Lion security flaw with "resetpassword"

Discussion in 'Mac OS X Lion (10.7)' started by NorthDakota91, Dec 13, 2011.

  1. macrumors member

    Sep 3, 2011
    Just yesterday I've discovered that anyone who has physical access to my Mac can easily reset just any password by using the "resetpassword" command from Lion's recovery partition. My question is: is there a way to avoid that?
  2. macrumors P6


    Jan 24, 2010
    Use a firmware password. This flaw is no different then boot the Mac from an external drive or cd.
  3. macrumors regular

    Oct 24, 2007
    I wouldn't really call it a "flaw". As any security guru will tell you, once somebody has physical access to your machine, all bets are off -- at that point, if somebody really wants access to your stuff, they can most likely get it one way or another. The best you can do is make it hard enough that they might lose interest first.
  4. macrumors G3

    Jul 23, 2002
    Sol III - Terra
    Two ways to avoid it. One is the firmware password. The other is Filevault 2. If the disk is encrypted, they wouldn't be able to use the reset password.

    If you're worried about data security and integrity, I would recommend the FileVault 2 route as the firmware password isn't 100% secure as Apple knows how to reset it, so I'm sure others do as well.
  5. macrumors 68020

    Jun 15, 2012
    If they have physical access to your Mac, they can boot it up in Target mode (making the whole Mac an external drive to another Mac), or take the drive out and mount it in an external case.

    The best way to avoid such problems are not to leave your expensive computer lying around, and place it in a locked drawer when you're not using it.
  6. macrumors 6502a

    Mar 8, 2008
    not with disk encryption. and the recommended methods provided previously.
    But, yes proper watch over your stuff is the first step.
    Also Back-ups are critical!
  7. macrumors 68020

    Jun 15, 2012
    Many people leave their laptops continually running, and don't leave a password to get past the screensaver.
    Some people let their dorm buddy use their laptop on the same account.

    In short, encryption is fine, but it's just one defence against some, but by no means all, of the security threats to your computer.

    Most thieves are not Tom Cruise trying to access your special data without you noticing, but will probably just wipe the disk and sell the laptop.
  8. macrumors 6502a

    Mar 20, 2006
    Washington State
    Common sense is your best defense.

    resetpassword is a feature not a flaw.
  9. macrumors 6502a

    Mar 8, 2008
    well when you support enterprise level systems it is critical regardless of how "Special" or "not special" the data is. even in basic users. never underestimate the maliciousness of thieves, a slight bit of personal data is all they may need to steal your identity, cause problems, etc.

    Also, tell me how you can erase an encrypted disk? if it were that easy it wouldnt be a defacto encryption process.
  10. macrumors 68020

    Jun 15, 2012
    I dunno -- erase it using Linux or Windows? I'd be surprised if diskutil didn't let you somehow, though.

    But yes, encryption is of course useful. And I would expect enterprise-level guys to be following a lot of procedure that most domestic users don't.
    I was merely trying to highlight other physical risks that are greater than "resetpassword".
  11. macrumors 601

    Jul 11, 2009
    Yeah, the Enterprise level equipment with sensitive data is locked in a limited-access secured data center.
  12. macrumors 6502a

    Nov 13, 2008
    not always true, such as with schools, or businesses with off-site work.

Share This Page