Can the macbook still give away it's location?


Rendering Error in layout Widget/Social: Call to a member function exists() on null. Please enable debug mode for more information.
More
8 years 1 month ago #2525 by Nonono12
Hello, maybe a stupid question but i got to ask ;)

Say you have a icloud locked macbook
After the efi chip has been flashed, with the original serial in the dump, will it still be able to give away its location ?

I'm guessing if i reinstall mac os it will icloud lock again, but what if i install windows ? or ubuntu ? can it still send out data to apple ?
The reason i ask is when i hold the options key to give me a bootmenu, it already shows the available wifi sources to connect to so it can run recovery. and that worries me :)

Please Log in or Create an account to join the conversation.

More
8 years 1 month ago #2546 by thaGH05T
This information is all stored in NVRAM/PRAM and can be find in the firmware of the EFI chip. You can modify most of this without worry, but you really need to know your way around Apple EFI. I will likely be working on a script or program in the future that will preform certain operations such as this. But, to answer your question, FMM is dependent on the operating system to my knowledge.

Please Log in or Create an account to join the conversation.

More
8 years 1 month ago #2559 by Nonono12
Okay, so just to sum it up... sorry if i ask the same question twice.

I know for a fact that if you start the recovery mode where it will download a new mac os by connecting to wifi (MBA, so no disc), but with the main partition wiped, it will still lock down and give away it's position. Allthough i'm not sure if it needs it reserved partition on the hard disk to do so. (i believe it was a 5gb partition that i noticed later on named EFI-something)

Later on i removed all partitions and formatted it with linux, flashed the efi chip by your instructions (BUT with the original serial number still in the modified dump).
But for some reason i'm still worried that it might somehow still lock and/or give away it's location if i connect it to the internet. At the same time it sounds stupid since it got linux (ubuntu) installed and i don't think it would allow that.

I ask the same question twice because apple's EFI seems more complicated than i originally thought ;) And because i think it is not totally OS dpendent (like i said, small partition left somewhere + recovery mode = lockdown).

What are your thoughts on this ? is it safe to assume FMM is not functioning anymore, or do you mean by "dependent on the OS" that the small partition was a part of the OS that had to be removed ?

Sorry if i made a mess of the story, just trying to understand!

Thanks in advance.

Please Log in or Create an account to join the conversation.

More
8 years 1 month ago #2565 by thaGH05T
Like I said before, I do not think it is possible without OS level intervention. Although, if the machine is'nt stolen then you have nothing to worry about.

Please Log in or Create an account to join the conversation.

More
8 years 1 month ago - 8 years 1 month ago #2569 by e1000
It won't happen again @gh05t, I'll limit to share information about all my studies about the flash process, after all this the best electronic computational science site.
Sorry it won't happen again.
Last edit: 8 years 1 month ago by e1000.

Please Log in or Create an account to join the conversation.

More
8 years 1 month ago - 8 years 1 month ago #2574 by Nonono12
@gh05t, thanks for sharing your thoughts & knowledge. But it's not about a stolen machine, it's about understanding the machine. That's what we are all doing here right ?

@e1000, I would be interested in that link if you can still dig that up. Could it be that a modified serial in the dump would block apple's way to authenticate your system and therefore not allow you to access certain apple services, including icloud/FMM? Sounds possible but also a bit easy, as every peace of apple's hardware seems to be marked in serial numbers. But perhaps it's just a paranoid thought, i don't know.

I'm glad you mentioned the EFI partition aswell, as i wasn't sure i remembered it right. But if, as you say, it is part of the assistant software, as in, a part of mac OS, then what ghost said could be right about FMM only functioning with (or a part of) apple's OS.

It sucks that you bought it from a person who asks for more money later on. I guess you could connect it to a public network somewhere, in that way the seller won't know where you live, and if it locks down again, you just have to flash or brute force it again. Not ideal, but it might be the easiest way to get some conclusive answers.

Would like to stay in contact sure, but why not do it here on the forum so perhaps other people can share their thoughts and ideas ? If it's okay with the moderators that we keep the topic alive.
Last edit: 8 years 1 month ago by Nonono12.

Please Log in or Create an account to join the conversation.

More
8 years 1 month ago #2658 by thaGH05T
I posted a reply a week ago on this, but ended up restoring the site that day as well which overwrote the post. I think this can be done easily with a controlled test covering all bases essentially. If one of you are interested in doing the test and reporting back I can off the instructions here, but doing a rewrite of my 6 paragraph original is a bit mute if nobody is interested.

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago #3405 by therealjayvi
Let me start out by saying that I do not condone in the servicing of stolen items. If you choose to follow my advice then you are doing so AT YOUR OWN DISCRETION and you accept sole responsibility for any actions you may take on behalf of this post. Now...

Not sure if this is 100% on-topic but I figure it may help out. So what I've learned about location services being reported... YES IT ABSOLUTELY WILL REPORT YOUR LOCATION THE VERY MOMENT YOU LET THE DEVICE CONNECT TO ANY INTERNET SOURCE!! Apple has programmed their Mac devices to seek out ANY open WiFi nearby for it to leech off of. Even if it is something like Xfinity WiFi (Open network but needs login to "fully" connect) you should still be concerned. If the device has been reported stolen then you have to be aware that it will ping not only your location (because Location services are ON by default on a fresh install), but also your geolocation is observed and that is based upon your IP address. Even if you use a VPN you need to be concerned. Police CAN and WILL show up to your doorstep asking about the device, so be prepared for what you're getting yourself into.

It should be in everybody's checklist of steps when performing anything related to EFI lock that you have an external drive with OS X installed upon. Not saying that it isn't possible by other means, just that with the amount of devices that I have serviced it is the safest way to go. With an external drive you have a controlled environment with which to boot any Mac device. And by controlled I mean you need to completely remove the .kext for WiFi from your external OS X, this way you ensure the device connects to the internet ONLY when you want it to.

Use a VPN. Period. And not just a software-related VPN. Make your own. Unless you would like to put trust in the hands of some company that wouldn't think twice to look into where you are if they are confronted by law enforcement. I have recently written an article here on just how to go about creating your own VPN in a remote location on a VPS (other devices/locations/methods can be used as well) I highly recommend reading it through to get a better idea. There's still the issue of having that split second in between when you initially connect to the internet and when you connect to the VPN though. And be aware that it may only take 1 second between clicks, but that 1 second is all that is needed for your whereabouts to be known to within a 10 foot radius. That's pretty specific. The ONLY way to ensure complete anonymity while doing this is to install your VPN service onto a separate router, remove the WiFi .kext from an external OS X installation (or just the WiFi (Airport) chip entirely), reset NVRAM/PRAM from device, boot into external drive, disable location services, open up the iCloud Account login prompt, type in the username and password to a burner iCloud account you have (dont have one then get one), then connect the device to the router you have your VPN installed onto via an Ethernet cable (newer devices have no Ethernet port so get yourself an Ethernet to USB converter), and the very moment you plug it into the device start spamming Enter as fast as you can to begin logging into iCloud with your burner account at the absolute soonest possible moment. Be prepared for it to sound the alarm if it is in fact reported stolen, it's loud. Check the box for Find My Mac and click continue. If everything went as planned then you will have overwritten the iCloud account on Apple's servers and you can now proceed with installing a fresh OS.

Cheers
The following user(s) said Thank You: F1Den

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago - 7 years 10 months ago #3497 by reverendalc
From Apple's website:

Lock your Mac
You can use Find My Mac to remotely lock your Mac with a passcode. You can also display a custom message on its screen. If you lock your Mac, you won’t be able to track it.

Erase your Mac
You can use Find My Mac to remotely erase and delete all your personal information from your Mac. If you erase your Mac, you won’t be able to track it.

What if my Mac is shut down or offline?
If your Mac is turned off or offline, you can still use Find My Mac to request a notification when it’s located, or lock or erase your Mac remotely. The next time your Mac is online, the actions take effect. If you remove your Mac from Find My Mac when it's offline, your requests are cancelled.
Last edit: 7 years 10 months ago by therealjayvi. Reason: Potentially Harmful Advice

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago - 7 years 10 months ago #3499 by therealjayvi
@reverendalc While your bit about what Apple says about FMM may be true

NOTE: clearing NVRAM and reinstalling OS X removes the device from iCloud.

is not only incorrect, but quite possibly the most horrendously and potentially endangering piece of advice I have ever heard on the topic! I am removing your final comment ASAP and then I will explain why.

Clearing NVRAM/PRAM and reinstalling OS X, for a fact, does NOT remove the device from iCloud. All you're doing by clearing NVRAM/PRAM and reinstalling OS X is essentially "convincing" the Mac that it has a new owner. By no means should you EVER feel comfortable about a device if these are the only steps you have taken.

(Scenario from your perspective)
Say that you have a device, and you perform the steps you mentioned... The only possible way that you would have the ability to reinstall OS X would be if the device had not already been locked up. Alright, so you got lucky, cool, you notice you can boot via external devices (hdd, usb, etc). You proceed to resetting the NVRAM/PRAM. Okay. You perform a fresh install. Awesome. Now your Mac boots up and you got a brand new Admin user account at your fingertips. Sweet.

(Scenario from "their" perspective)
My Mac was stolen out of my apartment last night bro! Agh they pilfered all my electronics, my wallet, my car keys, all my check books and credit cards, and pictures of my wife! The cops say they'll "get back to me" with any updates, so that's not too promising... Wait a minute... I just remembered! (Hits up icloud.com from his mobile device, thankfully had it on him at the time of the felony burglary) I'll find this thieving ******* myself then! Good thing I synced my Mac to my iCloud account the other day! *Logs in/navigates to devices/sees serial number of device* Here we go! Lock and erase? Nahhh I'll let him think he's gotten away with it for a day or two, maybe I'll get lucky and the dumbass will connect it to the internet, it only takes a split second of open wifi! Oh what's this? Last known location? An apartment a few blocks from me? 20 minutes ago? *Ponders about either going on vigilante killing spree of revenge, or letting the cops know and let them deal with it...*

BOTH SITUATIONS WHICH SPELL DISASTER FOR YOU. DOESN'T MATTER IF YOU STOLE IT YOURSELF OR BOUGHT IT FROM CRAIGSLIST OR GOT IT FOR THE SUPER BOPPIN PRICE FROM THA HOMIE. EVER HEARD THE SAYING "POSSESSION IS 9/10 OF THE LAW"?

This is not just a fictional scenario I just created off the top of my head for some hopeful advice online. This is serious sh*t that Apple has spent MILLIONS of dollars trying to prevent the EXACT thing that we have all come to figure out how thwart.

The ONLY way to safely overwrite the information on iCloud is to login to iCloud either via an external drive that you have booted from the device in question (I suggest having your login details already typed into the fields PRIOR to connecting the device to the internet & spamming the Enter key as fast as possible while connecting. If the device has been locked after its been in your possession it will flare an alarm hella loud and attempt to immediately lock itself. By you logging into a new iCloud account at the same time there is a few seconds where it will allow the login to go through and you will have a few second window where you can click the option to "OVERWRITE THE PREVIOUS ACCOUNT ICLOUD INFO?") Do not feel safe with any device unless you have successfully rewritten the Icloud info using this method or another similar method, because the moment you let your guard down is the moment you have police showing up on your doorstep. True story. Take this stuff seriously please, for everybody's sake.
Last edit: 7 years 10 months ago by therealjayvi. Reason: Continuing information...

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago - 7 years 10 months ago #3500 by mtronmeta
Thanks for the detailed clarification Jayvi. That definitely answered a few questions I had.
Last edit: 7 years 10 months ago by mtronmeta.

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago - 7 years 10 months ago #3512 by reverendalc
I would like to good naturedly challenge that:

Take your own MacBook, and lock it on FMM. Leave the FMM window open the entire time:

Dump/clean/rewrite firmware
Clear nvram on first boot
Boot from USB and reinstall OS X

FindMyMac will never give a peep about location because it's disabled by the iCloud lock. The iCloud lock is removed, and the EFI/NVRAM/OS no longer contain any iCloud information. If you want to see the MacBook silently disappear from your apple devices, just sign into an alternate iCloud account, and it's as if nobody else ever owned it.

I think it's totally clear that my comment was only about iCloud locked MacBooks, not stolen but unlocked macs, so I'm unsure what that whole blurb was about.

I have personally performed those steps and I never saw the Mac appear on FMM. Sure, Apple could still track your serial number if they felt compelled, but the previous iCloud account has no permission to access location information when it's not logged in. changing your serial number can change that, however it can negatively impact certain OS X features like messages that submit MLB and ROM during authorization. Unless you're using a serial from a real Mac.
Last edit: 7 years 10 months ago by reverendalc. Reason: TRUTH!

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago #3520 by thaGH05T
@Reverendalc and @therealjayvi, we know that the serial number is at least PART of what apple uses to uniquely identify your Mac when it comes to iClound, or in this case FMM. The testing I have done in the past proves that the latter is actually true and here is what I know to be true.

Until the Mac is registered when being reinstalled, the Mac is still susceptible to being locked down again. And even with NVRAM/PRAM variables cleared, the Mac will still be seen to Apple servers as the previous owner's because the information previously stored in NVRAM and PRAM live there as well.

However, when the Mac is re-registered with another iCloud account it is then removed from the previous owner'e account. Now, it has been about a year since i have tested anything like this, but I am willing to bet not much has changed. So, to all that have any questions or are curious; please take this challenge and post back your results, because data like this is needed for sure.

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago #3529 by reverendalc
it's been just a few months since my lest explorational icloud locking, but i'll do it again this weekend. i am absolutely certain that the steps outlined in my previous post will result in the macbook unlocking and not reporting to the previous iCloud owner.

this go 'round i'll not clear NVRMA or register a new iCloud immediately, and let it sit there for a day unlocked, powered up, and online.

alternatively, i would love to see somebody sign into iCloud, change their serial number, and see if FMM still works. perhaps these facets aren't mutually exclusive

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago #3534 by thaGH05T
I think the biggest thing we need to focus on is what actually does work. Thanks reverendalc for your follow through.

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago #3559 by reverendalc
ok everybody who cares! here's today's chronicle:

10:03am initiated iCloud lock on 2011 mba
ticked "notify me when found" box
powered off mba
10:13am iCloud reports last known location as "old location"
11:05am booted mba to iCloud lock screen, then powered off
location refreshed on FMM, however far less accurate
9:30pm removed iCloud lock with mba ez flash
reset nvram, reinstalled OS X from usb
completed osx install, enabled location services, no iCloud sign-in
FMM does not report location, FMM cannot send a sound to mba. sound is "pending"

at this point, the only option iCloud is presenting me with is "play sound" and that has no effect.
surely apple could track the serial number, but will not do so w/o a warrant from the police department.

i will consider this compelling evidence that my statement before was true, and that i didn't endanger anybody

i'm done with it for today, but tomorrow i'll iCloud lock it again, change only the serial number, and see what happens... unless somebody else cares to do it?

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago #3560 by reverendalc
oh i'll also note, that while apple's website claims you cannot track a locked macbook... you can. if it's powered on and locked, it can be tracked. i don't know about an erased one, maybe i'll try that tomorrow after the serial number game.

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago #3574 by thaGH05T
Nice report, can anyone else who has multiple Mac's try this out? I do not have any to try it on but would love to get more feedback on this topic.

Please Log in or Create an account to join the conversation.

More
7 years 10 months ago - 7 years 9 months ago #3584 by reverendalc
I have another MacBook I can try it on, but I'd love for another party to corroborate my story

UPDATE: remotely erased MacBooks are also still available on FMM while at the iCloud lock screen

UPDATE: changing the serial number, the mac won't boot. it's a white screen and then the (/) sign (no bootable device). iCloud lock links the boot volume to the mac (apparently thru the serial) to prevent you from swapping disks and using the mac again, or using a functional install to clear nvram.
being as i set the iCloud, i alt-booted and entered the code, and booted the iCloud locked OS X from the macbook with it's new serial#.
despite having a NEW serial number, the OS X install is STILL locked, and FMM can STILL track it and can still send a sound to it.
curiously enough, invoking a NEW iCloud lock, the mac STILL won't boot from the original SSD.

RESULT: changing the serial in the EFI does NOT deter iCloud from communicating with your mac while locked, so i will have to assume that changing the serial when unlocked won't protect you any further then either. unlocking the mac with the iCloud pincode restored the status online and on the macbook.
i also invoked an iCloud lock, flashed a firmware from a previous iCloud lock, and observed no difference. it's still not entirely clear to me the extent of involvement between the EFI stored serial and the iCloud lock, but it's clear that neither depends on the other.

ALSO: i've locked several MacBooks in my lap and never heard an alarm! they just turn off, then turn back on locked.

EDIT: i've successfully loaded windows and ubuntu on iCloud locked MacBooks. when booting an installed OS X or an installer, the machine locks up. but you can successfully load an alternative OS if you've brute forced the PIN.
Last edit: 7 years 9 months ago by reverendalc.

Please Log in or Create an account to join the conversation.

More
7 years 9 months ago #3653 by therealjayvi
Wow this convo really took off! @reverendalc nice research concerning the serial and such, that's good work! All I have to add to the topic at this point is that there are certain situations that I personally have encountered that resulted in the police showing up at my door due to my negligence to follow the steps I created for myself. Two times I've had to release a device to the police due to it having come up stolen upon first boot. I've since then had to get a legitimate business license and become Apple Certified because they said if they have to come a third time and I do not have the proper credentials then charges WILL be filed against me. The two times that it happened I reset NVRAM/PRAM immediately upon first boot (after already unlocking) and was able to boot to an external. From there I opened up iCloud to re-register with a new account. Both times this happened to me I got lazy and didn't want to go through and take out my personalized router, hook up all the cords, go find my ethernet-usb adapter and then continue. So instead I figured "meh I'll be good" and just just connected to my Wi-Fi and mashed enter on the login info. The mac would then take a moment, glitch the iCloud window into two places on the screen (usually always happens) and then start sounding an alarm as loud as the speakers could possibly go. Of course this freaks me out every time this happens, but I've encountered it enough times to know that if I wait out the alarm for about 10-20 seconds then another window pops up and asks "Do you want to overwrite (current registered owners name)'s iCloud information on this Mac?" Clicking Enter after this stops the alarm.

Now I can only assume that because I used my actual Wi-Fi it gave off my location which led to the police showing up, but I don't know for certain. All I do know is that since I looked into making my personalized VPN router, whose location is somewhere far away from me, this issue has never happened again.

Please Log in or Create an account to join the conversation.

Who's Online

We have 408 guests and no members online

N00BZ

  • ljamal
  • ljamal74
  • mikeg2atest
  • ducchinhbui
  • anjarezt

Cookies