Windows machines have things like TPM and Secure boot to help protect against firmware rootkits, but is Mac any safer in these regards? How does Mac work in the boot stage and is it any less suceptable to firmware rootkits? Are there any things like TPM and Secure boot for Mac to protect against these security problems?
-
8Beware, the less secure component of a personal device generaly lies between the keyboard and the chair... A standard OS offers standard security, but what matters most is the way you use it.– Serge BallestaCommented Apr 25, 2022 at 8:39
-
1Roughly speaking, we can say that Apple's Secure Enclave (support.apple.com/en-ca/guide/security/sec59b0b31ff/web) is much stronger than PC TPM's. I don't have time to write up a full answer, but here are some supporting links: medium.com/asecuritysite-when-bob-met-alice/… howtogeek.com/339705/… quora.com/…– PaulCommented Apr 25, 2022 at 19:06
-
W.r.t Secure Boot, I strongly suspect Macs are in a better position as well. IIUC both the Secure Enclave and the system start their boot from read-only firmware. (This did bite Apple once; it was possible to break the activation lock on T2 chip Macs and they could not fix it. Note we're talking about breaking a security feature that PC's don't even have.). Here is an article from Apple on the secure boot process in ARM-based Macs, note that virtually everything is checked, oftentimes with Secure Enclave help. support.apple.com/en-ca/guide/security/secac71d5623/web– PaulCommented Apr 25, 2022 at 19:20
-
1I'm sorry to keep posting links, but Apple has an excellent guide to the security of their systems at: support.apple.com/en-ca/guide/security/sec114e4db04/1/web/1 The first two links, Hardware Security (support.apple.com/en-ca/guide/security/secf020d1074/1/web/1), and System Security (support.apple.com/en-ca/guide/security/sec114e4db04/1/web/1), are concise and informative. It's interesting to note that for example files are encrypted with dedicated hardware using per-file keys that are not visible to the CPU nor OS (as a first approximation?).– PaulCommented Apr 25, 2022 at 19:31
-
1Some people believe Apple has set a trajectory to make Macs highly secure. It helps that they have virtually total control over their hardware and software stack, and that they don't worry too much about breaking existing applications. E.g., they recently introduced a change in macOS 12.3 that broke Dropbox, Google Drive, OneDrive, and probably others. They did give more than 2 years warning (and several postponements) before banning the kernel extensions these used to use. Now these all have to use an Apple API, which they've had years to work with.– PaulCommented Apr 25, 2022 at 19:42
|
Show 1 more comment
1 Answer
Are there any things like TPM and Secure boot for Mac to protect against these security problems?
Short version: Yes, and recent Macs have some very good security features like hardware-based RAM encryption that helps defeat things like freezing the physical RAM. I'm not sure I can give a good comparison of Mac vs. non-Mac hardware or firmware security in general; hopefully other answers can fill in more there. Instead, I want to focus on one area you mentioned.
"Evil maid" attacks are going to be largely undeterred. An easy form of evil maid attack (especially if you expect to get access to the machine more than once) is a hardware keylogger placed inside the machine, and Macs are no less vulnerable to that than PCs (they need some special tools, but so do many PCs). The keylogger just intercepts and logs the data flowing between the keyboard and the motherboard, and there's no opportunity for software to detect its presence. When the user boots the machine, they enter their FileVault password (which is probably also their login password), and the keylogger logs this. Later, the attacker opens up the machine to extract the keylogger again (or, if it's an especially fancy one, accesses its log via radio or Internet) to read the password out again.
There's nothing the OS or hardware can do to protect itself or your data, if the attacker is able to flawlessly authenticate as you.
answered Apr 25, 2022 at 5:23
-
1While Macs don't do this, it's worth mentioning that one-time codes can be used to thwart keyloggers - same as with online services. So while your last paragraph is a trivial truism, since much of your answer focuses on keyloggers it might be worth mentioning something that CAN be done by the OS/hardware to thwart those specificially. ...Also, e.g. Heads goes one step further by making the OS authenticate to YOU with TOTP, which makes it significantly harder to perform even sophisticated evil maids that e.g. replace the motherboard or reflash the firmware, since you can detect the tampering.– BorisCommented Apr 25, 2022 at 13:00
-
Some new MacBooks have TouchID and will often not require you to enter a password, which reduces the opportunities to catch one. On the other hand, once the attacker does manage to get the password, it's game over. There would be a workaround: If the keyboard can be told to transmit a permutation of the scan codes, it wouldn't transmit anything that can be used to detect the password easily. Commented Apr 25, 2022 at 16:56
-
6However, newer mac keyboards are actually securely paired and use encryption, which makes a hardware keylogger somewhat more difficult: support.apple.com/en-ca/guide/security/secf60513daa/web since you can't just put it on the 'USB' side, but probably on the matrix side.– MaxCommented Apr 25, 2022 at 17:05
-
@gnasher729 For unlocking the screen, yes. However, even after ten years FileVault still requires you to input the password to boot the system from shutdown. Even my 2020 MacBook Pro with a T2 chip won't unlock the drive automatically, and I bet Apple Silicon machines behave the same way. You could argue this is actually better for a key-logging attacker because they can forcibly shut down the machine with the power button (also less risky for messing around inside the device) and get a guaranteed password attempt basically as soon as the device is powered on.– BobCommented Apr 25, 2022 at 23:32
-
@Max That's a really interesting article, but it appears to apply specifically to external keyboards. Do you know if there's any such protection on laptop internal keyboards? Obviously in both cases the attacker could take the keyboard apart (after removing it from the laptop, if needed) and install the keylogger before the encryption, but it would be interesting to know if that's needed since the keyboard-mainboard connector is probably easier to tap. Also, you of course don't want a hardware keylogger on external USB if possible; it's too easy to spot and remove. Commented Apr 26, 2022 at 23:08