1

What security advantages, if any, would be gained by enabling Firmware Password Protection on a mac that allready has filevault encryption for the disk?

1

Setting a firmware password prevents your Mac from starting up from any device other than the built in hard drive.

Even if the contents of the hard drive are encrypted, the attacker could still modify the boot sector or copy the contents of the drive.

1

Okay. Let me try to explain this scenario practically using a Windows analogy first:

"I was in high school and had chosen Computer Science as my major. We were asked to bring our own laptops. Naturally, being kids we were pretty notorious. Since all of the students in our class had their Windows Logon Password enabled, me and my friend thought that it would be fun to hack into their PC's. We opened up their PC's during break, changed the primary boot device to a USB using the BIOS and installed OfflineNT in a USB drive. Now the cool part was that OfflineNT was capable of resetting the UAC password (read: clearing the password). We would do this and then boot into the PC bypassing the logon passwords (since it was now cleared) and set stupid wallpapers for fun sake." After being caught, we then told them that the best way to prevent such mishaps is to enable the BIOS password protection which asks you for a password even before letting you boot into the PC thus preventing us from changing the primary boot device to USB.

Firmware password protection is pretty much along the similar lines. It prevents you from changing the boot options. My point is that even though you have FileVault Encryption Enabled an attacker could easily boot into the PC and try to circumvent the protection and copy the contents. Cloning the drive is possible using tools like SuperDuper which will let you clone the entire drive. The attacker can then use his/her leisure time to crack thru the encryption using brute force tools and then peek at your data. Enabling Firmware Protection will help you prevent all this.

Hope it helps. :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.