MAC OS X SECURITY? OVERHEARD A STUPID.....

[jaseone]

Not true at all. There are a variety of attack vectors. Unpatched apache, ssh, OS pieces, etc. It's definitely happened. Unfortauntely, the easy of setting up OS X and some of it's nicer services makes it a rich target for attack. Grandma Jones doesn't know or care about security, but she does want to show those pictures of her grandchildren on her website!

But Grandma Jones isn't going to run an Apche server on her computer & serve the files up from there and I don't se how using iPhoto to publish photo's to .mac posts a security risk for her local computer.

As for needing root to change passwords, naah..

Single User Mode -> use niutil to change the password properties. That should work, no?

Good time to use the OF Password!

So in single user mode you can change the pasword without knowing the current one? That isn't too smart...

I hadn't even thought of setting up an OF password though as unlike Wintel machines you don't get to see the usual BIOS stuff on Macs that sets off that little reminder in your head that you really should setup BIOS passwords one day.

 

[26139]

Password..

You CAN create an open firmware password that will require anyone who wants to start up from anything other than the HD know the password, therefore disabling the ability to even have a chance to guess the user password.

 

[yellow]

But Grandma Jones isn't going to run an Apche server on her computer & serve the files up from there and I don't se how using iPhoto to publish photo's to .mac posts a security risk for her local computer.

I'm not talking about .Mac. And it's not hard for Grandma to start apache. All she has to do is click on the Personal Web Sharing Start button in the Sharing prefpane. She puts her pictures in her ~/Sites and away she goes. This stuff is all in the Mac Help.

 

[whooleytoo]

I'm confused, what do you guys mean when you say OSX "hasn't/can't be hacked"?

Probably the most dangerous security risk (spyware) could be implemented quite easily on OSX, and distributed as a Trojan.

 

[IJ Reilly]

That depends on your level of paranoia, I think.

Sure, but I was wondering how often open firmware passwords are actually used. I work in a home-office situation so obviously I'm not worried, unless the cats decide to get creative (the only hacking they ever do... oh, never mind!).

The way I look at it, if anybody really wanted my data that badly they'd just boost my entire computer.

 

[Les Kern]

Just don't forget that you've got it installed (and don't forget that password!) and freak when you can't boot from a CD. Which I did shortly after I started using it back in the day. Much cursing and sobbing ensued..

I have 300-400 wireless laptops and wanted a way to safeguard them if stolen. I tried a product called MacPhoneHome, but it could be easily deleted with an install CD. I then looked at OF password. Guess what? It can be easily bypassed.
(1) Install or remove a stick of ram.
(2) Zap the Pram 3 times in a row.
(3) your done.
SO what is the solution? None beside making sure you have insurance and a few spares. When a REAL method for security is invented, get back to us.

 

[26139]

Open Firmware

Open firmware prevents those who don't know the password from bypassing the option to start up from a different drive or cd. So, even though they had your computer, the password protection wouldn't be bypassed.

 

[IJ Reilly]

Open firmware prevents those who don't know the password from bypassing the option to start up from a different drive or cd. So, even though they had your computer, the password protection wouldn't be bypassed.

Not really. They could remove the hard drive and put it in an enclosure or another computer. Not being able to boot off the drive does not secure the data on the drive.

 

[tech4all]

I'm confused

What is this root password? Is it the same as the admin account password?

 

[panphage]

I have 300-400 wireless laptops and wanted a way to safeguard them if stolen. I tried a product called MacPhoneHome, but it could be easily deleted with an install CD. I then looked at OF password. Guess what? It can be easily bypassed.
(1) Install or remove a stick of ram.
(2) Zap the Pram 3 times in a row.
(3) your done.
SO what is the solution? None beside making sure you have insurance and a few spares. When a REAL method for security is invented, get back to us.

An attacker with that kind of time and access can do whatever they want to whatever computer regardless of platform. Computer security (and car security and chaining your bike and locking your front door) isn't based on thwarting all possible attacks in all possible situations, it's designed to either slow someone down enough that they can be caught in the act or to make it so hard that the risk/reward ratio isn't in their favor.

 

[jsw]

SO what is the solution? None beside making sure you have insurance and a few spares. When a REAL method for security is invented, get back to us.

Well, there's always FileVault (which I personally find a bit too worrisome - everything goes kaput if a bit gets twiddled by accident on the disk) or using encrypted folders, which seems pretty solid.

Yes, you can gain control of any Mac if you have it alone long enough, but that doesn't mean you can get to the data, which is what's important.

 

[jsw]

What is this root password? Is it the same as the admin account password?

"root" is the super-user on any *nix platform. That account can do anything, see anything, change anything. It's dangerously powerful. On OS X, it's disabled by default. You need to go into Utilities->NetInfo Manager->Security, Authenticate yourself, and then turn it on. Unless you know what you're doing, there's no reason to use that account or even to allow it to be enabled.

 

[tech4all]

"root" is the super-user on any *nix platform. That account can do anything, see anything, change anything. It's dangerously powerful. On OS X, it's disabled by default. You need to go into Utilities->NetInfo Manager->Security, Authenticate yourself, and then turn it on. Unless you know what you're doing, there's no reason to use that account or even to allow it to be enabled.

Thank you.

Is there a separate password for the root though? The way I read this thread it seems as though the root password is different from the normal account password(s)?

 

[yellow]

SO what is the solution? None beside making sure you have insurance and a few spares. When a REAL method for security is invented, get back to us.

Heh, this seems like a bit of an attack on me. I am well aware of being able to defeat OF passwords.. now... This was before the work-around for OF became so highly publicized. 3 years ago or so.

And to quote myself:

You can follow all sorts of "best practices" to protect yourself, but if malicious dude A has physical access to your comptuer (no matter what flavor it is), you are in danger. End of story.

 

[yellow]

What is this root password? Is it the same as the admin account password?

If you have to ask, I wouldn't worry about it.