3 ms·

No, it won't. They could simply put in a different BIOS chip, which records you password the next time you enter it. Or a malicious RAM chip that injects a viru

No, it won't. They could simply put in a different BIOS chip, which records you password the next time you enter it. Or a malicious RAM chip that injects a virus at runtime and extract your data that way. Or a bugged keyboard that transmits your key presses, combined with a full copy of your disk ... Sure, it's a bit more sophisticated than Ctrl+C/Ctrl+V. But if you're running a computer repair shop, it is quite likely that you have a good amount of technical knowledge. If someone has hardware access, you can usually see your device as compromised - especially if they have a lot of time and are expected to open up the device.

lorenzhs 5y ago
If that's your threat model, you should not be using any repair shop. And the attacks you describe are not just "a bit more sophisticated than Ctrl+C/Ctrl+V", they're most likely far beyond the abilities of most repair technicians.
- Sebb767 5y ago
  > If that's your threat model, you should not be using any repair shop. That's exactly what I said in my first comment: >> If you really don't trust them, you probably should not give them your device at all. > And the attacks you describe are not just "a bit more sophisticated than Ctrl+C/Ctrl+V", they're most likely far beyond the abilities of most repair technicians. The RAM one, yes. ROM chip swaps, on the other hand, are rather common. You will need to be able to solder quite well, but given the current state of macs, this is basically a given for anyone doing repairs on them. You'd of course need to get a malicious ROM chip, which might not be so easy, but probably doable - the technician only needs to be able to swap it, not to manufacture one. And if you can't get your hands on one - your can order a keylogger right now, for just a few bucks! [0] This was just the first result; if you invest a bit more time, you can surely find a smaller one or more fitting one. The keyboard is probably connected with USB [1], so no trouble there. As a bonus, you get all the passwords of accounts that were not saved at the time. Sure, simply unlocking is a bit easier. But it's not like this stuff is beyond anyone who is able to debug and solder on a Mac. [0] https://de.aliexpress.com/item/1005001988834597.html https://de.aliexpress.com/item/1005001988834597.html? [1] It's in my laptops; I don't know the specifics for macs, but I doubt is something more sophisticated than a strange plug.
  - Talanes 5y ago
    There are levels of trust. "Trust not to source and install malicious hardware in order to potentially steal unknown to them data" is a magnitude apart from "Trust not to go snooping around through unprotected photo albums."

lorenzhs 5y ago

If that's your threat model, you should not be using any repair shop. And the attacks you describe are not just "a bit more sophisticated than Ctrl+C/Ctrl+V", they're most likely far beyond the abilities of most repair technicians.

Sebb767 5y ago
> If that's your threat model, you should not be using any repair shop. That's exactly what I said in my first comment: >> If you really don't trust them, you probably should not give them your device at all. > And the attacks you describe are not just "a bit more sophisticated than Ctrl+C/Ctrl+V", they're most likely far beyond the abilities of most repair technicians. The RAM one, yes. ROM chip swaps, on the other hand, are rather common. You will need to be able to solder quite well, but given the current state of macs, this is basically a given for anyone doing repairs on them. You'd of course need to get a malicious ROM chip, which might not be so easy, but probably doable - the technician only needs to be able to swap it, not to manufacture one. And if you can't get your hands on one - your can order a keylogger right now, for just a few bucks! [0] This was just the first result; if you invest a bit more time, you can surely find a smaller one or more fitting one. The keyboard is probably connected with USB [1], so no trouble there. As a bonus, you get all the passwords of accounts that were not saved at the time. Sure, simply unlocking is a bit easier. But it's not like this stuff is beyond anyone who is able to debug and solder on a Mac. [0] https://de.aliexpress.com/item/1005001988834597.html https://de.aliexpress.com/item/1005001988834597.html? [1] It's in my laptops; I don't know the specifics for macs, but I doubt is something more sophisticated than a strange plug.
- Talanes 5y ago
  There are levels of trust. "Trust not to source and install malicious hardware in order to potentially steal unknown to them data" is a magnitude apart from "Trust not to go snooping around through unprotected photo albums."