1

Recently I brought my MacBook Air to a Genius Bar to perform a clean MacOS installation. For security purposes, I asked for a hardware check as well. The Genius Bar technician ran Apple Diagnostics, claiming that the test can check whether the hardware components of my computer have been tampered with.

After the test completed, a list of component information appeared on the technician's iPad (which I didn't read). He scrolled through all of the items and concluded that my computer is secure in terms of hardware modifications.

I would like to ask how secure a Mac is if it passes Apple Diagnostics. As an example, if an attacker disassembled my MacBook Air and inserted a hardware keylogger, I doubt that the hardware test could find it.

  • 1
    Realistically, unless you have reason to believe that the FBI, Mossad, the FSB, or some other nation-state security service has tampered with your computer and there are no unknown devices physically plugged into it, it's reasonable to assume the hardware has not been compromised. – Stephen Touset Jun 13 at 5:46
3

Apple Diagnostics is not designed for this purpose, and cannot prove your Mac is secure.

However, you should probably still assume you are safe from such a hardware-based attack.

It is important to note that Apple Diagnostics is a tool focused on testing hardware health, not focused on security assurance. So, we can assume that it isn't looking for things which it doesn't expect (within reason, I'm sure some aftermarket modifications that Apple dislikes would be found and flagged). Anybody with the resources for an attack like you describe — disassembling a MacBook Air, inserting a custom designed keylogger, and reassembling the machine — would have the resources to design it such that Apple Diagnostics wouldn't discover it.

But as the comment above by Stephen Touset points out, unless your threat model includes being targeted by some very well resourced attackers (clandestine services of nation states, elite private offensive security contractors, etc), whose attacks would include having undetected physical access to your computer, the risk of that kind of physical attack is insignificant. A MacBook Air is a particularly challenging target, as the interior of the machine is densely packed, difficult to access without leaving evidence, and generally just inaccessible.

Unless you have sincere, well-founded concern about the machine, hardware will not be the way you are attacked. Your risks are much more likely to be software-based attacks. And if you do have sincere, well-founded concern, then there's no way that a simple hardware diagnostics tool can ever prove the negative. In such a case, your only realistic option is to completely replace the unit with one that can't be linked to you (including being invoiced or delivered in your name or address, or being paid for by any method that can be connected to your identity or address).

  • Apple could sign the firmware on the various components and Diagnostics could confirm the signature in case someone tried to install aftermarket components. That's not far fetched given their strategy to prevent self-fixing. – schroeder Jun 13 at 9:24
  • According to Apple, the system serial number can become unavailable if the system changes hardware (developer.apple.com/library/archive/technotes/tn1103/…) I cannot find details on how exactly this effect gets triggered, but I speculate that this is one way to determine hardware tampering. See diagnostics code NNN001 support.apple.com/en-gb/HT203747 – schroeder Jun 13 at 9:33
  • @schroeder If I'm not mistaken, Apple does sign firmware (even in official chargers and cables if I recall correctly). But, for example, a hardware keylogger inserted inline or sensing induction could still be recording without any tampering to existing components, and without being visible to the Diagnostics (retrieval or exfiltration of that recorded data is another challenge, of course, but not in the scope of the question). If we're in the realm of hardware what-ifs by capable and resourced opponents, it's not out of the question. – Johnny Jun 13 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.