The general consensus on Mac OS X is that it is a very secure system. There is little to no threat of virus attacks and the operating system itself with the proper settings can be very secure. Unfortunately this isn’t as true as most of our perceptions would lead us to believe. I recently discovered that there is an extremely simple way to reset any administrative password on the OS X operating system. The only tool you need is a copy of the Mac OS X Install DVD. I won’t post the details here, but doing a quick Google Search results in some pretty shocking results; namely the Apple website has a very detailed page on how to change an administrative password in the case that you have “forgotten” yours, but has very poor details on how to prevent someone else from doing this to your computer. Don’t get me wrong, when the system is correctly put in place, Apple’s security is top notch. The problem is that by default these security measures are not implemented. Additionally, the existence and implementation of these measures are virtually hidden.
Before I begin on solutions to securing your machine, I must credit Orbicule. I recently found Orbicule’s Undercover software which is basically a “tracking” system for your laptop in the event your machine is stolen. It’s very affordable and I recommend it to anyone with a Mac laptop. Undercover makes a number of recommendations for making your computer more secure, which is what got the ball rolling for me.
To start there are a few basic settings you’ll want to put in place to make your machine more secure. In the “Security” panel of your “System Preferences” there are three check boxes you’ll want to be sure to have checked. These settings will lock your computer with your username/password.
The first is the “Require password to wake this computer from sleep or screen saver” check box. This will make your computer lock any time it has been inactive long enough to put the computer to sleep or kick on the screen saver. More importantly, on a laptop it will require a password any time the lid is opened — essentially locking the computer once the lid is closed. Additionally, you can change the timing of your “Energy Saver” and “Screen Saver” in your “System Preferences” — personally I’ve just gotten into the habit of closing my laptop lid or starting my screen saver when I’m not using my computer.
The second check box to make sure you check is the “Disable automatic login” password. Without this, all of your other security measures are next to useless. Without the “Disable automatic login” checked all anyone needs to do to get into your machine is force it to reboot. This check box provides a login screen when you restart your machine.
The third item to check in the “Security” panel is the “Require password to unlock each System Preferences pane”. This will keep anyone from changes this preferences before they get locked out.
Now, as I wrote above, it is extremely easy to reset any administrative password on OS X — or any user password for that matter. So, the smart ones out there are wondering, “Why the hell did I require myself to enter my password at every turn if anyone can simply reset my password?” Good f***ing question. A more appropriate question would be, “How do I prevent anyone from resetting my password?”
The big Lock that Apple doesn’t advertise: the Open Firmware Password Utility
The way to prevent someone from resetting your admin password is to “lock the firmware”. The way to reset a password on OS X involves booting from an Mac OS X Install DVD. By locking your firmware, the system will be unable to boot from any drive other than the main hard drive without entering a password. The only way to reset that password is again to boot from the Mac OS X Install DVD. The only downside to this is that if you forget your password, you’re pretty well screwed. So this solution is not recommended for the absentminded.
The Apple website will tell you to insert your Mac OS X Install DVD and find the Firmware Password Utility on the disk. For OS X 10.5 and later this will not work. You will need to boot from the DVD. To do this, insert the CD into the machine and reboot. Hold down the ‘c’ key as the machine is booting. This will allow you to boot from a “optional disk”. In our case select the “Mac OS X Install DVD” and press enter. From here you will reach the “Welcome” screen, select your language and click the “–>” button. Now, you may get a prompt saying you are unable to install the operating system. Ignore this prompt or any others that may appear. At this point you should be able to see a set of menus at the top of the screen. Select the “Utilities” menu, choose “Firmware Password Utility” and proceed as directed. And there it is. That’s how you can securely lock you computer. By doing this the only way to use your computer would be to replace the hard drive — which makes you computer far more secure, and your data incredibly secure.
I’m not sure why Apple doesn’t advertise this more. Or rather, why they make it so incredibly simple to reset an administrative password. I could see making it easy to reinstall the OS and wipe the machine, but allowing anyone to reset the administrative password gives anyone, with the means, access to practically everything on your computer. It’s also incredibly disappointing that there’s such a minimal amount of documentation on how to run the Open Firmware Password Utility. There’s definitely a good deal of documentation for the utility pre-Leopard, but all of that is next to useless for 10.5. My guess is that, sadly, there’s more demand from Mac users to know how to reset an admin password that they’ve forgotten than there is to lock the firmware. Most people aren’t aware of how easy it is to get around the administrative passwords and there assume that even if a computer is stolen, their information is secure. We just don’t think of it.
Anyway, I just hope this helps someone out. And again, I strongly recommend Undercover for a laptop — or any Mac for that matter. It’s a (seemingly) very effective way of adding an extra level of security to a machine. I would not, however, recommend Undercover for the iPhone. Unless I’m missing something, it seems to be pretty useless. From my understanding the crook would have to open the application in order to be tracked. In that case MobileMe is an extremely effective solution, which I wish I could afford (justify) the $99/year to pay for it.