Date: Sat, 17 Jul 2004 05:17:28 -0700
From: "Kurt Seifried" <bt@...fried.org>
To: <bugtraq@...urityfocus.com>
Subject: Re: Mac OS X stores login/Keychain/FileVault passwords on disk


>FWIW: You can enable the security features of OpenFirmware on modern Apple
>hardware, such that things like "boot from CD", "target disk mode", etc,
>are all disabled.

FWIW this is utterly worthless.

>It adds at least another barrier for people to have to get around to
>get your data.  More information is available via a Google search,
>but the following URL is a pretty good reference:
>
>http://www.mactipsandtricks.com/tips/display.lasso?mactip=3D118

To quote myself:

http://www.seifried.org/lasg/system/index.html

Unfortunately if you are using Apple hardware you cannot secure the boot
process in any meaningful manner. While booting if the user holds down the
command-option-P-R keys it will wipe any settings that exist, there is no
way to avoid this. About the only security related option you can set is
whether the machine automatically reboots or not, this is useful for servers
to prevent a remote attacker from changing the kernel for example (which
require a system reboot). Hold down the command-option-O-F keys to access
the OpenFirmware and from there you need to:
go> setenv auto-boot? FalseHowever because a local attacker can easily flush
the settings there is no inherent security. If you need to use Apple systems
as servers then it is highly advisable to lock them in a cabinet of some
sort. As workstations in a public area your best solution is to automate the
reloading of the OS to speed recovery time.

Kurt Seifried, kurt@...fried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/

Powered by blists - more mailing lists