Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm working on securing my Mac completely and utterly. I may be going to China for a business trip and I've been advised to do this but not provided steps that work for a Mac.

Is it safe to say that by setting "IPv4 Configure" to disabled that this will make it impossible for anyone to violate my Macbook through either Ether or Firewire? Should I do similar for an IPv6 setting?

share|improve this question
Can we assume you have physical control over the computer at all times and will not be forced to connect it to ethernet or firewire? The only complete and utter security is a computer in a room with no doors and no communication to the outside - so everything else opens the door to compromise. – bmike♦ Aug 26 '12 at 13:35
Security people may want to check your laptop inside a private room while you wait outside. They may take it apart, clone the disk, then reassemble it and give it back to you as if nothing happened. This procedure may not occur at the airport but discreetly in your hotel room when you are busy with some social event. – mouviciel Aug 26 '12 at 16:24

5 Answers

up vote 4 down vote accepted

Most of your concerns and more can be found on the Security board of Stackexchange.

Here is a post discussing Firewire concerns: http://security.stackexchange.com/questions/17051/safely-disable-firewire-thunderbolt-patching-up-dma-exposure.

This is about mobile devices but the same principles are true: http://security.stackexchange.com/questions/11612/what-are-prudent-security-precautions-to-take-for-business-travel-by-people-with

And what you will eventually learn is that you will not be able to achieve:

securing my Mac completely and utterly

You should take basic precautions but if you are concerned about your Firewire and Ethernet ports; you probably won't be able to stop whomever is trying to attack you.

share|improve this answer
Well, there is one way. I could open up the Mac and temporarily cut come wires, then solder them back together when I return. – Asker Aug 22 '12 at 22:33
@Mithras I meant that if you are worried about someone tampering with your computer through your Firewire or ethernet ports you are dealing with people that will most likely succeed in getting whatever they are after and would probably choose an easier path to do so. Therefore, you should focus on protecting yourself in more realistic ways according to the sensitivity of the data you have. – user142485 Aug 23 '12 at 13:29
up vote 5 down vote

Recommend taking a "throw-away" computer and not one you will continue using after returning. You're not going to be able to secure it just by disabling access (even with restricting boot).

share|improve this answer
This is a good idea but really doesn't solve any problems. If they need to take confidential information with you, which most executives, etc. do, then you need to take some precautions. Plus, even with a dummy laptop, you connecting to a network designed to steal information will reveal credentials that could compromise your corporate accounts. Giving someone a dummy computer without education and encryption is equally as dangerous. – Richard Belisle Aug 21 '12 at 16:10
Perhaps putting files on an iPad is the best choice, if there's no need to move files around too much or run specific programs. – Asker Aug 25 '12 at 23:43
iPad would make it cheap enough to just discard it upon return home too. The risk of data theft while there is bad, but far worse is the possibility of continuing data theft, on your now hacked/modified device, once you return home. – Brian Knoblauch Sep 17 '12 at 12:46
up vote 3 down vote

To answer your question, there are several things one must consider beyond just disabling Ethernet.

  1. Encrypt your hard drive. You could use FileVault2 but I'd opt for TrueCrypt. http://www.truecrypt.org/

  2. Make sure your computer is set to sleep quickly or to log out during inactivity. This will limit the potential of a physical attack dumping your keys from live memory via Firewire.

  3. Most important: Do not connect to any unknown networks. For example. do not, I repeat, do not connect to the hotel network!!! This is a main attack point for corporate espionage.

  4. Set firmware password. This really just slows down an attack. If you are targeted, this will be easily bypassed if they have access to your machine.

As for IPV6, it is likely you can just keep it off. There are two main probable ways your data would be compromised, physical theft and open networks. True Crypt would solve your physical theft issues, especially if you create encryption within whole disk encryption or some other obfuscating techniques. As I said before, do not connect to any networks that aren't owned by your company, even with another computer or device. Lastly, in regards to physical security. I have often recommended disabling the Firewire port. There are several ways to achieve this, the easiest being in 10.5 & 10.6, just deleting the /System/Library/Extension/IOFireWireFamily.kext and replacing it with a dummy file. I haven't done this on Lion, although I'm sure it's a similar avenue. You can also do the same to USB depending on your goals.

share|improve this answer
1  
You should watch killing the usb kernel extension, if you do that would render your keyboard and trackpad useless on a MacBook – MrDaniel Aug 21 '12 at 19:12
up vote 2 down vote

Turn on FileVault2 and set an OpenFirmware password. Shut it down rather than letting it sleep whenever it will be leaving your sight. That should protect you against any attack that could come over the Ethernet port or the Firewire port, although of course there's always scope for having your hardware hacked, e.g. by adding a keylogger to your keyboard.

share|improve this answer
up vote 0 down vote

You can also remove the active network interfaces from the system; in the Network pane of System Preferences, highlight each interface and click the - (minus) button, or use networksetup -listallnetworkservices from the shell to show all available interfaces and then networksetup -removenetworkservice <networkservice> for each entry. (Use networksetup -detectnewhardware to re-enable everything.)

Again, physical security is paramount; encrypting your hard drive and setting an OF password will greatly delay an attack, but not be 100% effective in preventing one.

share|improve this answer
The removenetworkservice option is giving me this error: You cannot remove FireWire because there aren't any other network services on FireWire. – Asker Aug 25 '12 at 23:40
Was that the last network interface? – da4 Aug 26 '12 at 15:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.