situation is a major security flaw.
    
    LikeLiked by 1 person
    - 10
      
      hoakley on January 14, 2023 at 11:41 am
      
      I’m sorry, you’re completely wrong. Please read Apple’s guide.
      Howard
      
      LikeLike
  - 11
    
    jes on January 15, 2023 at 9:27 am
    
    “It’s fairly common knowledge that Intel Mac firmware passwords can be bypassed (any Apple store will do that for you, if you need).” – what I was saying is you can enable firmwarepasswd -disable-reset-capability , I think that’s the command I don’t own one of those Macs anymore.
    
    LikeLiked by 1 person
    - 12
      
      hoakley on January 15, 2023 at 9:32 am
      
      That only disables reset using the unlockseed feature. I gather that there are other methods of bypass.
      Howard
      
      LikeLike
13

Jes on January 14, 2023 at 11:03 am

One way an attacker could exploit this vulnerability is by modifying the firmware to insert malicious code and then signing it with a fake Apple signature. The attacker could then put the MacBook Pro into DFU mode and load the malicious firmware onto the device. It is not clear why there are no safeguards in place to prevent this type of attack on Apple Silicon Macs.

LikeLiked by 1 person
- 14
  
  hoakley on January 14, 2023 at 11:42 am
  
  I’m sorry, you really don’t know what you’re talking about. Have you read the guide?
  Howard
  
  LikeLike
- 15
  
  hoakley on January 14, 2023 at 4:15 pm
  
  Sorry, I’m back at my Mac and now able to expand on my earlier replies.
  So, let’s look thoroughly at the ‘vulnerability’ you’re imagining.
  “modifying the firmware to insert malicious code and then signing it with a fake Apple signature”
  How do they make a “fake Apple signature”, then? Signatures are designed to ensure that no one can do that, and as far as I am aware, no one has ever succeeded. So, let’s imagine for your sake that someone managed to steal the right type of Apple signature instead.
  “The attacker could then put the MacBook Pro into DFU mode and load the malicious firmware” So how do they do that then? Reverse the whole of Apple Configurator 2? AFAIK that will only download valid IPSW images, which will invariably also be signed by Apple. So, another stolen signature maybe?
  Then they have to reverse the IPSW format in order to construct their own, as only Apple has the tools and knowledge to do that. An IPSW is much more than just the firmware – it needs to be able to format the internal SSD correctly before it can install anything, and there are more components required than just one ‘firmware’, all of which would require to be reversed and signed with stolen signatures too.
  So now we’ll imagine the attacker has somehow installed an IPSW successfully on the Apple silicon Mac. The next thing they have to do is get it to boot from that. Here comes another problem: the main role of the Boot ROM, which is in the hardware, and can’t be changed, is to verify the next stage of the boot, the Low-Level Bootloader, LLB. This where disappointment is inevitable, as your malicious LLB can’t be verified.
  So what does the Boot ROM do in that case? It puts the Mac into DFU mode to await a valid IPSW installation. Your Mac is back to where it started.
  “It is not clear why there are no safeguards in place to prevent this type of attack on Apple Silicon Macs” No, I think you mean that you haven’t done your homework and read accounts of the safeguards provided by the Secure Boot process, in spite of my series here explaining it, and Apple’s guide.
  After you have read those carefully, you’ll maybe appreciate that there are plenty of safeguards, and if you don’t believe it, then the challenge to you is to demonstrate the shortcomings with a Proof of Concept, from IPSW to booted LLB.
  There are two words in the name ‘secure boot’. This is what the first of them means. It’s secure. Vastly more secure than anything you’ll find on any Intel Mac, or PC.
  Howard.
  
  LikeLike
  - 16
    
    jes on January 15, 2023 at 9:28 am
    
    thanks for clearing that up in depth for me. you have explained in great depth and I now understand.
    
    LikeLiked by 1 person
    - 17
      
      hoakley on January 15, 2023 at 5:58 pm
      
      Thank you.
      Howard.
      
      LikeLike

·Comments are closed.

Share this:

Related