Apple EFI firmware passwords and the SCBO myth

[You are the One]

And that’s it. The SCBO mystery is finally solved and its format understood. With the precious assistance of my EFI DXE emulator and debugger I sped up the reverse engineering effort. The SCBO feature design is robust, and the only mystery I haven’t solved right now is how someone is apparently selling working SCBO files on the Internet. My bet is on insider access to Apple systems via Apple Support centers or something like that, but once again only Apple can really investigate the root cause.

(my bold, YATO)

Here is what a commenter to the post had to say:

You can basically do anything with an Apple GSX account, so selling the file is not a news. You can unlock even more stuff with it.

Also, it’s not that hard to gain access to a GSX account, work for an APR and you are golden. Most of them don’t even bother to delete ex-employee’s account.

 

[Weaselboy]

Good article and thanks. Right now there are three different eBay sellers offering to unlock firmware like this and send you the USB key you need. They all have a lot of positive feedback, so I assume it works.

I reported one of these to Apple Security about a year ago telling them it appears someone has access to their systems to be able to create these USB keys, and they got back to me they would investigate. As far as I could tell, nothing was ever done since the seller kept right on selling on eBay and now I see more on there.

One would think Apple would want to find out who was doing this and block access to this security hole, but I guess not.

 

[killawat]

Good post. Does this have any impact on iCloud locks?

 

[Weaselboy]

Good post. Does this have any impact on iCloud locks?

Yep... same issue. Search eBay for "apple firmware password".

 

[throAU]

Someone selling stuff on eBay doesn't necessarily mean it works.

Anyone confirmed these to actually work?

 

[Weaselboy]

Someone selling stuff on eBay doesn't necessarily mean it works.

Anyone confirmed these to actually work?

None of these three eBay sellers are new. They all have a lot of reviews saying it does work.

I can't find the thread now, but the original discussion we had here about this when I reported it to Apple had a couple forum members post that they had used this eBay service and it worked.

 

[You are the One]

So an EFI-password give practically no protection... neither iCloud. Serious.