So in yet another example of why default passwords are bad, consider your Apple laptop batteries as a potential threat. Yep, thats right... a threat.
According to a recent Forbes article, a default password stored in the chip that controls the batteries of Apple laptop allows an attacker the ability hijack the firmware and have their way with it. Since the firmware is designed to control the microcontrollers ability to monitor power levels of the unit, the operating system can be tricked to think it is running in a good condition when it could actually be overheating, could cause the system to stop charging, or possibly even implanting malware that could reinfect the host, even after you were to completely wipe and reinstall the system.
At present, there is no practical attack to this vulnerability. However at this year's BlackHat conference the researcher that found the vulnerability will be discussing this attack, and releasing an interm fix to address it. I am going to miss sitting in on this talk, but would be interested to hear what others say about it at the parties.
Reality is, we are back to square 1. You cannot rely on default passwords for anything. They are a bad idea. They are unsafe. And as we see here, potentially disasterous when used in hardware.
