1

I'm working on securing my Mac completely and utterly. I may be going to China for a business trip and I've been advised to do this but not provided steps that work for a Mac.

Is it safe to say that by setting "IPv4 Configure" to disabled that this will make it impossible for anyone to violate my Macbook through either Ether or Firewire? Should I do similar for an IPv6 setting?

|improve this question
  • Can we assume you have physical control over the computer at all times and will not be forced to connect it to ethernet or firewire? The only complete and utter security is a computer in a room with no doors and no communication to the outside - so everything else opens the door to compromise. – bmike♦ Aug 26 '12 at 13:35
  • Security people may want to check your laptop inside a private room while you wait outside. They may take it apart, clone the disk, then reassemble it and give it back to you as if nothing happened. This procedure may not occur at the airport but discreetly in your hotel room when you are busy with some social event. – mouviciel Aug 26 '12 at 16:24
3

Most of your concerns and more can be found on the Security board of Stackexchange.

Here is a post discussing Firewire concerns: https://security.stackexchange.com/questions/17051/safely-disable-firewire-thunderbolt-patching-up-dma-exposure.

This is about mobile devices but the same principles are true: https://security.stackexchange.com/questions/11612/what-are-prudent-security-precautions-to-take-for-business-travel-by-people-with

And what you will eventually learn is that you will not be able to achieve:

securing my Mac completely and utterly

You should take basic precautions but if you are concerned about your Firewire and Ethernet ports; you probably won't be able to stop whomever is trying to attack you.

|improve this answer
  • Well, there is one way. I could open up the Mac and temporarily cut come wires, then solder them back together when I return. – Asker Aug 22 '12 at 22:33
  • 1
    @Mithras I meant that if you are worried about someone tampering with your computer through your Firewire or ethernet ports you are dealing with people that will most likely succeed in getting whatever they are after and would probably choose an easier path to do so. Therefore, you should focus on protecting yourself in more realistic ways according to the sensitivity of the data you have. – user142485 Aug 23 '12 at 13:29
6

Recommend taking a "throw-away" computer and not one you will continue using after returning. You're not going to be able to secure it just by disabling access (even with restricting boot).

|improve this answer
  • Perhaps putting files on an iPad is the best choice, if there's no need to move files around too much or run specific programs. – Asker Aug 25 '12 at 23:43
  • iPad would make it cheap enough to just discard it upon return home too. The risk of data theft while there is bad, but far worse is the possibility of continuing data theft, on your now hacked/modified device, once you return home. – Brian Knoblauch Sep 17 '12 at 12:46
2

Turn on FileVault2 and set an OpenFirmware password. Shut it down rather than letting it sleep whenever it will be leaving your sight. That should protect you against any attack that could come over the Ethernet port or the Firewire port, although of course there's always scope for having your hardware hacked, e.g. by adding a keylogger to your keyboard.

|improve this answer
0

You can also remove the active network interfaces from the system; in the Network pane of System Preferences, highlight each interface and click the - (minus) button, or use networksetup -listallnetworkservices from the shell to show all available interfaces and then networksetup -removenetworkservice <networkservice> for each entry. (Use networksetup -detectnewhardware to re-enable everything.)

Again, physical security is paramount; encrypting your hard drive and setting an OF password will greatly delay an attack, but not be 100% effective in preventing one.

|improve this answer
  • The removenetworkservice option is giving me this error: You cannot remove FireWire because there aren't any other network services on FireWire. – Asker Aug 25 '12 at 23:40
  • Was that the last network interface? – da4 Aug 26 '12 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .