Announcing the Trail of Bits osquery extension repository

Summary: Trail of Bits released a maintained repository of osquery extensions, with its first extension querying the Duo Labs EFIgy API to check whether EFI firmware on a Mac fleet is up to date. Duo Labs had analyzed all publicly released Apple updates from the prior three years and verified findings across more than 73,000 Macs, finding many running outdated firmware even where the required EFI updates were supposed to be bundled in installed OS patches.
What you should know: EFI firmware runs at a privilege level out of reach of the operating system and hypervisor, so a Mac fleet carrying outdated firmware is exposed below every control you have installed on the host - and the 73,000-machine sample shows patched operating systems do not guarantee patched firmware.

Read the original at Trail of Bits Blog ↗