0

Let's suppose i lend my new macbook to a (dishonest) friend. This is a new fresh macbook, just unboxed.

My friend does what ever he wants on this macbook.

One month later, he gives me back the macbook.

I want to work with this macbook and i will store confidential documents on it.

So i decide to re-install mac os before working on the macbook.

There are no dvd of mac os x: Mac os installation media is stored on an hidden partition. Some installation files are downloaded from apple servers but there might be at least a bootloader on the hidden partition.

My question is: Is it possible for my friend to install a malware on the hidden partition (for example a kernel mode keylogger) that will be integrated to my new mac os installation.

In other words: Do you think the macbook is checking hidden partition integrity (with a checksum for example) ?

Thanks a lot

Improve this question
2
  • The installation files aren't found on a hidden partition, they are downloaded form Apple's servers (and verified) before installation.
    – At0micMutex
    Commented Dec 7, 2021 at 15:06
  • Yes but the small software which download the full os from Apple’s servers may be corrupted
    – Bob5421
    Commented Dec 7, 2021 at 15:41

1 Answer 1

Reset to default
0

MacOS checks the integrity of the filesystem and updates during installation and at runtime (SIP). But Apple does not always get things right:

https://www.microsoft.com/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/

The best way to restore the laptop would be through DFU restore which is the lowest level. If your friend has access to some private keys from Apple, found some bug for the install/verification process or has the ability to infect firmware(s) on the device you still could have a problem.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .