Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Stolen Macbook Air - What can they do

N

-Node1-

macrumors newbie
Original poster
Aug 9, 2009
19
0
United Kingdom
Right so in May this year I had my 2012 11inch Macbook Air stolen from my car.

The laptop was running Find My Mac.
The laptop was running Mavericks.
The laptop was encrypted with Filevault.
The laptop had a password on the account.
The laptop was sleeping in my bag when it was stolen.

A few days later I got an email to say it had been found at a location some 30 miles away from my house.

The police went round to try and find it but nothing came of it.

Upon it being found I then locked it using Find My Mac.

My questions are:

If they take the hard drive out can they use the laptop with a new hard drive?
What would they need to unlock the locked mac?
If they format the mac does that mean the tracking is then useless?
Does the locked state mean the laptops effectively useless?
What happens if the hard drive is removed and read on a different mac could they still access the encrypted data?

I'm worried that my data could be at stake if they successfully managed to unlock the laptop somehow.

I fail to see how someone could just buy it and start using it again just like that.

Can apple flag the serial as stolen?
 
-Node1- said:
My questions are:

If they take the hard drive out can they use the laptop with a new hard drive?
Click to expand...

Yes. In fact, they could use it with the same drive, if they put it in recovery mode, wipe the drive and re-install.

Only way to prevent this is to set an EFI password, to lock down recovery mode.

What would they need to unlock the locked mac?
Click to expand...

To access your data? They need either your username/password or the recovery key that was set up when FileVault was turned on.

To wipe the drive and start fresh? They just need to know to hold down Command+R on boot. They will not have access to your data, however.

If they format the mac does that mean the tracking is then useless?
Click to expand...

Yep. It won't be trackable on Find My Mac after that.

Does the locked state mean the laptops effectively useless?
Click to expand...

Not unless you set the EFI password. No EFI password, the Mac can be reformatted and reused.

What happens if the hard drive is removed and read on a different mac could they still access the encrypted data?
Click to expand...

They would need your unlock password or recovery key. Without these, they cannot access the data, but they can reformat the drive.

I'm worried that my data could be at stake if they successfully managed to unlock the laptop somehow.
Click to expand...

If they manage to unlock he laptop, then yes, your data would be at risk. But, they need to unlock your laptop. How hard that is depends on how difficult a password you set.

Can apple flag the serial as stolen?
Click to expand...

Can they? Maybe. Do they? Not that I know of.

As someone who has had my MacBook Pro stolen from my car as well, my condolences. But, unfortunately, I wouldn't count on getting it back at this point. You should check with your insurance company and see if any claim can be filed.
 
Sort of. It sets a 4-digit code. I wouldn't consider that particularly secure though... given enough time someone would guess that, I'd imagine, if they were persistent.
 
It does? How do I know what it is, if it magically ever ends up back in my hands?

I can't imagine if the laptop even exists now, maybe someone wiped it even though it got locked (presumingly when they tried recovery mode and connected to a wifi network, when it first got nicked).
 
-Node1- said:
Doesnt locking the computer via FMM set an EFI password if it doesnt already have one?
Click to expand...

Yes it does.

-Node1- said:
It does? How do I know what it is, if it magically ever ends up back in my hands?

I can't imagine if the laptop even exists now, maybe someone wiped it even though it got locked (presumingly when they tried recovery mode and connected to a wifi network, when it first got nicked).
Click to expand...

Like scaredpoet mentioned, if they are persistent, they can just keep entering all 9,999 combinations until they hit the four digit code you entered. Apple does make this tough by blocking attempts for 15 minutes after a few bad entries (I can't recall how many).

If you ever got the machine back you would need to renter the code you sent to Find my Mac when you did the lock.
 
I do not remember telling FMM a code when i locked the computer.

What happens if they change the hard drive is the computer useable?
 
-Node1- said:
I do not remember telling FMM a code when i locked the computer.

What happens if they change the hard drive is the computer useable?
Click to expand...

You may have just erased it and not locked it... two different things.

If the PIN lock was applied and they install a new drive, that drive will also be locked. One would need to unlock the PIN and also put in a new drive to get out from under this.
 
I did definitely lock it it wont let me erase it now, it hasn't been seen on FMM since the day it was locked.

I can't imagine its just sitting around doing nothing, someone be using it in some fashion
 
-Node1- said:
I did definitely lock it it wont let me erase it now, it hasn't been seen on FMM since the day it was locked.

I can't imagine its just sitting around doing nothing, someone be using it in some fashion
Click to expand...

Its gone at this point, the thief probably already wiped the computer and maybe even sold it.

Sorry to hear about your loss, though. Did you have File Vault enabled? That will protect your data, especially if you have credit card, bank information.
 
I'm sorry for your loss but I can understand your concern. I got mine stolen sometime ago and worse it wasn't filevaulted. For a while I was worried they'd go through my data and do the unimaginable but nothing of the sort ever happened.

If you got filevault on then you're pretty safe, it'll take some serious determination to break into it and most likely they won't bother. They'll probably just format it and sell it/use it on their own.

Apple can definitely mark your laptop as stolen in their database, I'm not quite sure what'll happen if someone brings it to an Apple Store though.
 
scaredpoet said:
Sort of. It sets a 4-digit code. I wouldn't consider that particularly secure though... given enough time someone would guess that, I'd imagine, if they were persistent.
Click to expand...

A 4 digit code has 10,000 different possibilities given that you can use every digit more than once, they will be trying for a very long time given a manual brute force.
 
Last edited:
orestes1984 said:
A 4 digit code has 10,000 different possibilities given that you can use every digit more than once, they will be trying for a very long time given a manual brute force.
Click to expand...

but a computer script can go through all 10000 possibilities extremely quickly..
 
as I posted above
A low cost usb teensy board will try all 10k codes within a couple days.
With NO user input needed.
Program it and just plug it in and wait

It is by far best to enter in a long efi password phase right away and not depend on the limited find my four digit code

http://www.hackmac.org/forum/topic/1...-bruteforcing/
orestes1984 said:
A 4 digit code has 10,000 different possibilities given that you can use every digit more than once, they will be trying for a very long time given a manual brute force.
Click to expand...
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back