Apple EFI firmware passwords and the SCBO myth
reverse.put.as
reverse.put.as
[1] https://dogber1.blogspot.com/2009/05/table-of-reverse-engine...
Presario FTW!
with this feature, Apple HQ can give a service center the ability to clear a particular firmware password without giving them a universal backdoor (hardware or software).
This doesn't take very long. Maybe 5 minutes to disassemble the machine.
As for hardware, you can flash SPI chips using a Teensy and a clip chip. [1] The total cost of parts is under $30.
Incidentally, I highly recommend investing in one of these if you're doing firmware development for routers. It's so much easier to flash a backup than muck around with TFTP.
> because when a firmware password is set, a Mac requires the password to choose a different boot disk.
This is hardly unique to Apple. Most PC laptop manufacturers also disable changing the boot device or choosing a temporary boot device when a setup password is enabled.
> with this feature, Apple HQ can give a service center the ability to clear a particular firmware password without giving them a universal backdoor (hardware or software).
Um, this is how it works for PC firmware passwords as well. Unless there is a keygen available, most modern implementations use a hashed value from the serial number or hard drive as the master unlock password. It's unique to the laptop being unlocked.
It makes me somewhat happy in a weird way to think that, even in notoriously locked-down and secretive companies like Apple, there are individuals who don't believe in and subvert the company's attempts to have sole control of its products. We have these individuals to thank for schematics, parts, and a lot of other material that feeds the third-party repair industry.
Makes me wonder if their SCBO generating system is connected to their stolen serial number db (probably not)
Also those which have been recycled, or which someone has locked out accidentally, or deliberately to scam someone ( https://news.ycombinator.com/item?id=7993435 ), etc. Used computers from companies often have BIOS passwords that no one bothered to clear before sending them off. Not every computer with a password its current owner doesn't know is a stolen one. That's why I think this is a good thing --- I believe in the fact that if you physically own something, regardless of how you came to own it, you should truly "own" it.
Or the good old FireWire DMA trick?
Even when they did, enabling a firmware password disabled FireWire DMA, even after boot. (And I'm not sure it was ever active during preboot.)
Edit: I guess this is the slightly better answer than simply yes or no:
"If you lost your firmware password you can now reset it yourself as long the SPI flash chip is not the new BGA type (newer Macs are using them but there is a sneaky debug port that can be used for this same purpose!). You just need a device to dump the flash chip, remove the variable and reflash the modified version, or directly remove the variable (I always prefer to full dump and reflash). Of course this information can be used by thieves selling stolen Macs, but given that there are already defeat devices being sold all over the web, this post does not reveal any previously-unknown secrets."
In theory only Apple employees can sign the unlock files. How many employees have access to sign these unlock files? 10? 100? Every low-level employee? There may be some "bad apple" employees selling the signing of unlock files, some social engineering to trick Apple into providing signed files they shouldn't be, or a vulnerability the researcher has not found that allows attackers to bypass the public-key crypto implementation.
The number of people that can unlock it is probably quite high, this isn't that different than removing an apple id from the device you need to go to the apple store with the device and proof of purchase and they do it for you.
I’d make a large bet that the same is true for removing Apple ID activation locks from devices.
While It's likely that Apple has probably has some audit trail on these requests just the sheer amount of devices that are likely to need to undergo such procedure make it unlikely that there is some room in Apple HQ where 5 highly trusted engineers issue those files.
Even if you don't count all the end users that lock their devices and can't unlock them all the devices that are returned to apple, go in for a hardware replacement/fix or recycling need to undergo a similar procedure. So If I would be asked to wager on how this process is done it would be that it's an automated process with an audit trail just like what many organizations use to reset account details, passwords and other things.
To foolproof the system, you would need less than a dozen people trusted with the ability to sign the files, and require the device and proof of purchase to be shipped to them rather than allowing unlocks to be authorized remotely.
It's unfortunate that the last line of defense against a stolen machine, the firmware password, has a backdoor. I'd have expected a firmware password on a MacBook to be just as difficult to bypass as an iPhone's passcode. Apple refuses to unlock phones, but will gladly remove a firmware password on a real machine. Disappointing.
Firmware passwords are more like Activation Lock for iOS. They make it harder to reuse a stolen computer and stop some less-invasive tampering, but don't offer any guarantees about protecting your data.