After FBI vs. Apple, I have a few questions about the security of my data. Here's my setup:

  • AppleID is connected to local account
  • I don't remember exactly, but I think I have selected option "Allow user to reset the password using Apple ID."
  • FileVault Enabled(note: It was enabled half month after the first setup, where I enabled the option above)
  • "Wake for WiFi Access" is enabled
  • "Find my Mac" enabled

What could determined law enforcement do if they confiscate my MacBook:

  1. while it is in sleep
  2. locked, but user is logged in
  3. powered off

What law enforcement can do, depends, yes, on the state of your computer, and on how many good computer scientists they know and how politely they ask for help. Please keep in mind that encryption can be broken using brute-force methods, and there are some really powerful computers out there that can break weak encryption schemes. Of course law enforcement getting access to those powerful computers and the computational expertise required to break the encryption is quite a feat of political savvy. Such a method would probably involve computer science research, so I will answer the question with methods that already exist in the public domain (i.e., methods that are readily accessible to law enforcement).

  1. While the laptop is in sleep

    A determined person could try an exploit that attempts to use lan-scanning events to gain access to the OS. Most of these successful exploits use the wireless card. Some of these exploits yield significant access, and sometimes root access, depending on the operating system. These exploits do work on Mac OS X.

    Since you have the ability to reset your password using the AppleID, a politically savvy professional could convince Apple to give up your AppleID or enter it to gain access to the OS.

    There are USB trojans that yield root access on Mac OS. A determined professional could use one of these trojans to gain access to your data.

    There may be iPhone/iTunes vulnerabilities which can be used to gain access.

  2. While the laptop is locked, but the user logged in

    Remember that they encryption key for the hard-drive is on your computer, somewhere that it can be access very early in the boot process. This key should be accessible by rebooting the machine in a different OS that can read the boot portion of the hard disk. It is possible that with some OS-specific expertise, the key can be located, and subjected to a brute-force password hack. Such a effort would very likely be successful, and it would only require a small cluster of computers to do this quickly.

  3. While the laptop is powered off

    If the computer can be booted, then this offers very little more protection over the other states. Did you set a bios password or boot password? If so, then the determined professional would have to brute-force those passwords. Then they could employ any of the techniques listed above.

On the other hand, the easiest thing that law enforcement can do is deprive you access to your data forever. With this encryption scheme it is very easy to destroy the contents of the hard disk by destroying the encryption key. I assumed above that your main concern was someone accessing your data.

Please keep in mind that the techniques mentioned here have a lifetime. These things work until the vulnerabilities are repaired. These methods are current as of late last year, 2015.

  • What if password is really long(40+ characters, alphanum+special characters)? Is it vulnerable to brute-force? – assp1r1n3 Mar 20 '16 at 18:20
  • Of course, everything is vulnerable to brute-force attack. The question is how long does the attacker want to wait and what kind of computational resources do they have access to. – Brent Kirkpatrick Mar 20 '16 at 18:32
  • This discussion seems quite related to: security.stackexchange.com/questions/117272/… – Brent Kirkpatrick Mar 20 '16 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.