In the cast that malware and/or a trojan has infected macOS, can an attacker disable system integrity protection and inject code and do other harmful stuff? Can an attacker even discover your admin password before disabling sip as keylogging software would be needed? If he can't discover the password that way then lets say he guesses it because the passcode is really simple.

  • Do you mean the Apple ID account password? Or the admin password for your machine? (Both have separate security issues if compromised)
    – bjbk
    Mar 30, 2017 at 19:53
  • admin password for macbook
    – John Brown
    Mar 30, 2017 at 19:54

1 Answer 1


SIP itself is not an issue, since that requires physical presence to disable (to wit: rebooting the machine into recovery mode and running a terminal command). At no point during the process of changing SIP settings is your account password required.

However, there's an old adage in computer security: If someone has physical access to your computer, it isn't your computer anymore.

If a remote hacker has your account password, they could access various network services if they can reach the ports, get an SSH shell, impersonate you, and so forth.

If a hacker sitting in front of your keyboard has your account password, the hacker having your account password is the least of your worries.

  • is it possible to bypass sip
    – John Brown
    Mar 30, 2017 at 21:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .