I have set all of the options possible as well as the security setting in OpenFirmware:
setenv security-mode full
But I need to get a laptop back with a key lock and a cinder block so no one can take it. However, mac laptops are really just attack boxes and not meant to be secure.
:-)
shirkdog http://www.shirkdog.us
-----Original Message----- From: bt@xxxxxxxxxxxx [mailto:bt@xxxxxxxxxxxx] Sent: Saturday, July 17, 2004 8:17 AM To: bugtraq@xxxxxxxxxxxxxxxxx Subject: Re: Mac OS X stores login/Keychain/FileVault passwords on disk Importance: Low
FWIW: You can enable the security features of OpenFirmware on modern Apple hardware, such that things like "boot from CD", "target disk mode", etc, are all disabled.
FWIW this is utterly worthless.
It adds at least another barrier for people to have to get around to get your data. More information is available via a Google search, but the following URL is a pretty good reference:
http://www.mactipsandtricks.com/tips/display.lasso?mactip=3D118
To quote myself:
http://www.seifried.org/lasg/system/index.html
Unfortunately if you are using Apple hardware you cannot secure the boot process in any meaningful manner. While booting if the user holds down the command-option-P-R keys it will wipe any settings that exist, there is no way to avoid this. About the only security related option you can set is whether the machine automatically reboots or not, this is useful for servers to prevent a remote attacker from changing the kernel for example (which require a system reboot). Hold down the command-option-O-F keys to access the OpenFirmware and from there you need to: go> setenv auto-boot? FalseHowever because a local attacker can easily flush the settings there is no inherent security. If you need to use Apple systems as servers then it is highly advisable to lock them in a cabinet of some sort. As workstations in a public area your best solution is to automate the reloading of the OS to speed recovery time.
Kurt Seifried, kurt@xxxxxxxxxxxx A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/
_________________________________________________________________
Don?t just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/
