1

I'm unsure whether this was possible in OS X Yosemite, however OS X Mavericks has a security flaw in which : Should a individual have physical access to a computer, he need only launch in Single User Mode, mount the hard drive and remove the file ".AppleSetupDone" in the Directory "/var/db/". In doing so, tricking the computer into thinking it is its first ever launch and allowing the individual to setup a new Admin account.

OS X El Capitan apparently has this new security feature known as System Integrity Protection, which limits root access to an array of Directories including: /system, /bin, /sbin, /usr, /etc, /tmp and /var.

My Question is:

Will System Integrity Protection protect the executable .AppleSetupDone from deletion, and the subsequent exploit?

|improve this question
  • Just as an FYI, to you and anyone else reading this, SIP does many things, but it does not solve all security issues everywhere. Some people make the mistake of thinking this. Good question though. – Ezekiel Elin Dec 7 '15 at 22:02
4

No. .AppleSetupDone isn't an executable, it's just an empty file. SIP does not include /tmp or /var. These are directories that need to remain write able during normal use.

|improve this answer
  • 1
    ahh, ok i stand corrected. Wikipedia clearly needs to update its information, and i need to stop relying on Wikipedia. – user4493605 Nov 18 '15 at 13:02
4

If you'd like to prevent a user from performing this attack, you can add a Firmware Password. By doing this, you prevent booting into Single User Mode without entering the password, and from booting from an external device. System Integrity Protection does not prevent this attack.

|improve this answer
  • 2
    Agreed. Even if SIP could protect .AppleSetupDone there are plenty of other ways to take over a computer in single-user mode. Protecting a computer against an attacker with unrestricted physical access is nearly impossible, but a firmware password makes it significantly harder to take over. – Gordon Davisson Dec 8 '15 at 1:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .