Timeline for MacOS Recovery Mode Risk
Current License: CC BY-SA 4.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 18 at 15:31 | answer | added | bmike♦ | timeline score: 1 | |
| May 18 at 15:25 | vote | accept | CommunityBot | ||
| May 18 at 15:25 | vote | accept | CommunityBot | ||
| May 18 at 15:25 | |||||
| May 18 at 12:16 | history | became hot network question | |||
| May 18 at 10:02 | answer | added | Gordon Davisson | timeline score: 3 | |
| May 18 at 7:04 | comment | added | user522753 | @Allan I just want to gauge the potential risk and understand the way macOS protect its system. For example, how difficult would it for a malware/virus to alter boot partition or recovery partition. | |
| May 18 at 7:00 | comment | added | Allan | Let's put this another way: What is the practical problem you're trying to solve here?. Theoretical questions about situations that don't yet exist are considered off topic. | |
| May 18 at 6:50 | comment | added | user522753 | @Allan I understand the potential risk, I'm just wondering how serious the risk is compare to other virus. Are there viruses/malwares that try to mess up system boot or recovery partitions? | |
| May 18 at 6:43 | comment | added | Allan | So, then the answer is "yes" you'd be the nefarious one with the nefarious script. Every computer has a point at which it completely vulnerable to attack. Here, since you must be in possession of the device to run your custom script with supposedly nefarious code, yes, you could potentially leave something behind. But ultimately, that would be your doing, not a vulnerability of the Mac or macOS. I think you're over complicating things. | |
| May 18 at 6:42 | review | Close votes | |||
| May 24 at 3:11 | |||||
| May 18 at 6:35 | comment | added | user522753 | @Allan the script was ran on macOS recovery mode on Mac hardware. The script is intended to purge unused Asahi Linux partition from my Mac. | |
| May 18 at 6:34 | comment | added | Allan | Again, you must be in possession of the Mac to put it in Recovery Mode. Are you the nefarious one with this nefarious script? It' still not clear why you need a special script to wipe the drive since those methods are baked into macOS Recovery. | |
| May 18 at 6:30 | comment | added | user522753 | @Allan running the "wipe-linux" script in Recovery Mode is the only way for me to remove unused volumes in "/System/Volumes/iSCPreboot/"; later on I kind of realize how dangerous this could be given the fact that in Recovery Mode the privilege seems to be a lot higher than usual. I am more wondering if a malware/virus injection in Recovery Mode would be more fatal and harder to detect because of the elevated privilege, or is MacOS secure enough that the "Read-Only" partitions are difficult to mutate from a malicious script. | |
| May 18 at 6:24 | comment | added | Allan | You don't run 3rd party scripts in Recovery Mode in macOS. You have to have hands on with the device to enter Recovery. That's my point. Are you saying that you, yourself is the nefarious actor here? I think there is a misunderstanding of Linux Recovery and macOS Recovery and you're applying what Linux does onto macOS. | |
| May 18 at 6:21 | comment | added | user522753 | @Allan one example, you can't write to "/System/Volumes/iSCPreboot/" in normal MacOS even with sudo privilege, but that is easily doable in Recovery Mode. | |
| May 18 at 6:20 | comment | added | user522753 | @Allan you are given elevated privilege in Recovery Mode; the exact wipe-linux script is here: github.com/AsahiLinux/asahi-installer/raw/main/tools/… if you look at the last few lines, it removes /System/Volumes/iSCPreboot/$1 where $1 iterate through unused volumes. Such operation is not possible in normal MacOS environment even with root. | |
| May 18 at 6:03 | comment | added | Allan | macOS doesn't use Recovery Mode to remotely do anything. Recovery.Mode is how macOS is reinstalled you must be in possession of the device to utilize it. So, I am not understanding where a "script" would be introduced to send things "south." | |
| S May 18 at 4:12 | review | First questions | |||
| May 18 at 8:15 | |||||
| S May 18 at 4:12 | history | asked | user522753 | CC BY-SA 4.0 |