Remember Thunderstrike 2? Last summer, Xeno Kovah and Trammell Hudson unveiled several known vulnerabilities affecting the Mac firmware and letting malware creators update the firmware without any way to reset it to its factory status — you’d need to reflash the firmware chip. And it looks like Apple didn’t just fix the vulnerability — it has also hired LegbaCore co-founders Kovah and Corey Kallenberg to work on security.
Thunderstrike 2 infected Thunderbolt devices like Ethernet adaptors or external DVD drives. If you reboot your Mac with an infected Thunderbolt device plugged in, the Mac firmware will execute the option ROM on the Thunderbolt accessory before booting OS X. It lets malware creators insert malicious code in the firmware.
The best part is that the accessory remains infected, letting someone infect as many Macs as they want. It was a powerful demo and the team alerted Apple has soon as possible.
In November 2015, Hudson from Two Sigma revealed that Apple had acquired LegbaCore at the 32C3 conference. Kovah also confirmed that he was working for Apple now:
What did Apple hire us to do? We can’t say. :) Well, we can probably say something like “low level security” (I don’t know our job titles)
— Xeno Kovah (@XenoKovah) November 10, 2015
Disrupt 2026: The tech ecosystem, all in one room
Your next round. Your next hire. Your next breakout opportunity. Find it at TechCrunch Disrupt 2026, where 10,000+ founders, investors, and tech leaders gather for three days of 250+ tactical sessions, powerful introductions, and market-defining innovation. Register now to save up to $400.
Save up to $300 or 30% to TechCrunch Founder Summit
1,000+ founders and investors come together at TechCrunch Founder Summit 2026 for a full day focused on growth, execution, and real-world scaling. Learn from founders and investors who have shaped the industry. Connect with peers navigating similar growth stages. Walk away with tactics you can apply immediately
Offer ends March 13.
Since then, LegbaCore has stopped accepting new customers for its security consultancy activity.
It’s unclear whether it’s an acqui-hire or Apple just hired the two persons behind LegbaCore. In both cases, it looks like Kovah and fellow LegbaCore co-founder Corey Kallenberg can’t continue working on LegbaCore and are now working for Apple full time.
And it makes sense that Apple would hire these security experts. Many tech companies hire hackers to fix security holes before they become public. It’s a great way to make sure that your products remain as secure as possible.
Via Mac Rumors
