Root access in recovery mode terminal

Question

Level 1

9 points

Root access in recovery mode terminal

I found out that opening a terminal in the recovery mode allows me to log into the system as 'root' user without authentication. While this happened to save me from an issue that locked me out of my Mac, I am very concerned that such access to the system is even possible.

This, to me, suggests that anyone who has physical access to my Mac can go into the recovery mode and have a root access without authentication. Is my concern misplaced? Or is my system misconfigured in some way?

I am using Sierra, and I have NOT enabled root account in Disk Utility.

Any advice/feedback would be very much appreciated.

macOS Sierra (10.12.5)

Posted on Jul 19, 2017 8:54 AM

Reply

Answer 1

Barney-15E

Level 10

122,186 points

Jul 19, 2017 10:07 AM in response to Tmzm

Yes, that is all true. They can also remove your hard drive and get access to all information, regardless of the permissions.

If you wish to prevent single-user or Recovery root access, Enable a Firmware password or use FileVault, or both.

Use a firmware password on your Mac - Apple Support

Make sure you write down and save each password. Recovery of your data is impossible if you lose the FileVault password. An Apple Store can reset the Firmware password, but only physically in the store with your proof of ownership. They cannot recover a lost FileVault password or the encrypted data.

Reply

Answer 2

John Galt

Level 10

155,510 points

Jul 19, 2017 1:30 PM in response to Tmzm

FileVault renders a hard disk's contents totally inaccessible without its password.

Removing a hard disk drive from a portable Mac takes about five minutes. Its contents will remain permanently inaccessible, irretrievable and useless to anyone without its FileVault password.

Full disk encryption has already been incorporated in iOS for years, and is likely to become the default in future macOS releases. iOS device security has been the subject of at least a couple of high profile cases recently.

By reversing the process I just went through, anyone who gains physical access to a Mac can, in a matter of a few minutes, render it inoperable.

Sure. You can smash it with a rock. It takes no experience to do that.

If you should ever lose your Mac, or even if you want to secure it while it's not in your possession, read If your Mac is lost or stolen - Apple Support.

Reply

Answer 3

etresoft

Level 9

56,374 points

Jul 19, 2017 2:34 PM in response to Tmzm

Tmzm wrote:

what can be done to influence Apple to change this?

Ask them: Product Feedback - Apple

Every year I'm surprised that Apple hasn't made a lock-down iOS mode an option in macOS. I know that scamware and adware is out of control right now. True malware is on the rise too. I think quite a lot of people would go for a more secure macOS.

Reply

Answer 4

Tmzm Author

Level 1

9 points

Jul 19, 2017 12:07 PM in response to Barney-15E

Thank you very much for your quick response. I already use File Vault; but will look into setting up a firmware password.

Just to be clear though, removing a hard driver or SSD, especially from a laptop, is an arduous task. Furthermore, disk encyrption solves only a subset of computer security cocerns.

By reversing the process I just went through, anyone who gains physical access to a Mac can, in a matter of a few minutes, render it inoperable. A more experienced user probably can do much mischief beyond that.

I see this as a back door; it is difficult for me to fathom how this is a good default set up for any Mac users.

Do you agree with my sentiment? If so, what can be done to influence Apple to change this?

Reply

Answer 5

Tmzm Author

Level 1

9 points

Jul 19, 2017 1:49 PM in response to John Galt

Smashing a laptop vs making it inoperable have very different impact to the owner of the system. In the case of the latter, the owner may not even suspect any foul play.

Just for my further education, what is the scope of the power of this 'root' account with respect to the operating system security features, including user administration?

Reply

Answer 6

John Galt

Level 10

155,510 points

Jul 19, 2017 2:17 PM in response to Tmzm

You asked about the ability to render a Mac inoperable: "... anyone who gains physical access to a Mac can, in a matter of a few minutes, render it inoperable". Well, of course. It wouldn't even take that long. Ask anyone who's spilled a cup of coffee on one.

The point is that physical access to a Mac conveys the ability to perpetrate intrusive acts limited only by one's imagination, time, and available funds.

You're asking hypothetical questions for which there are only hypothetical answers.

Given FileVault access, the root user may access the contents of all User Accounts, but (as long as SIP remains enabled) not macOS itself.

Reply

Answer 7

Barney-15E

Level 10

122,186 points

Jul 19, 2017 2:56 PM in response to Tmzm

No, I don't agree. Creating such a system would be mostly unusable.

iOS is pretty much locked down, but with physical access I can render an iPhone unusable in less than a second.

I certainly don't want my computer locked down to that extreme. It would serve no purpose to lock it down like that from an Availability perspective since anyone can destroy it just as easily.

If your data is more valuable than the physical computer, FileVault and shutting down your computer when you cannot maintain physical control is a must. I can just rip the case open and take the drive will little effort. And, I don't need to tear it apart at your home, office, or whatever. I can do that anywhere at any later moment.

Physical control is the key to all security.

While brute force attacks against a mixed-case, alpha-numeric, symbol password is not feasible right now, quantum computing may soon make that quite feasible.

Reply

Answer 8

Tmzm Author

Level 1

9 points

Jul 19, 2017 7:17 PM in response to Barney-15E

It was not at all my intent to discuss the ideal security model for the operating system or how much damage one can do to a system - physical or otherwise - in a short period of time.

The primary purpose of this post was to understand what this root access would allow one to do to the system. It is still not very clear to me. I was able to do something to my system using this access, which was very surprising to me. But despite what I suggested earlier, the reverse may not be possible based on a quick test that I have just run. With that said, this is more than just the terminal access, but what recovery process would allow one to do to the system.

As John Galt kindly pointed out, Apple provides a way to restrict access to recovery mode, which, to my naive eyes, is more than an adequate solution. Should recovery mode present tangible security vulnerability, I, then, wanted to know if experienced and knowledgeable Mac users like yourselves thought it best if Apple made such solution a default, rather than an option.

In any case, etresoft, thank you for the link. I have used the feedback system for further inquiry into this.

Reply