Stolen Macbook Air - What can they do

Discussion in 'MacBook Air' started by -Node1-, Jul 22, 2014.

  1. -Node1- macrumors newbie

    Joined:
    Aug 9, 2009
    Location:
    United Kingdom
    #1
    Right so in May this year I had my 2012 11inch Macbook Air stolen from my car.

    The laptop was running Find My Mac.
    The laptop was running Mavericks.
    The laptop was encrypted with Filevault.
    The laptop had a password on the account.
    The laptop was sleeping in my bag when it was stolen.

    A few days later I got an email to say it had been found at a location some 30 miles away from my house.

    The police went round to try and find it but nothing came of it.

    Upon it being found I then locked it using Find My Mac.

    My questions are:

    If they take the hard drive out can they use the laptop with a new hard drive?
    What would they need to unlock the locked mac?
    If they format the mac does that mean the tracking is then useless?
    Does the locked state mean the laptops effectively useless?
    What happens if the hard drive is removed and read on a different mac could they still access the encrypted data?

    I'm worried that my data could be at stake if they successfully managed to unlock the laptop somehow.

    I fail to see how someone could just buy it and start using it again just like that.

    Can apple flag the serial as stolen?
     
  2. scaredpoet macrumors 604

    scaredpoet

    Joined:
    Apr 6, 2007
    #2
    Yes. In fact, they could use it with the same drive, if they put it in recovery mode, wipe the drive and re-install.

    Only way to prevent this is to set an EFI password, to lock down recovery mode.

    To access your data? They need either your username/password or the recovery key that was set up when FileVault was turned on.

    To wipe the drive and start fresh? They just need to know to hold down Command+R on boot. They will not have access to your data, however.

    Yep. It won't be trackable on Find My Mac after that.

    Not unless you set the EFI password. No EFI password, the Mac can be reformatted and reused.

    They would need your unlock password or recovery key. Without these, they cannot access the data, but they can reformat the drive.

    If they manage to unlock he laptop, then yes, your data would be at risk. But, they need to unlock your laptop. How hard that is depends on how difficult a password you set.

    Can they? Maybe. Do they? Not that I know of.

    As someone who has had my MacBook Pro stolen from my car as well, my condolences. But, unfortunately, I wouldn't count on getting it back at this point. You should check with your insurance company and see if any claim can be filed.
     
  3. -Node1- thread starter macrumors newbie

    Joined:
    Aug 9, 2009
    Location:
    United Kingdom
    #3
    Doesnt locking the computer via FMM set an EFI password if it doesnt already have one?
     
  4. scaredpoet macrumors 604

    scaredpoet

    Joined:
    Apr 6, 2007
    #4
    Sort of. It sets a 4-digit code. I wouldn't consider that particularly secure though... given enough time someone would guess that, I'd imagine, if they were persistent.
     
  5. -Node1- thread starter macrumors newbie

    Joined:
    Aug 9, 2009
    Location:
    United Kingdom
    #5
    It does? How do I know what it is, if it magically ever ends up back in my hands?

    I can't imagine if the laptop even exists now, maybe someone wiped it even though it got locked (presumingly when they tried recovery mode and connected to a wifi network, when it first got nicked).
     
  6. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #7
    Yes it does.

    Like scaredpoet mentioned, if they are persistent, they can just keep entering all 9,999 combinations until they hit the four digit code you entered. Apple does make this tough by blocking attempts for 15 minutes after a few bad entries (I can't recall how many).

    If you ever got the machine back you would need to renter the code you sent to Find my Mac when you did the lock.
     
  7. cyber16 macrumors 6502

    Joined:
    Jan 12, 2013
    #8
  8. -Node1- thread starter macrumors newbie

    Joined:
    Aug 9, 2009
    Location:
    United Kingdom
    #9
    I do not remember telling FMM a code when i locked the computer.

    What happens if they change the hard drive is the computer useable?
     
  9. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #10
    You may have just erased it and not locked it... two different things.

    If the PIN lock was applied and they install a new drive, that drive will also be locked. One would need to unlock the PIN and also put in a new drive to get out from under this.
     
  10. -Node1- thread starter macrumors newbie

    Joined:
    Aug 9, 2009
    Location:
    United Kingdom
    #11
    I did definitely lock it it wont let me erase it now, it hasn't been seen on FMM since the day it was locked.

    I can't imagine its just sitting around doing nothing, someone be using it in some fashion
     
  11. Newtons Apple macrumors P6

    Newtons Apple

    Joined:
    Mar 12, 2014
    Location:
    Jacksonville, Florida
    #12
    Sooner or later you will have to just move on.

    Sorry for the loss.
     
  12. maflynn Moderator

    maflynn

    Staff Member

    Joined:
    May 3, 2009
    Location:
    Boston
    #13
    Its gone at this point, the thief probably already wiped the computer and maybe even sold it.

    Sorry to hear about your loss, though. Did you have File Vault enabled? That will protect your data, especially if you have credit card, bank information.
     
  13. tiartrop macrumors regular

    Joined:
    Oct 28, 2008
    #14
    I'm sorry for your loss but I can understand your concern. I got mine stolen sometime ago and worse it wasn't filevaulted. For a while I was worried they'd go through my data and do the unimaginable but nothing of the sort ever happened.

    If you got filevault on then you're pretty safe, it'll take some serious determination to break into it and most likely they won't bother. They'll probably just format it and sell it/use it on their own.

    Apple can definitely mark your laptop as stolen in their database, I'm not quite sure what'll happen if someone brings it to an Apple Store though.
     
  14. 960design macrumors 68020

    Joined:
    Apr 17, 2012
    Location:
    Destin, FL
  15. orestes1984, Jul 25, 2014
    Last edited: Jul 25, 2014

    orestes1984 macrumors 65816

    Joined:
    Jun 10, 2005
    Location:
    Australia
    #16
    A 4 digit code has 10,000 different possibilities given that you can use every digit more than once, they will be trying for a very long time given a manual brute force.
     
  16. Epiphron macrumors regular

    Joined:
    Jul 25, 2010
    #17
    but a computer script can go through all 10000 possibilities extremely quickly..
     
  17. cyber16 macrumors 6502

    Joined:
    Jan 12, 2013
    #18
    as I posted above
    A low cost usb teensy board will try all 10k codes within a couple days.
    With NO user input needed.
    Program it and just plug it in and wait

    It is by far best to enter in a long efi password phase right away and not depend on the limited find my four digit code

    http://www.hackmac.org/forum/topic/1...-bruteforcing/
     
  18. Suture macrumors 6502a

    Suture

    Joined:
    Feb 22, 2007
    #19
    I also use this, and recommend it. If I recall correctly, it's free for up to 3 devices.
     

Share This Page