My friend's MacBook Pro was recently stolen. Fortunately, it was protected with a password. How secure is the built-in protection ?
Can thieves access the data on the hard drive, and at what difficulty?
2
-
2It should be noted that most mentions of Filevault in various answers relate to the original Filevault which protected individual user accounts via storing their home directories in an encrypted DMG, and not what we now call Filevault which is whole disk encryption introduced in Lion. Therefore some answers are no longer relevant to a user not noticing the date and assuming current filevault.– stuffeCommented Feb 13, 2013 at 0:25
-
Since this is not really related to your question I'll leave this as a comment. One word of advise if your friend thinks he has no chance of getting his computer back he can lock or erase the mac on Find My iPhone through iCloud's website or the app.– Tre SCommented Feb 15, 2016 at 17:15
Add a comment
|
3 Answers
It depends on exactly what you mean by:
it was protected with a password
If it means that they were using FileVault, then their data should be pretty much inaccessible.
If it just meant that they had a login password, though, all the thieves have to do is boot the laptop off another disk, and they'll have immediate access to everything on the internal drive.
-
6Just one caveat to go along with "their data should be pretty much inaccessible"... if their password was very simple, for example the user's name, a dictionary word or the same as the combination on my luggage, then an attacker could brute force the FileVault DMG file and access the contents.– JoshCommented Nov 22, 2010 at 13:05
If FileVault is not enabled, there are two easy ways to reset the login password in single user mode without even having access to another computer or installation media.
It doesn't reset the password of the login keychain, but the thief could still access most files normally. They couldn't use auto-fill in Safari or log in to accounts in Mail. But if you had set a webmail site to log in automatically and hadn't disabled the option to reset a password with an Apple ID, the thief could reset the Apple ID (it doesn't currently require answering security questions) and use it to reset the keychain password.
The hash of the login password (which is usually also the password of the login keychain) is stored in /var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8. In 10.7 it was easy to crack even relatively complex passwords by using DaveGrohl, but 10.8 switched to PBKDF2, which limits it to about 10 guesses per second per core.
The current version of FileVault is secure against currently well-known attacks, if best practices are followed.
Some older versions of FileVault had serious issues. See http://en.wikipedia.org/wiki/FileVault#Issues and https://discussions.apple.com/message/18835839#18835839 ; both have more detail. With older versions of and incautiously configured installations of MacOS, it's definitely easy to decrypt the contents of a FileVault-protected drive. Fortunately, those known issues in older versions of FileVault have been fixed.
Google for examples of some "best practices", such as the NSA's configuration guide for Mac OS X.
What was protected by a password is a key question... Do all accounts require a login password? Is there a boot-time password as well? Was Filevault (or other encryption software) used at all? Were good password practices followed? A chain is only as strong as its weakest link.
answered Feb 12, 2013 at 23:50
WHO'sNoToOldRx4Covid-CENSOREDWHO'sNoToOldRx4Covid-CENSORED
1,3102 gold badges14 silver badges33 bronze badges
-
I don't understand what are the serious issues that you think are present in the current version of FileVault. The Wikipedia link doesn't help (none of those sound like serious issues to me). The link to the Apple Discussions page doesn't seem relevant to current versions of FileFault. My understanding is that current versions of FileVault are secure and it's very unlikely that an average thief could access the data on a FileVault-protected computer -- the exact opposite of what you wrote.– D.W.Commented Feb 13, 2013 at 3:21
-
Sorry if I upset you, Matthew. I was just trying to help you improve your answer. If your re-read the first sentence of your answer, it certainly could lead a very different impression than what you said in the first first sentence of your comment.– D.W.Commented Mar 3, 2013 at 19:18
-
1P.S. When you mention "best practices" (where failing to follow them might endanger the security of the current version of FileVault), I think it would help if you listed them explicitly. One must enable FileVault and choose a good passphrase; would you care to list the other "best practices" that are needed for security? I suspect others who visit this question would benefit if you would care to elaborate.– D.W.Commented Mar 3, 2013 at 19:19
-
Thanks for the feedback. It looks like I tweaked my answer to make it clearer. Any further suggestions? Doh! I just realized that it was you who improved my answer. Yay. Still getting the hang of things on Stack sites, and/or they're changing. ('About' says I can't edit posts but I can - but my edits are moderated; you can edit my answer, but have <<2000 points...) Anyway, I guess the right thing to do now is to delete most of our comments, above? Interesting editing here...like Wikipedia, but not too much! :-) As for (not) being upset, NVC is helping me be better at that! Commented Mar 14, 2013 at 19:44
-
@D.W.: Re. "best practices": When answering, I started writing specifics, but decided it's probably best to simply say best practices, not re-answer. Others have done a good job already - with audit standards like ISO27001. gog.is/mac+os+x+security+best+practices shows the NSA's goo.gl/ineX4, etc. I wouldn't be surprised if there's a separate Q&A or or even series of questions, perhaps at <security.stack...> where you are so busy. There's so much - e.g. what I cover at elvey.com/insecure , no one else is covering! Commented Mar 14, 2013 at 20:07