Update: Apple tells us that this bug has been at least partially patched in OS X 10.10.4, so this particular version of Thunderstrike shouldn't be of immediate concern to users of fully updated Macs. We've reached out to Trammell Hudson for confirmation and will update the post if we receive further information.

Update 2: Hudson has posted more details about Thunderstrike 2 and the status of Apple's fixes to his Web site.

Thanks to a firmware update and OS X 10.10.4, he says Macs are "no longer trivially vulnerable," but he lists several vulnerabilities that Apple still needs to fix; the company has been informed of the problems. Hudson and Xeno Kovah, the other researcher who helped develop Thunderstrike 2, will be presenting more details in a talk at the Black Hat conference tomorrow.

Original story: Earlier this year, security engineer Trammell Hudson developed and showed off a proof-of-concept firmware called Thunderstrike. The malware could hitch a ride on Thunderbolt-connected accessories that used Option ROMs and infect any Mac it was connected to at boot. The infected Mac could then pass the malware to other accessories, which could infect other computers.

Apple (mostly) patched this exploit in OS X version 10.10.2 back in January, but Wired reports that Hudson and LegbaCore security researcher Xeno Kovah have developed a sequel.

Dubbed "Thunderstrike 2," the new proof-of-concept attack still spreads primarily through infected Thunderbolt accessories. But where the original Thunderstrike required a malicious user to have physical access to your computer to work—something sometimes referred to as an "evil maid" attack, though an evil butler could probably do the same job—the new one can be spread remotely. The malware can be delivered "via a phishing e-mail and malicious Web site," and once downloaded it can infect connected accessories that use Option ROM (Apple's Thunderbolt-to-gigabit-Ethernet accessory is a commonly cited example). Once the accessory is infected, the malware can spread to any Mac that you plug the accessory into.

The danger of firmware-level malware is that most virus scanners and other anti-malware products focus on RAM and files stored on the desk. It's difficult to detect in the first place, and it's difficult to track it back to its source. It's also tough to remove. "You can't use Thunderstrike to remove Thunderstrike" because the infected firmware patches the security hole in the original firmware.

Many of the security vulnerabilities that make Thunderstrike 2 possible are common to most EFI firmware. Researchers discovered a total of six vulnerabilities that affected PCs from Dell, HP, Lenovo, Samsung, and others. Of those, five also applied to the Mac's firmware, and of those, Apple has fully patched one, partially patched another, and failed to patch three more.

Apple has been alerted to the new vulnerabilities and will hopefully patch them using new OS X versions, new firmware updates for Thunderbolt-equipped Macs, or both. All Macs that ship with a Thunderbolt port (the bulk of new Macs introduced since 2011, with a handful of exceptions) are theoretically vulnerable to infection.