Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 12 down vote favorite
5

Find My Mac is a useful feature of iCloud to locate your computer. As recent events have shown, however, if bad guys gain control of one's iCloud account, they can wreak havoc, including remotely erasing the contents of your Mac.

Is there a way to enable "Find My Mac" to find one's computer but not to enable the remote wipe feature?

A good answer would point to some official Apple document about whether or not this is supported. A great answer would say no, this isn't supported, but you can modify this particular file on your computer to prevent remote wipe from happening.

share|improve this question
By the way, I did happen upon (orbicule.com/undercover/index.html) this security software that honestly looks like a good alternative. – bassplayer7 Aug 8 '12 at 13:21
If the consensus comes back "no", I'd be up for feature-requesting it on radar.apple.com... – Ben Mosher Aug 9 '12 at 17:39
I guess there must be a small program on your iPhone to 'format'. Through a jailbreak i can imagine you could remove this program and effectively disable this feature, but it could have some serious side effects! – Rogier Aug 9 '12 at 18:12
@Rogier Read the question again. I'm talking about remote-wiping a Mac not an iPhone. So yes, it's hacking the system, but no jailbreak required. – Daniel Lawson♦ Aug 9 '12 at 18:16
@Daniel, sorry! Damn 'find my iphone' is in my head. Well basically the same applies. If you know which program Apple uses to wipe the disk, then its a matter of renaming (or removing it). – Rogier Aug 9 '12 at 19:16
show 2 more comments

4 Answers

up vote 7 down vote accepted
+100

In this Knowledge Base article, Apple write "With Find My iPhone set up on your iPhone, iPad, or iPod touch or Mac, you can locate, display a message, play a sound, remotely lock, or remotely wipe (erase) your device using the Find My iPhone app from another device (such as a friend's iPhone or iPad)."

This is the closest I have found to a direct statement that it's one package: if it's set up, you can locate, display a message, play a sound, lock, or erase. None of the documentation about configuration mentions options to enable these selectively; the control is off/on.

As far as disabling remote wipe, there seems to be a strong indication that the remote wipe involves rebooting to the Restore partition. Evidences for this include the fact that "Find my Mac" will not turn on (be greyed out) if there is no Restore partition present. Also, it would be very difficult for a running process to wipe its own boot drive. The Find my Mac remote wipe causes a reboot. It seems most likely that wherever the remote wipe lives, it's somewhere on the recovery partition.

So, Find my Mac won't turn on unless there is a recovery partition. Remote wipe most likely won't work if the Recovery partition isn't bootable. To enable Find My Mac but disable Remote Wipe, you need to have a recovery partition, and it needs to not successfully boot. Sabotage the recovery system somewhere so it can't boot and thus can't be used as the plaatform to wipe your main drive. Of course you will want to keep an external bootable recovery drive (USB stick?) available if you do this.

share|improve this answer
up vote 1 down vote

The first suggestion of sabotaging you recovery partition will not work. If you do that, the "Find My Mac" feature will disable itself. Meaning when you log into the feature, your computer will no longer be listed. The computer needs that recovery partition to function. If it's gone, "Find my Mac" will turn itself off on the computer. I found this out by accident. I used Carbon Copy to transfer my data to a bigger harddrive on my MacBook Pro and the software didn't copy the recovery partition over. When I went onto Find My Phone about a month later, My MBP was no longer listed (I was showing the feature to a friend who just bought a mac). So I went into iCloud in system preferences and noticed Find My Mac was greyed out and said "recovery system update required". the only way i was able to fix this and get FMM running again was to reinstall the operating system so the Recovery partition could be rebuilt. So yeah. Don't damage / erase the recovery partition or the FMM app WILL stop working altogether.

share|improve this answer
1  
What if it's present but missing some key executable file so it can't boot? Surely Find My Mac doesn't actually boot from the recovery partition every time it checks to make sure it's present. – Daniel Lawson♦ Dec 6 '12 at 4:05
up vote 0 down vote

No, you can't selectively disable remote wiping. If you could, the thieves could do it too.

You also can't modify anything on the machine to prevent it, that I know of. It might even be using built in UNIX tools that come with the machine, such as rm, to do the deleting. You really, really wouldn't want to rename or delete the rm program.

Sorry. There are alternatives, such as Prey and Orbicule's Undercover and Witness.

Good luck.

EDIT: The alternatives above may give you what you want.

share|improve this answer
Thanks, @CanuckSkier! – Harv Aug 19 '12 at 19:56
It doesn't follow that if you, with an administrative password, can disable remote wiping, thieves who do not have that password would also be able to do it. – Daniel Lawson♦ Aug 19 '12 at 22:03
Also, there must exist some process on the machine that listens for "Find My Mac" requests. Said process can be turned on or off. Even if the process invokes rm to do the wiping (which it does not appear to), patching the listener process to NOOP out the call to remove the call to the deletion routine should be possible. What I'm looking for is 1) what daemon or other process listens for Find My Mac pings and 2) can we run it through strings or otherwise decompile it to find how to neuter it so it can't be invoked to remotely wipe the machine on which it runs. – Daniel Lawson♦ Aug 19 '12 at 22:07
up vote -3 down vote

What do you think of this:

Go to iCloud.com and sign in.

Select "Find My Phone"... FMP actually is misnamed and finds all your devices, including your Macs.

You can email yourself when the Mac is found, and you can also "remote lock" - rather than "remote wipe".

Naturally, you will also have a location.

share|improve this answer
1  
I think you miss the point of my request. I know that I can click an option other than remote wipe. I want those other options to be enabled, but not let any bad guy who obtains my iCloud password remote wipe my computer. I want to find a way so a person with my iCloud password CAN find or remote lock the computer (which can be undone if it turns out the person with my password was a bad guy) but cannot remote wipe the machine (which is harder if not impossible to undo if the initiator turns out to be unauthorized). – Daniel Lawson♦ Aug 25 '12 at 19:33
OK. Now I understand better. I don't know a way to selectively split Remote Wipe and Remote Lock, but I'll keep looking. Meanwhile, you could turn off "Find my whatever" and one way to make sure that a hostile user can't turn it back on would be to remove the Recovery HD partition. However, if you remove Recovery HD, you won't be able to use Apple's FileVault 2 encryption. – David DelMonte Aug 26 '12 at 3:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.