Mastodawn

Another reason to hate #Apple We're seeing more 2018+ MacBook Pro/Air donations — but Apple's T2 chip means even after iCloud sign-out and reset, the firmware stays locked to the original account.

Without donor contact, these machines are useless. :(

I've upcycled ~1,000 older Macs, but T2 era machines will end that. It's controlling, creates e-waste, and will only get worse. #righttorepair matters — Apple couldn't care less.

coldclimate Apr 15

@codemonkeymike this is astoundingly shit

@coldclimate it really hurts every one of my brain cells. How could they not have thought about this?

Eric Jennings Apr 15

@codemonkeymike @coldclimate Well. The use case they were trying to solve for was someone steals your laptop and tries to access it without your permission.

Hard part is getting owners to unlock it before donating/selling to someone else.

@HitokiriEric @coldclimate but here's the rub for me. Even if a user logs into their iCloud account and removes the device from their account, it still won't release.

That should be illegal.

Even enterprise locked Chromebooks can be decommissioned remotely and unlocked.

There is no reason this cant be done with apple.

Eric Jennings Apr 16

@codemonkeymike @coldclimate

Hmm… for the hardware firmware I’d still want to have to unlock it on device rather than having an attack surface/backdoor from the internet to exploit. Apple had the issue a couple years ago with thieves exploiting the remote password change to workaround the phone protections.

But I get how it sucks for this use case.

Like a lot of things, for 99% of users who don’t care they should default to a version that’s secure from most thieves but not totally secure from government and then let the users who really care opt in to the stronger lockdown mode.

@HitokiriEric @coldclimate yeah. I mean look. You can unsolder the t2 chip and reprogram it etc. Motivated thiefs can still do it.

But was this when a problem? I really don't think it was.

Again. Look at Chromebooks. They have a firmware level lock too that can't be hacked. And yet it can be decomissioned remotely when the org releases it.

You're telling me apple couldn't do this?! For regular users? Its a racket

Eric Jennings Apr 16

@codemonkeymike @coldclimate Well. When that generation of laptops was new, that was a big feature that Apple was selling hard on. They kept trying to lock them down more and more to attempt to be as secure as possible by default and were so proud of how hard it was to defeat.

I’m not saying they couldn’t do better and better consider different choices to improve the balance for different types of users. Which they have done since then.

I’m just saying that back then, the discussion was all about making them as secure as they could think to make them and that’s what they optimized for. It’s not a surprise they went too far back then when that was top of mind for them.

Eric Jennings Apr 16

@codemonkeymike @coldclimate Keep in mind how proud they were of resisting government attempts to access devices and saying that they would design them so that Apple would have no ability to unlock them for governments.

vriesk (Jan Srz)Apr 16

@HitokiriEric @codemonkeymike @coldclimate But unlocking them to provide access to stored data is completely different than unlocking it so that it is wiped clean, fresh, and shiny for somebody else to use.

@vriesk @HitokiriEric @coldclimate exactly.. i'm not saying break encryption or offer a back door. That's fine.. i stand by that.

But if a user logs into their secure apple account and removes a device, that device should be able to be wiped and reused.

Hard stop. If you have an issue with that.. you're pro-ewaste

Eric Jennings Apr 16

@codemonkeymike @vriesk @coldclimate

I’m with you that overall, the default settings for Find My should allow users to deactivate the lock remotely. Most users would benefit greatly and it would make it so much easier to transfer devices.

I think they still should have an opt-in mode where you can go into a higher security mode and remote unlocks are completely disabled. I don’t think it’s pro-ewaste to make that level of security available and optional.

@HitokiriEric @vriesk @coldclimate agree completely. I'd have no issue with that.

That's secure by default but sensible settings for most users.. and if you wanna go into hard core mode.. then go for it

Eric Jennings Apr 16

@codemonkeymike @vriesk @coldclimate All said and done. Good luck with the batch you have. Sucks that they’re so hard to deal with. You’re doing great work and it’s good to see people posting about it.

Wink and the Broken Robot Apr 21

@HitokiriEric And now they bow down to fascists. How funny

William B Peckham Apr 16

@codemonkeymike @HitokiriEric @coldclimate frankly, the last time I liked what Apple did, they were making the Apple IIe

Wink and the Broken Robot Apr 21

@wbpeckham That's pretty silly. They did a lot of great things in the late 90s and 2000s

William B Peckham Apr 21

@winkwinkerson That might depend on your perception and definition of great in this context. Our perspectives are clearly different and I think we'll just agree to disagree on that.

Chaslinux Apr 16

@codemonkeymike

Does removing the BIOS security screw get around this? I've installed Debian on some Chromebooks, but I suspect they were already released from any corporate locks.

@chaslinux nope.. write protect screw has no effect on firmware lock.. trust me.. i've tried haha

Chaslinux Apr 16

@codemonkeymike thanks, that confirms what I thought, the org de- registered everything before they gave it to us. We had the same issue with a huge dump of iPads years ago.

toadjaune Apr 16

@codemonkeymike @HitokiriEric @coldclimate

Hi, so, question tangential to this thread : about current Macbook theft and activation lock bypass.

So, afaict Macbook theft is still a thing, which means that there must be a way for thieves to get something out of those machines.

Are they just hoping that the machine they stole isn't activation-locked ? Is there like, an entire underground economy of replacing T2 chips to then resell (mostly) functional Macs ?

toadjaune Apr 16

@codemonkeymike @HitokiriEric @coldclimate also, regarding the Macs you have on your hands, I'm assuming quite a few of them are on the older side, and don't get security updates anymore.

Aren't there like, known vulnerabilities/jailbreaks for those ?

Or even "unpatchable without hardware revision" vulns

raspberry Apr 17

@toadjaune @codemonkeymike @HitokiriEric @coldclimate they may sell the device in a locked state to someone not knowing that it is locked and that its useless without it bring unlocked. I figure also people can use the mainboards as donors for lifting parts to repair other macs for parts that aren't serialized to the board

toadjaune Apr 17

@theraspb @codemonkeymike @HitokiriEric @coldclimate that seems pretty limited, though.
I'd be curious to see stats about Mac theft since the introduction of those features

aura, disgraced heretic Apr 16

@codemonkeymike @HitokiriEric @coldclimate You can remotely remove a machine from activation lock, but "deleting" the machine from Find My does not do that. I've done this incorrectly with a work T2 machine that they had unlocked by Apple after I left instead (with invoice and such), but it still sometimes checked in to my Find My (with the new user's hostname no less, good engineering apple) until I actually removed it properly.

aura, disgraced heretic Apr 16

It feels like deliberately shitty UX so you don't actually release your old activation locked hardware by accident.

@aura exactly. Why is it so confusing. We're nerds and we couldn't figure it out. I gave an old Mac mini to a friend and was really confident I had removed all the hooks.

And still, the bootloader was locked to my Apple id and there was no way around it other than giving him my apple password and then 3fa the login attempt.

It's ridiculous.

Wink and the Broken Robot Apr 21

@aura I think it's shitty UX because it gets Apple slightly more money from people who have to buy a new one

@aura @codemonkeymike @HitokiriEric @coldclimate Had a new Mac with a line of dead pixels. Apple support kindly guided me through reset and removal from my account while connected to the internet. Exchanged for a new one. A couple of months later I get a notification that the dead pixel Mac has been added to my Facetime and such … I was able to verify because I kept the serial number screen shots.

Wink and the Broken Robot Apr 21

@HenryT That makes it seem like they're making things *less* secure in some ways

Siegfried.Apr 16

@HitokiriEric @codemonkeymike @coldclimate I guess the real use case is, they want people to buy (new) apples, donating is reducing business.

Sven Lakemeier Apr 16

@realSiegfried you know what makes people buy even more devices? If they are stolen often, so why would Apple make them unattractive to thieves in your logic. That surely is the bigger market than donated hardware without donor contact to do a proper unlock.

Siegfried.Apr 16

@sven You might be right. Looking back on my life, I’ve bought a number of computers over the course of several decades—partly because of hardware requirements, but mainly because of the software; however, none of them were stolen.

Disco3000 Apr 16

@HitokiriEric @codemonkeymike @coldclimate this! It even tells you when you reset the mac (what you should definitely do because of your data on it). You have to actively skip that step to disable “find my” functionality. I assume its mostly Noobs or companies that don’t care what happens to the machines after they decommissioned it. 🫤

[email protected]:~$

@HitokiriEric @codemonkeymike @coldclimate

Reminds me of back in the early days, one of my first sells on eBay was an old iPhone. I was naive enough to not know that the purchaser could mark it as paid without actually paying. Not know how the process worked, I shipped the iPhone not realizing I was never actually paid (and never going to be). The purchaser deleted their eBay account to cover their tracks. The BIG irony... I forgot to reset the phone. I later got angry, threatening messages from the purchaser under a different account saying they would disassemble for parts if I didn't give them the password for the phone they never paid for. 😂

Point is, ya... Apple's anti-theft technology is from their viewpoint a feature, not a bug.

Eric Jennings Apr 16

@kodamachameleon Sorry you got scammed and harassed but that’s one hell of a funny story in the end. 🤣

[email protected]:~$

@HitokiriEric I can look back now and laugh about it. At the time... well, you can imagine.

@codemonkeymike @coldclimate assuming they didn't seems excessively generous to me. It seems far more likely they did and don't care. Smaller secondhand market means more pressure for new purchases.

Rasmus Lindegaard Apr 16

@codemonkeymike @coldclimate I'm one hundred percent sure they DID think of this

Leo Schuldiner🤘🏼Apr 16

@rasmus91 @codemonkeymike @coldclimate I totally agree. They are capable of converting your laptop in literally garbage if you don't upgrade your OS.. only that is immoral.

Wink and the Broken Robot Apr 21

@codemonkeymike They thought about it. They just didn't care

Jake in the desert Apr 17

@coldclimate @codemonkeymike I stopped with Apple stuff after an early iMac.. I hated how non-customizable their ecosystem is. Just like Microsoft, they lost something along the way.

@codemonkeymike Can these not run a Linux distro instead of MacOS?

@paulywill they can.. of course. But you need to unlock the bootloader to do that.. and you can't do that while its locked :(

That's the entire issue..

@codemonkeymike I am interested to see if you have tried this method

https://mrmacintosh.com/how-to-restore-bridgeos-on-a-t2-mac-how-to-put-a-mac-into-dfu-mode/

And

https://mrmacintosh.com/how-to-remove-mac-firmware-password-new-way-if-you-have-a-2018-2020-t2-mac/

You need a second Mac that works and you control the one with a firmware lock using Apple Configurator. I have converted Apple Macs to run Linux but all of them have been 2017 or earlier.

How to Restore BridgeOS on a T2 Mac + Boot a Mac to DFU Mode

macOS Update brick your Mac? This article will show you how boot to DFU Mode and restore BridgeOS on a T2 MacBook Pro, Air, iMac Pro, Mac Mini & Mac Pro!

Mr. Macintosh

@vicash yup.. doesnt work if you don't know the activation password.. AND if you can't prove ownership.

It's shit mate

@codemonkeymike did you try https://theapplewiki.com/wiki/Checkra1n their site says they have experimental support for T2 processors.

Checkra1n

checkra1n is a semi-tethered jailbreak, developed primarily by Luca Todesco (qwertyoruiop). It's based on the checkm8 bootrom exploit released by axi0mX. checkra1n...

The Apple Wiki

@codemonkeymike wow.

@codemonkeymike is there a way in your experience to extract the hash of the firmware password from the chip via SPI bus or similar ? Then run hashcat on it. It’s excessive for sure, but maybe a solution can be devised somehow. Extract some hash or firmware and find an exploit or something and find a working solution eventually. In the end the chip is an oracle and something is verifying the firmware password which has to be stored in memory.

Ankh-Morpork Parks and Rec 🌱Apr 15

@codemonkeymike ugh, how infuriating. Such a waste.

@coreysnipes it really breaks my brain. And it's just starting..

The ONLY solution seems to be this super long and complicated procedure of literally unsoldering the t2 chip, directly reprogramming it, resoldering it, and then hookign it up to another mac in DFW mode,etc.. HOURS of work just to use a machine you own

Ankh-Morpork Parks and Rec 🌱Apr 15

@codemonkeymike That's just malicious. 😠

@coreysnipes textbook Apple.. I hate it so much.

Like, I can't even tell you how many lives have been improved and SAVED because I was able to install linux on an older mac and give it to someone.

This kills that..

Victor Oxyrhynchus Apr 15

@codemonkeymike I don't know the legality of it, but there's a T203 tool from Ali Express plus desoldering and resoldering that is supposed to overcome this. If I had a bunch of these that were legit donations I might try to figure this out, if it works.

@Victorsigmoid have you seen the video of that? I just watched it and holy shit its intense haha.

I mean I AM considering it.. but what a nightmare.. its' super time consuming.. and you still need another up to date mac to hook it up to in DFW mode..

So even after ALL that.. you still end up needing a current Mac.. god i hate them

@codemonkeymike
I'll be curious to see that, do you have a link to it?
@Victorsigmoid

Victor Oxyrhynchus Apr 15

@magnetic_tape @codemonkeymike I watched the ifixit video, https://www.ifixit.com/Guide/How+to+Remove+MacBook+ID+Activation+Lock+by+T203/143072

How to Remove MacBook ID Activation Lock by T203

In daily MacBook repair, unlocking ID activation lock is commonly seen. For example, ID activation lock will appear on the system activation...

iFixit

🐈‍⬛David Sommerseth Apr 16

@Victorsigmoid @magnetic_tape @codemonkeymike

Have you looked at the price for the T203 unlock kit? AliExpress has them for $275 and upwards.

Probably makes more sense when recovering quite some devices. But nothing likely what someone does for a 2-5 Macs. And then you need the appropriate hotglue gun and a functional Mac along side to reprogram the T2 chip.

Might be worth it if you got a pile of macs which the OP picture shows.

But it is clearly not good for the ability to repair/fix used machines. Quite good for device security though.

Just wondering if this approach renders previous data completely unreadable or if it's possible to scrape off data from the device somewhere in this process.