WikiLeaks claims that Der Starke (German for “The Strong”) is an advanced CIA implant for Mac OS X that embeds itself in EFI firmware, making detection and removal difficult. Activated within the disk arbitration process, Der Starke evades personal security tools like Little Snitch by using web-based network communications instead of physical disks. This exploit is part of a series of malware that targets Apple devices that WikiLeaks claims the CIA’s Embedded Development Branch (EDB) is responsible for creating.
