Lion security flaw with "resetpassword"

Discussion in 'Mac OS X Lion (10.7)' started by NorthDakota91, Dec 13, 2011.

  1. macrumors member

    Joined:
    Sep 3, 2011
    Location:
    Italy
    #1
    Just yesterday I've discovered that anyone who has physical access to my Mac can easily reset just any password by using the "resetpassword" command from Lion's recovery partition. My question is: is there a way to avoid that?
     
  2. macrumors P6

    Intell

    Joined:
    Jan 24, 2010
    Location:
    Inside
    #2
    Use a firmware password. This flaw is no different then boot the Mac from an external drive or cd.
     
  3. macrumors regular

    Joined:
    Oct 24, 2007
    #3
    I wouldn't really call it a "flaw". As any security guru will tell you, once somebody has physical access to your machine, all bets are off -- at that point, if somebody really wants access to your stuff, they can most likely get it one way or another. The best you can do is make it hard enough that they might lose interest first.
     
  4. macrumors G3

    Joined:
    Jul 23, 2002
    Location:
    Sol III - Terra
    #4
    Two ways to avoid it. One is the firmware password. The other is Filevault 2. If the disk is encrypted, they wouldn't be able to use the reset password.

    If you're worried about data security and integrity, I would recommend the FileVault 2 route as the firmware password isn't 100% secure as Apple knows how to reset it, so I'm sure others do as well.
     
  5. macrumors 68020

    Joined:
    Jun 15, 2012
    #5
    If they have physical access to your Mac, they can boot it up in Target mode (making the whole Mac an external drive to another Mac), or take the drive out and mount it in an external case.

    The best way to avoid such problems are not to leave your expensive computer lying around, and place it in a locked drawer when you're not using it.
     
  6. macrumors 6502a

    Joined:
    Mar 8, 2008
    #6
    not with disk encryption. and the recommended methods provided previously.
    But, yes proper watch over your stuff is the first step.
    Also Back-ups are critical!
     
  7. macrumors 68020

    Joined:
    Jun 15, 2012
    #7
    Many people leave their laptops continually running, and don't leave a password to get past the screensaver.
    Some people let their dorm buddy use their laptop on the same account.

    In short, encryption is fine, but it's just one defence against some, but by no means all, of the security threats to your computer.

    Most thieves are not Tom Cruise trying to access your special data without you noticing, but will probably just wipe the disk and sell the laptop.
     
  8. macrumors 6502a

    Joined:
    Mar 20, 2006
    Location:
    Washington State
    #8
    Common sense is your best defense.

    resetpassword is a feature not a flaw.
     
  9. macrumors 6502a

    Joined:
    Mar 8, 2008
    #9
    well when you support enterprise level systems it is critical regardless of how "Special" or "not special" the data is. even in basic users. never underestimate the maliciousness of thieves, a slight bit of personal data is all they may need to steal your identity, cause problems, etc.

    Also, tell me how you can erase an encrypted disk? if it were that easy it wouldnt be a defacto encryption process.
     
  10. macrumors 68020

    Joined:
    Jun 15, 2012
    #10
    I dunno -- erase it using Linux or Windows? I'd be surprised if diskutil didn't let you somehow, though.

    But yes, encryption is of course useful. And I would expect enterprise-level guys to be following a lot of procedure that most domestic users don't.
    I was merely trying to highlight other physical risks that are greater than "resetpassword".
    ;-)
     
  11. macrumors 68040

    Joined:
    Jul 11, 2009
    #11
    Yeah, the Enterprise level equipment with sensitive data is locked in a limited-access secured data center.
     
  12. macrumors 6502a

    Joined:
    Nov 13, 2008
    #12
    not always true, such as with schools, or businesses with off-site work.
     

Share This Page