CDs are dangerous

[rbandrews]

Public Service Announcement Shaming:

Reading how to reset the root password on a Mac led to this little tidbit:

"IMPORTANT: Because a user with the Mac OS X install disc can gain unrestricted access to your computer, you should keep the disc in a safe place."

What's that, Apple? Did you just say that if any idiot with a blank CD has physical access to my CD drive, they can root my machine?

I bet the Math Emporium people would find that interesting...

Comments

[rbandrews]

It's still stupid. They should make the disc that can change the password specific to that computer.

[wyrdone.livejournal.com]

Specific to the computer == hellishly expensive.

As stated the only way to protect against this is to hardware encrypt the HDD.

[rbandrews]

You can't even buy a Mac without a CD burner, so what's wrong with during the install "insert a blank CD now to make a recovery disc; don't lose it!"

Obviously if you have physical access to a machine you can root it, there's no way around that, but at least make it harder than "boot off this easily-obtainable CD". Make it require a screwdriver. Make it where you can't do it without it being immediately obvious to whoever is guarding the machines that you're doing something you shouldn't.

[candle.livejournal.com]

OK, so how do you do that?

The passwords are stored using a known hashing algorithm in a known file using a known salt. The only way to keep someone from being able to overwrite the file is to use encryption to prevent access to it or the salt. Except then there's also the fact that hard drive file security is OS enforced, so if you're booting from an external OS, even if I can't overwrite the password files, I could replace a binary (or tag a line onto your .bashrc) that normally requires sudo-style privilege escalation (so as not to cause suspicion in the user) with one that roots the system. So to protect against that, you've basically got to encrypt every executable.

So now you have to type in a password every time you boot up. That doesn't sound like something the average Mac user wants to do. There's enough that dislike having to log in once, let alone twice. You could theoretically get your encryption password from the hardware, but then your hard drive is tied to your specific motherboard (no more bootable hard drives that you can use different places) and if the MB fails, then the hard drive is locked.

Then there's also the factor that hard drive encryption greatly increases the chance of irrecoverable hard drive corruption and system problems. So Apple has to weigh the combination of risk assessment between the potential cost to them of being disliked for being hackable via boot CD vs. the increased service costs of encryption, potential data loss, and increased consumer dislike of their product because it's gotten harder to use. Far more Mac users are concerned at the idea that someone could change their password than losing ease of use or data loss.

Then there's also the evaluation of what's actually valuable on your hard drive and what's worth fighting hard to protect. Your OS is next to worthless to an attacker or to you (if you lose it) - your user data is.

[rbandrews]

The goal shouldn't be to make it impossible, that's obviously not going to happen. The goal should be to make it reasonably hard. If I have to boot into something else, that's reasonably hard. If they vary the salt and store it on a system-specific emergency boot CD, that's reasonably hard.

[candle.livejournal.com]

To an attacker, there's no appreciable difference to using a Knoppix disc than an official OS X password reset disc, so your suggested change would not prevent any but the dumbest attackers but would make genuine users' lives harder. If you've not read it, you should get a copy of Beyond Fear (http://www.schneier.com/book-beyondfear.html).

A tidbit I forgot to tag on previously - most users are prolly more worried that if someone has physical access to their computer that they're going to steal it than root it.

[rbandrews]

This is just the thread that will not end, isn't it?

There are places where there are lots of Macs and most people who use them are not root. One of these is the Math Emporium.

If you boot a Mac off of Knoppix and fiddle around with it, someone walking around watching you, like the people at the Math Emporium, will notice and stop you.

If you boot a Mac off its install disc, it still looks like a Mac unless you look closely, so people walking around watching you won't notice.

Thus, making it just a little bit harder would, in the specific case I mentioned, have a real security benefit.

Why is that so hard to comprehend?