MacBook Neo Survives Apple Store DFU with Passive FTP and Hidden UI Overrides
Background Passive FTP with No GUI Control Survives Apple Store DFU
A freshly wiped MacBook Neo, after an in-store DFU and with Lockdown Mode on and no iCloud account, still shows passive FTP enabled and JoinMode set to Automatic in its system configuration. The macOS firewall also resets to allow signed software, and a hidden API for overlaying windows raises concerns about pixel overwrite attacks. The author questions whether DFU can preserve malicious settings or if Wi-Fi can infect a device despite Lockdown Mode.
I’m left to conclude that either a DFU can allow malicious configurations to survive, or upon opening my MacBook Neo at home, some neighbor’s Wi-Fi connection “infected” it with the above settings, despite being in Lockdown Mode. Neither are great options.
- reanimus
It's pretty easy to go online and understand what the "FTPPassive" key is (and why it's enabled by default). The firewall settings thing is a UI bug, if that. Those other toggles don't take effect when blocking all incoming connections is active. As such, it doesn't matter what the value for the other toggles is, so it resets them to the default (true). Perhaps a sharp point if you toggle firewall often, but not an outright security issue. My laptop has that systemuiserver preference setting there as well.
I think this person is a bit paranoid and reading a bit too much into things judging from their timeline.
- lowmagnet
Pasv is just a work around for nat'd connections.
- sippingabonedry
God bless Apple retail employees who have to deal with this stuff because I could not, I would hand in my neon t-shirt on day 3.