Accessible to an attacker who has reset the administrator password

firmware-passwordpasswordSecurity

I understand that it is possible to reset the administrator password on a Mac, allowing someone with physical access to a machine to create a new password that gives them access to all files unlocked files remaining on the machine after the reset process.

But what else do they have access to? Specifically:

  1. Are all user accounts still present?
  2. Are all keychains still present, or are they reset or cleared as part of the password creation process?
  3. If the keychains are still present, does the (new) administrator have access to the contents of existing keychains.
  4. Are any files (other than keychains) erased or reset as part of the process?

I assume that FileVault protects against using this technique in an attack; would a firmware password confer any protection?

Best Answer

If FileVault is enabled, booting into single user mode requires a password, so neither of the methods for resetting the password in single user mode work.

As others have mentioned, resetting the login password doesn't reset the password of the login keychain. I tried resetting the login password a few months ago. I could access most files normally, but not my account in Mail.app or auto-filled passwords in Safari. But I could access my Gmail account from Safari because I had set it to log in automatically.

The login password (but not the password of the login keychain) can also be reset with an Apple ID. There's a checkbox for allowing that when creating an account. I think it was checked by default. The option can be disabled later in the Users & Groups preference pane. If the option was enabled before you turned FileVault on, you cannot disable it without turning FileVault off and back on. See Michael Tsai - Blog - FileVault 2’s Apple ID Backdoor.

1. Are all user accounts still present?

Yes. And all of their passwords can be changed separately, or from the Users & Groups preferences after logging in to (or creating) one adminstrator account.

2. Are all keychains still present, or are they reset or cleared as part of the password creation process?

The keychains aren't removed, but the login keychain isn't unlocked automatically after the login password is reset.

3. If the keychains are still present, does the (new) administrator have access to the contents of existing keychains.

Not without knowing their passwords.

4. Are any files (other than keychains) erased or reset as part of the process?

I don't know, but you can access most files normally.

Related Question