7 ms·

Apple EFI firmware passwords and the SCBO myth

177 points by hkr_mag 10y ago

sigjuice 10y ago
TLDR? EFI password protection broken or not?
- totoz 10y ago
  Yes.
  - TheTon 10y ago
    What? That's not what it says at all! Edit: I guess this is the slightly better answer than simply yes or no: "If you lost your firmware password you can now reset it yourself as long the SPI flash chip is not the new BGA type (newer Macs are using them but there is a sneaky debug port that can be used for this same purpose!). You just need a device to dump the flash chip, remove the variable and reflash the modified version, or directly remove the variable (I always prefer to full dump and reflash). Of course this information can be used by thieves selling stolen Macs, but given that there are already defeat devices being sold all over the web, this post does not reveal any previously-unknown secrets."
- developer2 10y ago
  Apple has a backdoor for resetting firmware passwords via a special unlock file that must be cryptographically signed using Apple's private key(s). In theory only Apple employees can sign the unlock files. How many employees have access to sign these unlock files? 10? 100? Every low-level employee? There may be some "bad apple" employees selling the signing of unlock files, some social engineering to trick Apple into providing signed files they shouldn't be, or a vulnerability the researcher has not found that allows attackers to bypass the public-key crypto implementation.
  - dogma1138 10y ago
    Since it's likely that every apple care center can perform this unlock there is a very good chance that there is a machine in virtually everyone of them that also has a service lab that makes these files. The number of people that can unlock it is probably quite high, this isn't that different than removing an apple id from the device you need to go to the apple store with the device and proof of purchase and they do it for you.
    - Sidnicious 10y ago
      Last I heard, service centers have to request these files from Apple on a case-by-case basis, so that only a small number of people need the ability to generate them. All of the complexity (writing a nonce to flash when the firmware password is changed, etc.) exists to make it easy for a service provider to apply an unlock when authorized. I’d make a large bet that the same is true for removing Apple ID activation locks from devices.
      - dogma1138 10y ago
        I haven't removed an EFI password but I've removed an Apple ID from 2 devices and it was done in <30min at the Apple Store in Westfield (SB) London. While It's likely that Apple has probably has some audit trail on these requests just the sheer amount of devices that are likely to need to undergo such procedure make it unlikely that there is some room in Apple HQ where 5 highly trusted engineers issue those files. Even if you don't count all the end users that lock their devices and can't unlock them all the devices that are returned to apple, go in for a hardware replacement/fix or recycling need to undergo a similar procedure. So If I would be asked to wager on how this process is done it would be that it's an automated process with an audit trail just like what many organizations use to reset account details, passwords and other things.
      - developer2 10y ago
        Even if the employees capable of directly signing the files make up a very small group, they would probably be authorizing over the phone or a similar indirect route. This opens the door to social engineering by anyone, employee or not, who knows what number to dial and what information to provide. The tech would be authorizing the file without seeing the customer's device and proof of purchase themselves. To foolproof the system, you would need less than a dozen people trusted with the ability to sign the files, and require the device and proof of purchase to be shipped to them rather than allowing unlocks to be authorized remotely. It's unfortunate that the last line of defense against a stolen machine, the firmware password, has a backdoor. I'd have expected a firmware password on a MacBook to be just as difficult to bypass as an iPhone's passcode. Apple refuses to unlock phones, but will gladly remove a firmware password on a real machine. Disappointing.
dogber1 10y ago
Apple is doing a much better job than all the rest of the PC vendors. Even those vendors that I haven't published keygens for [1] have just stupendously unsound bypass mechanisms for BIOS passwords. [1] https://dogber1.blogspot.com/2009/05/table-of-reverse-engineered-bios.html https://dogber1.blogspot.com/2009/05/table-of-reverse-engine...
- themartorana 10y ago
  Seeing Compaq at the top of that table brought me all the way back... Presario FTW!
  - yuhong 10y ago
    I wonder what PCs would be like if Intel bought Compaq in 1991 with people like Rod Canion and Jim Harris staying on. I think they were there when Compaq reverse engineered the IBM PC BIOS for example.
- userbinator 10y ago
  Nevertheless, physical access still means it's game over; and I consider that a feature, not a bug. Given that, it's actually a little amusing that Apple went to all that effort for something that can be defeated with nothing more than a full BIOS reflash.
  - Sidnicious 10y ago
    Maybe not so amusing! As far as I know, you’ll need to take the machine apart to reflash it, plus special hardware — because when a firmware password is set, a Mac requires the password to choose a different boot disk. with this feature, Apple HQ can give a service center the ability to clear a particular firmware password without giving them a universal backdoor (hardware or software).
    - kogepathic 10y ago
      > As far as I know, you’ll need to take the machine apart to reflash it, plus special hardware This doesn't take very long. Maybe 5 minutes to disassemble the machine. As for hardware, you can flash SPI chips using a Teensy and a clip chip. [1] The total cost of parts is under $30. Incidentally, I highly recommend investing in one of these if you're doing firmware development for routers. It's so much easier to flash a backup than muck around with TFTP. > because when a firmware password is set, a Mac requires the password to choose a different boot disk. This is hardly unique to Apple. Most PC laptop manufacturers also disable changing the boot device or choosing a temporary boot device when a setup password is enabled. > with this feature, Apple HQ can give a service center the ability to clear a particular firmware password without giving them a universal backdoor (hardware or software). Um, this is how it works for PC firmware passwords as well. Unless there is a keygen available, most modern implementations use a hashed value from the serial number or hard drive as the master unlock password. It's unique to the laptop being unlocked. [1] https://trmm.net/SPI_flash https://trmm.net/SPI_flash
userbinator 10y ago
These could be insiders working at Apple support centers or even Apple itself. It makes me somewhat happy in a weird way to think that, even in notoriously locked-down and secretive companies like Apple, there are individuals who don't believe in and subvert the company's attempts to have sole control of its products. We have these individuals to thank for schematics, parts, and a lot of other material that feeds the third-party repair industry.
- Dylan16807 10y ago
  But these people are just signing password reset tokens. They're not in any way related to the people you're cheering for.
- venomsnake 10y ago
  In every major company there is unofficial price list for "services" in the support departments. Most often they are motivated by good old profit.
- Bluestrike2 10y ago
  I'm not so sure the people selling SCBO files are the ones we'd consider the good guys. Or at least not based on their most likely buyers.
  - raverbashing 10y ago
    Correct, they're most likely allowing stolen computers to be used Makes me wonder if their SCBO generating system is connected to their stolen serial number db (probably not)
    - userbinator 10y ago
      they're most likely allowing stolen computers to be used Also those which have been recycled, or which someone has locked out accidentally, or deliberately to scam someone ( https://news.ycombinator.com/item?id=7993435 https://news.ycombinator.com/item?id=7993435 ), etc. Used computers from companies often have BIOS passwords that no one bothered to clear before sending them off. Not every computer with a password its current owner doesn't know is a stolen one. That's why I think this is a good thing --- I believe in the fact that if you physically own something, regardless of how you came to own it, you should truly "own" it.
TempleOS 10y ago
Intel is only allowed to decrease the line-of-code count, not increase. It is 80,739 lines of code. Elf support bloats everything. A new graphics file bloats everything. However, adding RedSea to Linux and removing ISO9660 and FAT32 reduces lines of code. In other word, "Oh hell! no UEFI is banned, mother fuckers." Boot TempleOS instead of UEFI when RESET button is pressed. God says... robotic dispute curmudgeons sinkers chilblain's probability's nightcaps acidity hardball Hell gorgeous Vazquez catalytic Ger prosecutor's caravan's shambled cancellation retold reptilian's Skype recessing hypnosis's Kr Casablanca's headlocks disinherits soapbox's goading ritually vignetted Jarred's ====== You need to copy ROM to RAM because TempleOS self modifies. RAM is faster, almost certainly.
thought_alarm 10y ago
Can someone please cut me to the chase?
- lisper 10y ago
  You can work around a Mac firmware lock by reflashing the boot ROM.
- __david__ 10y ago
  Apple can create a file to reset the flash password (it does not require tampering with the physical flash chip). This password reset file is RSA signed, so third parties can't create one from scratch unless they have stolen Apple's private key (unlikely), or have contacts inside Apple willing to make the file for them (more likely—all it takes is one unscrupulous employee with access to the reset file generation program).
SCBO 10y ago
What the hell does SCBO even mean?
- kalleboo 10y ago
  Dunno but Apple's EFI firmware files use the extension SCAP
mschuster91 10y ago
Hmm... what about bugs in the USB / FireWire implementation of the EFI? Or the good old FireWire DMA trick?
- duskwuff 10y ago
  With the exception of the non-Retina MacBook Pro (which is due to be discontinued any day now), none of Apple's computers have FireWire anymore. Even when they did, enabling a firmware password disabled FireWire DMA, even after boot. (And I'm not sure it was ever active during preboot.)
joelhaasnoot 10y ago
This article is the kind that makes me sit down with a cup of coffee and read it top to bottom, even though I don't understand all of the low-level assembler details (but it's understandable without that). Security is important for everyone, not just security researchers.
kalleboo 10y ago
I wonder if we can expect this to change if Apple add a TouchID reader (and accompanying Secure Enclave) to the next generation of MacBooks

177 points by hkr_mag 10y ago

sigjuice 10y ago

TLDR? EFI password protection broken or not?

totoz 10y ago
Yes.
- TheTon 10y ago
  What? That's not what it says at all! Edit: I guess this is the slightly better answer than simply yes or no: "If you lost your firmware password you can now reset it yourself as long the SPI flash chip is not the new BGA type (newer Macs are using them but there is a sneaky debug port that can be used for this same purpose!). You just need a device to dump the flash chip, remove the variable and reflash the modified version, or directly remove the variable (I always prefer to full dump and reflash). Of course this information can be used by thieves selling stolen Macs, but given that there are already defeat devices being sold all over the web, this post does not reveal any previously-unknown secrets."
developer2 10y ago
Apple has a backdoor for resetting firmware passwords via a special unlock file that must be cryptographically signed using Apple's private key(s). In theory only Apple employees can sign the unlock files. How many employees have access to sign these unlock files? 10? 100? Every low-level employee? There may be some "bad apple" employees selling the signing of unlock files, some social engineering to trick Apple into providing signed files they shouldn't be, or a vulnerability the researcher has not found that allows attackers to bypass the public-key crypto implementation.
- dogma1138 10y ago
  Since it's likely that every apple care center can perform this unlock there is a very good chance that there is a machine in virtually everyone of them that also has a service lab that makes these files. The number of people that can unlock it is probably quite high, this isn't that different than removing an apple id from the device you need to go to the apple store with the device and proof of purchase and they do it for you.
  - Sidnicious 10y ago
    Last I heard, service centers have to request these files from Apple on a case-by-case basis, so that only a small number of people need the ability to generate them. All of the complexity (writing a nonce to flash when the firmware password is changed, etc.) exists to make it easy for a service provider to apply an unlock when authorized. I’d make a large bet that the same is true for removing Apple ID activation locks from devices.
    - dogma1138 10y ago
      I haven't removed an EFI password but I've removed an Apple ID from 2 devices and it was done in <30min at the Apple Store in Westfield (SB) London. While It's likely that Apple has probably has some audit trail on these requests just the sheer amount of devices that are likely to need to undergo such procedure make it unlikely that there is some room in Apple HQ where 5 highly trusted engineers issue those files. Even if you don't count all the end users that lock their devices and can't unlock them all the devices that are returned to apple, go in for a hardware replacement/fix or recycling need to undergo a similar procedure. So If I would be asked to wager on how this process is done it would be that it's an automated process with an audit trail just like what many organizations use to reset account details, passwords and other things.
    - developer2 10y ago
      Even if the employees capable of directly signing the files make up a very small group, they would probably be authorizing over the phone or a similar indirect route. This opens the door to social engineering by anyone, employee or not, who knows what number to dial and what information to provide. The tech would be authorizing the file without seeing the customer's device and proof of purchase themselves. To foolproof the system, you would need less than a dozen people trusted with the ability to sign the files, and require the device and proof of purchase to be shipped to them rather than allowing unlocks to be authorized remotely. It's unfortunate that the last line of defense against a stolen machine, the firmware password, has a backdoor. I'd have expected a firmware password on a MacBook to be just as difficult to bypass as an iPhone's passcode. Apple refuses to unlock phones, but will gladly remove a firmware password on a real machine. Disappointing.

dogber1 10y ago

Apple is doing a much better job than all the rest of the PC vendors. Even those vendors that I haven't published keygens for [1] have just stupendously unsound bypass mechanisms for BIOS passwords. [1] https://dogber1.blogspot.com/2009/05/table-of-reverse-engineered-bios.html https://dogber1.blogspot.com/2009/05/table-of-reverse-engine...

themartorana 10y ago
Seeing Compaq at the top of that table brought me all the way back... Presario FTW!
- yuhong 10y ago
  I wonder what PCs would be like if Intel bought Compaq in 1991 with people like Rod Canion and Jim Harris staying on. I think they were there when Compaq reverse engineered the IBM PC BIOS for example.
userbinator 10y ago
Nevertheless, physical access still means it's game over; and I consider that a feature, not a bug. Given that, it's actually a little amusing that Apple went to all that effort for something that can be defeated with nothing more than a full BIOS reflash.
- Sidnicious 10y ago
  Maybe not so amusing! As far as I know, you’ll need to take the machine apart to reflash it, plus special hardware — because when a firmware password is set, a Mac requires the password to choose a different boot disk. with this feature, Apple HQ can give a service center the ability to clear a particular firmware password without giving them a universal backdoor (hardware or software).
  - kogepathic 10y ago
    > As far as I know, you’ll need to take the machine apart to reflash it, plus special hardware This doesn't take very long. Maybe 5 minutes to disassemble the machine. As for hardware, you can flash SPI chips using a Teensy and a clip chip. [1] The total cost of parts is under $30. Incidentally, I highly recommend investing in one of these if you're doing firmware development for routers. It's so much easier to flash a backup than muck around with TFTP. > because when a firmware password is set, a Mac requires the password to choose a different boot disk. This is hardly unique to Apple. Most PC laptop manufacturers also disable changing the boot device or choosing a temporary boot device when a setup password is enabled. > with this feature, Apple HQ can give a service center the ability to clear a particular firmware password without giving them a universal backdoor (hardware or software). Um, this is how it works for PC firmware passwords as well. Unless there is a keygen available, most modern implementations use a hashed value from the serial number or hard drive as the master unlock password. It's unique to the laptop being unlocked. [1] https://trmm.net/SPI_flash https://trmm.net/SPI_flash

userbinator 10y ago

These could be insiders working at Apple support centers or even Apple itself. It makes me somewhat happy in a weird way to think that, even in notoriously locked-down and secretive companies like Apple, there are individuals who don't believe in and subvert the company's attempts to have sole control of its products. We have these individuals to thank for schematics, parts, and a lot of other material that feeds the third-party repair industry.

Dylan16807 10y ago
But these people are just signing password reset tokens. They're not in any way related to the people you're cheering for.
venomsnake 10y ago
In every major company there is unofficial price list for "services" in the support departments. Most often they are motivated by good old profit.
Bluestrike2 10y ago
I'm not so sure the people selling SCBO files are the ones we'd consider the good guys. Or at least not based on their most likely buyers.
- raverbashing 10y ago
  Correct, they're most likely allowing stolen computers to be used Makes me wonder if their SCBO generating system is connected to their stolen serial number db (probably not)
  - userbinator 10y ago
    they're most likely allowing stolen computers to be used Also those which have been recycled, or which someone has locked out accidentally, or deliberately to scam someone ( https://news.ycombinator.com/item?id=7993435 https://news.ycombinator.com/item?id=7993435 ), etc. Used computers from companies often have BIOS passwords that no one bothered to clear before sending them off. Not every computer with a password its current owner doesn't know is a stolen one. That's why I think this is a good thing --- I believe in the fact that if you physically own something, regardless of how you came to own it, you should truly "own" it.

TempleOS 10y ago

Intel is only allowed to decrease the line-of-code count, not increase. It is 80,739 lines of code. Elf support bloats everything. A new graphics file bloats everything. However, adding RedSea to Linux and removing ISO9660 and FAT32 reduces lines of code. In other word, "Oh hell! no UEFI is banned, mother fuckers." Boot TempleOS instead of UEFI when RESET button is pressed. God says... robotic dispute curmudgeons sinkers chilblain's probability's nightcaps acidity hardball Hell gorgeous Vazquez catalytic Ger prosecutor's caravan's shambled cancellation retold reptilian's Skype recessing hypnosis's Kr Casablanca's headlocks disinherits soapbox's goading ritually vignetted Jarred's ====== You need to copy ROM to RAM because TempleOS self modifies. RAM is faster, almost certainly.

thought_alarm 10y ago

Can someone please cut me to the chase?

lisper 10y ago
You can work around a Mac firmware lock by reflashing the boot ROM.
__david__ 10y ago
Apple can create a file to reset the flash password (it does not require tampering with the physical flash chip). This password reset file is RSA signed, so third parties can't create one from scratch unless they have stolen Apple's private key (unlikely), or have contacts inside Apple willing to make the file for them (more likely—all it takes is one unscrupulous employee with access to the reset file generation program).

SCBO 10y ago

What the hell does SCBO even mean?

kalleboo 10y ago
Dunno but Apple's EFI firmware files use the extension SCAP

mschuster91 10y ago

Hmm... what about bugs in the USB / FireWire implementation of the EFI? Or the good old FireWire DMA trick?

duskwuff 10y ago
With the exception of the non-Retina MacBook Pro (which is due to be discontinued any day now), none of Apple's computers have FireWire anymore. Even when they did, enabling a firmware password disabled FireWire DMA, even after boot. (And I'm not sure it was ever active during preboot.)

joelhaasnoot 10y ago

This article is the kind that makes me sit down with a cup of coffee and read it top to bottom, even though I don't understand all of the low-level assembler details (but it's understandable without that). Security is important for everyone, not just security researchers.

kalleboo 10y ago

I wonder if we can expect this to change if Apple add a TouchID reader (and accompanying Secure Enclave) to the next generation of MacBooks