Closing off firewire connect security hole

Question

I connected my Macbook Pro to my iMac to transfer accounts over firewire. It seems i can see the origin Mac's user folders without any trouble at all. I mean i can see the contents and copy all of them over, without using the migration assistant's options. I simply use finder, see the mac HD that is the origin and copy stuff from any account on that mac to the account i am logged into on destination mac. Is there a problem with the folder permissions of origin mac? I checked and they were fine. Is there a way i can now setup my MacBook Pro to not allow such snooping and copying permissions once it is connected via firewire?

Answer 1

As mentioned, there is single user mode. Very useful for troubleshooting, but for nefarious individuals, this is the root kit hack that is built in for all to use. Start your machine holding down the Apple and the S keys. This will enter you into single user mode. From here, you have access to everything as root. Thus, for intruders with physical access to the machine, a reboot and that key combination provides unrestricted access. This access can be used to transfer data to another drive, fire up a network stack, or worse. Four commands and no knowledge of prior accounts or passwords can reset the admin password and have near full access to the account after a reboot.
Likewise, if you have another volume with a bootable OS, say on a firewire/USB drive, a nefarious user can plug it it, force a reboot, hold down the option key and then select the alternate bootable volume. This will allow booting the machine from the external drive and that too can provide unrestricted access to the normal internal drive.
Please keep in mind that I am not saying these are security flaws in the design of OS X or the hardware. These are features that are indispensable to field service technicians and serve very useful purposes for normal operation with Apple hardware. I am simply stating the obvious. Physical access to a machine means complete access to data. As long as you are not running excess services or visiting questionable locations on the internet, you are pretty safe.
Apple does have features in place to protect security conscious individuals. As mentioned, the Firmware password is the first step. However, as you can discover, physical access can overcome firmware passwords. If you have critical information on the machine, you should look at File Vault. Research it before you enable it as you need to make specific adjustments to how you backup and interact with your machine. If you use it, never sleep the machine while logged in to your account. Next, enable encrypted swap and periodically perform a secure erase of free space. These are all features built into the OS.
If you are using a laptop and travel with it, these suggestions should be considered. Think about how many places between home and that business meeting four states away that your laptop can sprout legs and walk. If that was to happen and it contains proprietary information, product development information, personal or financial data, etc, think about the nightmare you would be in trying to cover all the exploits. Heck, even if you were to get your address book taken or email account exploited.
Again, do not misread my post. The features are there for a reason and provide functionality that is required to manage, repair, and diagnose Apple hardware. These features are not security risks unless the machine is accessible by people of questionable intent. For those instances, Apple has provided methods to protect your data. For machines that are in your home, behind a locked door, you should be pretty safe. If this is a laptop that travels or a machine in a school or other public space, then these are "features" that need to be suppressed.
Hope this helps.