I did a little research and quickly came up with a simple process that was shocking! Simply:
- Starting the Mac with two keys pressed brought it up in a terminal session logged in as root (the most authoritative user on the system).
- Three simple commands produced a list of all users on the computer (their short names), and
- One more command allowed me to change any of those users' passwords to whatever I wanted.
- Then a simple reboot allowed me to login as them with their new password, giving me access to all of their files!
Are you kidding me, Apple?!!? Can't you at least require a password or some other methodology to protect the files on your computers?
Posts
6 comments:
Thankfully, the most common user of a Mac would have no clue how to do this. Nor would they try to go through all that trouble; they could just as easily take their computer to an Apple Store and have them reset a password.
Plus, to be fair, it's not like the similar isn't impossible on any Windows machine...XP, Vista, Win7...run the same Google search for resetting a password in Windows and nearly identical, and as complicated, results come up that the common person would never, ever try. They'd seek the help of a "professional" before attempting any of this.
In my opinion, this is much ado about nothing.
I agree that most Mac users would never get into this stuff. My greater concern is the easy ability for someone to hijack a system and its contents. Though there are ways to do this on a Windows computer too (I'm not out to bash Macs; I like them!), the difference is that to do so I need something other than just the computer to do it... like Windows install media. Requiring anything additional on a Mac would be an improvement.
Vulnerable? It's physical access, physical access is everything.
Very simple protections against this for IT support
As anonymous has said - it's all about access.
If someone has physical access then it's game over in terms of security.
Now if they had enabled FileVault on their home folder in Snow Leopard or FileVault on the hard drive in Lion, it would a lot harder and basically impossible unless they knew their password. Although if you did set a master password in security System Preference, like in an IT environment, one could reset the password.
Post a Comment