4

A friend tells me that on OSX, bypassing password and getting into user's files is very easy (especially when hard disk not encrypted, but protected with user's login password). He tells me this is how it would be done:

  1. shut down the mac
  2. hold Cmd+s
  3. boot up the mac
    that is all you need for basic root access
  4. mount -w /
    to get basic read/write

I can't believe it would be that easy. Is he talkin cr*p or what?

|improve this question
  • 10
    Same with any drive that isn't encrypted, no matter what OS it would normally boot to. If it's in your hand, you own it. – Tetsujin Feb 3 '17 at 18:13
  • 10
    From Microsoft's Ten Immutable Laws Of Security (Version 2.0): "Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore." – Gordon Davisson Feb 3 '17 at 18:24
  • Thanks, yes I know it is possible to bypass the password. But is it that easy as in my question? – Guesthere Feb 3 '17 at 18:26
  • 9
    You don't need a password if the drive is in your hand. Gordon & I both said the same thing, in 2 different ways. The only way to be safe from that is for the drive itself to be encrypted. No computer or OS is any different in that regard. Bypassing the login password is actually a pointless exercise if what you want is the data off the drive. Just move the drive to another machine & the data is yours. – Tetsujin Feb 3 '17 at 18:39
  • It's the same on Windows or any OS. If you have the disk and the information is not encrypted, you can do whatever you want to it. – Derek 朕會功夫 Feb 4 '17 at 0:34
7

I just did it on my MacBook Air with macOS Sierra 10.12.3 (latest macOS as of 02/2017) and that is indeed actually how it can be done.

As Tetsujin wisely points out, if you have the machine in your hands, then no OS is immune to a simple 'read the disk' attack - unless the drive itself is encrypted.

Of note Cmd+s invokes "Single User Mode" and there are other ways to bypass the login requirement, such as booting into local or internet "Recovery Mode" or booting the drive in "Target Mode". To avoid abuse of these options, you could also use a Firmware Lock. Per the article about "Recovery Mode":

Enable a Firmware Password to Lock Down Your Mac’s Hardware Even with FileVault enabled, someone with access to your Mac could still wipe it from recovery mode and set it up as a new system. A firmware password can protect against this.

This will also help if you don’t want to use FileVault encryption for some reason, but do want to prevent people from changing your password and accessing your files. A firmware password also prevents people from booting your Mac from other devices — like USB drives or external hard drives — and accessing your files if they’re not encrypted. Someone could still rip the hard drive out of your Mac and access its files on another device if you just use a firmware password without encryption, however.

If you set a firmware password, you’ll need to enter it before booting into recovery mode or holding the Option key to boot from a different device. Just powering on your Mac normally without doing anything special won’t require the password, so it isn’t too much additional hassle.

Also of note, per this answer, the impact to performance from activating FileVault on computers using SSD drives is negligible. The only difference the user will likely notice is the need to enter a password prior to booting... and remembering where you stored your "recovery key" should you ever need it.

enter image description here

|improve this answer
5

Enryption is opt-out so anyone that doesn't have their boot drive encrypted chose to do so out of a decision or inattention/ignorance.

Physical control of the computer gives you total control of the contents of the storage. Before Yosemite, you had to opt in to encrypt your data, so I suppose this is possible / default based on the version of macOS you run up against.

You could also enable a firmware password to prevent booting to single user mode or target disk mode if you wanted a little more protection but had to opt out of encryption of the drive.

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .