Prevent Insecure Booting Of Your Mac 51
maxphunk writes "So you can boot anyone's Mac using a CD or (for newer machines) mount the hard drive using target disk mode. Therefore, your machine isn't secure, right? Stock, yes; otherwise, no. Apple has a neato utility described here that eliminates this problem and more, using Open Firmware Password Protection. I have installed it on my iBook (late 2001) and I am definitely pleased with the results." It requires Mac OS X 10.1 or greater, and prevents things like starting up in single user mode, verbose mode, resetting PRAM, and more.
Reset Switch? (Score:1)
Re:Reset Switch? (Score:3, Informative)
The hardware reset starts the machine reading at the beginning of its onboard ROM (or wherever the reset address is set to) and so it immediately starts executing code that wants the password.
The way around this is to grab a the hard drive out of the machine, and put it in an external firewire case, attach it to another machine that boots from its internal hard drive
This password protection is basically a deterrant, but not ultimate security.
Re:Reset Switch? (Score:1)
that's right, it won't stop a determined hacker. If they want what's on your machine, and they have physical access, they'll get it.
But where this falls down is that it makes it a *real* bitch if you need to legitimately boot off a CD - for example, something bad happens to your install. Unlikely with OS X, but still a remote possibility.
-- james
Re:Reset Switch? (Score:3, Interesting)
Seriously, is it more than that? I wouldn't have thought so.
Re:Reset Switch? (Score:2)
Re:Reset Switch? (Score:2)
I think we are considering the wrong tools for different jobs here.
The OpenFirmware password should be used to disallow usage of your machine as a whole (hardware stolen etc) and disallow a weak attempt at theft of private info from the machine (most attempts would be weak, the average joe is not an elite cracker or even script kiddie).
High protection of your valuable information should be kept inside an AES-128 encrypted disk image. If they can get your data out of that (stored with a strong password), then they are pretty damned determined!
At the end of the day, suffering a loss of hardware can be something hard to avoid. You need to decide how much you are willing to spend to prevent the theft of hardware. Securing the data is the easy part.
If everyone secured their Macs with the OpenFirmware password, thieves might soon avoid stealing them since their value to purchasers plummet. Theives would not be able to demonstrate that "they own the machine" and that the machine is usable to a private buyer, money-lent shop, etc. I know many stolen goods are sold on the street without any demonstration, though theives selling useless hardware will soon get a bad reputation for supplying useless goods and thus avoid those goods.
It should come pre-enabled with OSX, since the BIOS queries for a password, allowing the rightful owner to protect their hardware.
Re:BIOS Password. Big deal. (Score:5, Interesting)
Historically, Apple cared not to add password protection to their first Macs for the same reason that you don't expect someone to ask for your papers just to use your toaster. Apple's original intent was to design the Macintosh for use as an appliance--something that didn't require a science degree to use. Easy. Efficient. Simple. NOTHING on a Macintosh was meant to be complex. That is why we STILL have only one button on our boxed mouse. This is a fundamental difference in how Apple and other companies, particularly Microsoft, design their products. If you, the user, want complexity, you're free to do so, but Apple won't screw their product by adding something that many do not need or want, and sometimes compromises the whole box. Perhaps you should think about WHY PCs had to have password protection to begin with, so long before Apple supported it on their hardware? Compensating for something, perhaps?
Recent changes to Apple hardware such as Open Firmware are extensions to this simplicity. In the past, Macintosh systems had fixed ROMs where the system bootstrapping code and portions of the system software was stored. This was expensive (these were custom chips) and inefficient over time (OS upgrades would have to hack over the hard code in the chips, if it could). Old systems could not be modified to handle more advanced OS tasks after a point.
Rather than go towards the use of the very inefficient and extremely complex BIOS format of the PC world, Apple chose OF, something that STILL didn't require users to go nuts when making hardware changes, and added similar BIOS functionality, including flashing. As an "old Mac user", you should know this, so that's why I doubt your sincerity, much less your knowledge base.
Apple is simply responding to the current world's need for greater security, particularly with the increased potential for cracking Mac OS X (it's basically BSD, after all). Apple may want a Macintosh to be free and open, but its just not that kind of world. Sure, password protection isn't not necessarily innovative. But it's a positive step in an otherwise dull market where innovation is still an exception, not a rule.
What you get out of your PC creations is your business. I make my PCs, too. They make great game boxes, but I doubt I'll make anything with it. With your kind of logic, Apple will never impress you. When you really need something that Apple's products solve for you, please buy it and enjoy it. Otherwise, I'm sure you can post to applesucks.com and not waste our bandwidth.
Apple has provided quite a lot to the computer industry. I don't remember Microsoft or Tovalds discussing how digital video would be a neat thing to do. I don't remember Bill Gates discussing the merits of FireWire or USB before 1998. I've never found a computer as easy to open and install new components as a Power Mac tower (and I've used a lot of computers since 1977). I would love for other companies to have a quarter of vision like Apple (Sun is one of the few exceptions: Java was a marvelous concept), but it's not that world. Microsoft earns its "borg" nickname for a reason. And they control the PC hardware design by controlling the OS, which is a shame: PC hardware should've been free of interrupts and other stupid things that Macs and other advanced hardware like SGIs have never dealt with.
Which is worse: Apple offering password protection at a time where it needed it and the OS fully supported it, or PC users being stuck with a bootstrapping process bound in an archaic resource management system that's so old that it makes my wristwatch seem advanced?
IAAAST (I am an Apple Service Technician)
Re:BIOS Password. Big deal. (Score:2)
This is why I much prefer Woz's old philosophy. The Apple ]['s actually came with schematics. The Macs came with "tamper-resistant" cases. That says a lot to me about how little Apple respects tech-savvy users. They only want to build an appliance for the average user, closing it off to the point of not even making it well known that their OpenFirmware had this simple functionality which would be so useful for labs and other public Macs. (That is, if the below post about this functionality having been there for so long is accurate).
As a user who actually knows what he's doing, I feel condescended to by Apple's behaviour constantly, which is why I remain a PC user. When I graduated collage I couldn't afford a PowerMac, and very reluctantly bought a used 100MHz 486DX4 laptop. Practically burnt a hole in my leg when using it for extended periods, but it ran Windows 95 well enough and did everything the Macs did, but with less finesse and speed. By the time I could afford a new computer, I'd educated myself enough to realize that although I *much* preferred the MacOS, despite its cooperative multitasking at the time, I'd be able to build a PC from quality parts that would perform much better and be much more upgradeable. Today my PC is based around an Abit motherboard with onboard RAID; Abit not only lets users know what's in their BIOSes, it encourages tech-savvy users to change features and settings by providing a utility to change registers of a binary BIOS file before flashing to the new one. They don't hide features from me for years. I like having control over my hardware, not being condescended to about it, which is why this OpenFirmware feature being made available after so many years is so unimpressive. I love the MacOS, but I loathe the closed nature of the hardware.
> it's a positive step in an otherwise dull market where innovation is still an exception, not a rule.
Again, providing something in the Mac world which has been available on most PCs for many years, isn't innovation at all. I'm perfectly willing to award Apple the software innovation crown it richly deserves. But it doesn't deserve any credit for hardware and low-level logic innovation. In that regard it's still trailing behind x86 machines, since while Apple's logic is newer and cleaner, its functionality trails behind x86 counterparts. x86 users get the fastest and newest of almost every feature first, with quite a lag before Mac platforms get them. We get faster memory, faster and larger ATA device support for newer ATA standards, faster graphics accelerators, and the ability to interchange most of this technology with our older hardware. The few exceptions I can think of where Apple got the hardware first are areas where PCs very soon caught up, often with the mere purchase of a $40 card, like USB and Firewire. The SuperDrive (of course, to guys of my vintage that brings up memories of Apple's cool floppy drive that read both PC and Mac disks, but I digress) is the only clear victory I can give Apple for hardware innovation in a very long time, and even so I can now buy one OEM for my PC for $300.
It all just underlines what I found odd about this little bit of functionality, present in "primitive" x86 BIOSes for many many years, making it to the Apple section of
> With your kind of logic, Apple will never impress you.
Not with Steve's reality distortion field dictating everything at Apple, unfortunately. Look! It's a small cube! Buy it; it's innovative! Look! An LCD stuck onto the computer! Buy it! It's innovative! Look! We've integrated the power and DVI signals to produce an incompatible adapter so you can't use third-party displays without buying clunky adapters! It's innovative!
Again, I like MacOS' simple, intuitive design. That would be why I have Basilisk II running OS 8 on my PC for playing old Mac games, and for a symbolic link to my loving relationship with MacOS. That's also why, if the PCI card (by one of the Mac accelerator card companies in conjunction with Microcode Solutions) which is still under wraps which will allow a real G3/G4 processor to be used in an emulation of older iMacs does become available, I'll buy it and gladly run OS X at about native speed on my x86 box. But OS X's beautiful design isn't worth the closed design and great expense of the hardwae it currently runs on.
> , I'm sure you can post to applesucks.com and not waste our bandwidth.
It ain't your bandwidth, pal. This is the Apple section of
> Apple has provided quite a lot to the computer industry.
Problem is, Apple never follows through. It starts something, and then sits on the pot while other companies do their business and makle it better than Apple ever did. You mentioned video: this is why Apple has to pay big studios to release content in QuickTime, while that really crappy Windows Media quietly took over the world., and why RealPlayer, which by all rights should not exist, still does. And while Windows Media format really, really sucks, the actual Windows Media Player has become far superior to QuickTime in its support of so many formats, and in the very simplicity of its design. QuickTime has an ungainly interface which Jobs insists on for aesthetic rather than practical reasons, with functionaility not present which has been in WMP since version 6.4, like remembering that I always want my videos to play double-sized or restarting as well as stopping when the screen is clicked in succession. I can't say whether these features are present in the Mac versions, but they are entirely lacking on the Win32 versions, including the beta of QuickTime 6.0. Apple starts a lot of things, and then never takes them to their fullest potential. It ties itself to closed and proprietary bits moreso than Microsoft does, since at least Microsoft doesn't exercise near-total control over the hardware.
> I've never found a computer as easy to open and install new components as a Power Mac tower
IBM's snap-open cases of the same vintage, if not a bit earlier, were just as nice if not moreso. Push in the sides, pull the covr up, instant access. Beautiful.
> Microsoft earns its "borg" nickname for a reason.
Yes, they do. I'm by no means a Microsoft fanatic. It's not the Microsoft OSes I love; it's the x86 hardware. Because, as much as I love MacOS (and believe it or not I do), I love having the added control and flexibility over my PC and my hardwae and upgrade paths. Something as simple as a BIOS password wasn't even available to typical Mac users until recently. Not to mention the higher-level hardware, like my beloved ATI All-in-Wonder card with its sweet sweet Guide+ driven TiVo functionality, hardware DVD acceleration that puts a Mac's to shame (the picture is much better; I have compared), etc. ATI's own TV products for the Mac don't nearly offer the ame functionalities and qualities.
That's just an example, of course. It's the x86 hardware's openness I love, not Windows or x86 Linux. In contrast the Mac field of available hardware and software is...paltry. I really do hate to say that, since I do prefer the Mac OS. But its hardware just sucks.
> And they control the PC hardware design by controlling the OS
Not remotely true. PC hardware manufacture is wide-open, and writing drivers for Windows is something any company can freely do. Not just that, but Microsoft has even on rare occasion offered to write their own drivers into the OS for compatibility with older hardware that nonetheless has a large user base--Voodoo video cards, for example. Microsoft offered to write XP drivers since nVidia had purchased 3dfx and discontinued support for 3dfx cards; but nVidia refused to allow Microsoft to do so.
At any rate, the hardware is wide-open, and unconstrained--unlike in the Mac world, where hardware makers often want to make their products available to all Mac users, and so cripple their devices in order to be compatible with the smaller Macs with little or no internal expansion. Hence expensive Firewire peripherals which could have been IDE devices at half the cost. Hence crippled devices like ATI's TV devices for the Mac, which haven't the same functionality since they're external and don't have the PCI bus' data rate.
In other words, there are no hardwae constraints in the PC world, other than what none of the dozens of motherboard manufacturers, drive manufcturers, etc., want to do. MS decides nothing, except for a few "XP Compatible" or other designations which are essentially meaningless since you can still install the hardware and drivers even if the drivers aren't approved.
> PC hardware should've been free of interrupts and other stupid things that Macs and other advanced hardware
> like SGIs have never dealt with.
You have to blame IBM for that, not Microsoft, since IBM is responsible both for the basic PC design and the BIOS functionality. Aside from which, none of that matters except in very rare cases anymore, since ACPI compliance is the standard. Blaming PCs for IRQ conflicts is a bit passe, don't you think? That would be like me finding fault with the 16-bit bus which crippled many 68k Macs. It';s true, but it doesn't matter anymore. All modern PC motherboards have ACPI, which typically eliminates all problems in recent OSes. A small number of users have complaints, but on the whole the issue is dead.
> Which is worse: Apple offering password protection at a time where it needed it and the OS fully supported
> it, or PC users being stuck with a bootstrapping process bound in an archaic resource management
> system that's so old that it makes my wristwatch seem advanced?
ACPI isn't archaic, it's a modern way to deal with low-level processes in such a way as to be compatible with the archaic. I find it very elegant in fact that I can run nearly any PC OS made in the last 20 years, and most PC software made in the last 20 years, and yet still outperform the highest-end Macintosh available on almost all applications and benchmarks. If your computer is so much better because of its "superior" clean hardware design, why does mine kick its ass? And to get back to the topic, why is yours only now getting fatures my platform has had for at least 6 years?
Archaic or not, the PC platform has both near-total backwards compatibility, and the ability to eat G4 towers for breakfast. While I greatly prefer the interface of the Mac OS, it isn't worth the deficient hardware.
Re:BIOS Password. Big deal. (Score:2)
Your points are all valid, so we'll agree to disagree. And "fanboy" I ain't. I'm a computer person, not "Apple person." Like you, I have my choices, but I'm obligated to make good choices for my work, and many of them aren't Apple related. It's hard to determine from your comments which platform you would prefer if cost were not a factor.
Steve runs the company. This can (and has) changed, but Apple was nearly killed from that change. The "magic", if I dare to use such a word, comes from Steve Jobs and his "screw you, I like it THIS way" sort of attitude. It's not for everybody. Today, it tends to move things forward where everyone else in the industry appears moribund. I don't think I'd like the guy personally if I met him--but I appreciate what he does for his company, and the products he creates keep me employed and a few less things to worry about than whether my SMART drive settings were on or if I put that last jumper on wrong.
I don't buy the hype. I only have optimism because working dominantly with Apple, with all its highs and lows, requires it. But I recommend to users what they need, not what I like. Need to do video? An iMac or Power Mac. Need to write a letter and surf? A PC. Tight budget? PC. Hate fighting with a computer? Mac. It's not a complex formula, and I would be jobless if I were strictly an Apple proponent.
Not everyone wants to get their hands dirty. If that toots your boat, great. Innovation is subjective firsthand. Few people debate that Apple was innovative when it introduced the Macintosh initially. I guess we can really judge that much, much later.
Sounds like the traditional PC homebrew style is best for you. It's a fine choice. It's just not something that everyone can do, and I don't presume that they can build their own box. Hence my rant. We are in agreement on one thing: Woz is a genius and was the quintessential homebrewer.
Re:BIOS Password. Big deal. (Score:2)
Re:BIOS Password. Big deal. (Score:2)
Forget? (Score:1)
Actually (Score:1)
Re:Actually (Score:2)
I'd be far more worried about that iBook getting stolen than getting cracked...
Re:Forget? (Score:1)
Re:Forget? (Score:2)
Re:Forget? (Score:1)
Three ways to reset the password (Score:2)
Warning: The Open Firmware Password can be reset and changed by any one of the following:
1. By any Admin user, as designated in the users pane of System Preferences (or in Server Admin).
2. Via physical access to the inside of the computer.
3. When the computer is started up in Mac OS 9.
No computer is secure if you have physical access to the computer.
wow, cool... (Score:1, Offtopic)
Re:wow, cool... (Score:1)
Re:wow, cool... (Score:2, Insightful)
Re:wow, cool... (Score:1)
Re:wow, cool... (Score:1)
Forgot the OF Password? (Score:4, Informative)
Fear not! According to the securemac site [securemac.com] and the macosxlabs site [macosxlabs.org], just do the following:
I'm not sure if just removing the PRAM battery will also reset the PRAM or not in this case.
Is this secure? Well, it depends on your situation. If you are in a lab situation and you don't want the students booting off CDs, ZIPs, external hard drives, etc., for their hax0rish needs, then this works OK. It's easy to spot someone opening up a computer and swapping out ram, etc.
For your own machine? Probably more trouble than it's worth because it causes problems with firmware upgrades, etc. If someone has physical access to your machine, they can get the data off by using the above procedure or by the hard drive swapping someone else mentioned.
Bottom Line: If you have sensitive data on your machine, you should encrypt it even if you have OF password set. In general, if you let someone have physical access to a machine, assume they can get access to all the data on it.
Re:Forgot the OF Password? (Score:2)
Re:Forgot the OF Password? (Score:2)
Re:Forgot the OF Password? (Score:1)
It's hard as hell to find a lock to fit it, but once locked down, you cannot open it. I found a cable-type luggage lock that fit.
Re:Forgot the OF Password? (Score:2)
The padlock itself may be able to laugh at bullets, but the little tab of lightweight metal it's attached to is about two seconds work with a Dremel.
Locking a computer case that way is about as effective as putting a bulletproof window into a cardboard wall. It's the illusion of security, nothing more.
Re:Forgot the OF Password? (Score:1)
typical startup session with this mode on
Pi
Good, Basic Protection (Score:5, Insightful)
Open Firmware protection has been around since the Blue & White G3 (maybe the original G3) but wasn't really endorsed by Apple until now. I think they really wanted to make a formal way to configure it. Before this, users had to boot into OF and enter some arcane commands.
Basically, all Macs made since late 1999 work with this, but original and Blue & White G3s as well as early iMacs (made in 1998 and 1999) don't qualify. That doesn't mean you can't attempt to use the OF password features available on these systems, just that you may not be able to use Apple's utility to configure it since the firmware versions don't match.
As someone already said, all bets are off when a hacker has physical access to the computer. But, combined with physical deterrents such as locks and proper security (rlogin off, password on screen saver, proper admin and user accounts, etc.), this really helps teachers and other sysadmins who need to keep kiddies or college kids from overriding the system's security and installing or copying stuff.
Apple hardware has really needed this for a long time, and I couldn't endorse it until Apple did since it's a CYA thing.
Re:Good, Basic Protection (Score:1)
I read this on the Apple Care page linked to this article:
Hardware Requirements * none
But from what you say, this isn't true.
For what it's worth, yaboot, the Open Firmware boot loader that comes with most (all?) PPC Linux distros, has password protection as well. (http://www.debian.org/ports/powerpc/inst/yaboot-
im screwed! (Score:2, Funny)
we hacked an entire room of G4's just to put on our Wacom drivers so we could use our tablets to do homework.
An open firmware password is just a deterrent (Score:2, Informative)
Bottom line, the Open Firmware password is a Maginot Line. It's great until someone realizes they can go around it. You'd better be ready to use other utilties or practices in conjunction with the password.
Well geez, people... (Score:1)
Disables Firewire Target Disk Mode (Score:2, Informative)
Re:Disables Firewire Target Disk Mode (Score:1)
Re:Disables Firewire Target Disk Mode (Score:1)
Re:Disables Firewire Target Disk Mode (Score:1)
yeah, and those very useful functions that are disabled make your machine less secure, so disabling them makes the machine more secure...
it's obvious you just don't get it.
Re:Disables Firewire Target Disk Mode (Score:1)
Well, there's always this trick... (Score:2, Informative)
Remove the internal hard drive, or ensure that there is no OS installed on it (data only), set up an external firewire drive with everything you need (OS, Apps, etc.), and set the system to boot from that drive. When you're done, take the hard drive with you.
Alternatively, you could also boot this same system off an OSX server volume (ala diskless Unix workstations) Apple demonstrated that capability with an early dsitro of OSX Server to 50 diskless iMacs a while back. Here's a reference: http://docs.info.apple.com/article.html?artnum=60
Re:Fails, and also Fails. (Score:1)
So, if the system is set up to only boot off the network server or it is set to boot to a specifically named removable hard drive (not sure if you can do this with Target Disk Mode), then it should be a bit more secure. This, of course, precludes keyboard taps to capture passwords, etc.
laptop theft (Score:2, Insightful)