1. iMore Question's Avatar
    My sons MacBook was stolen a few weeks ago.
    He searched through Find my iPhone-app but of course it was offline.
    He then gave the command to blok the MacBook the moment it would be online, since there was some confidential material in it.

    Only yesterday he received an email informing his MacBook was blokked. Obvisously only yesterday somebody tried going online.
    He tried to look for his Mac through Find my iPhone but without luck.
    Any suggestions?
    Will the unrightful holder be able to use the MacBook?
    12-24-2015 02:10 AM
  2. firedept10's Avatar
    My son’s MacBook was stolen a few weeks ago.
    He searched through “Find my iPhone”-app but of course it was offline.
    He then gave the command to blok the MacBook the moment it would be online, since there was some confidential material in it.

    Only yesterday he received an email informing his MacBook was blokked. Obvisously only yesterday somebody tried going online.
    He tried to look for his Mac through “Find my iPhone” but without luck.
    Any suggestions?
    Will the unrightful holder be able to use the MacBook?
    So sorry to hear about your sons MacBook.

    As for the person who is in possession of the MacBook, it will be useless to them. They will need your sons Apple ID and Password to unlock the MacBook. If you are really concerned about confidential info, my suggestion would be to do a Remote Wipe instead of just blocking it. This will erase the HDD should they try turning it on again. If you do this though, I hope you have a backup of the HDD.

    As for the person in possession, they have a great paperweight for now.
    Last edited by firedept10; 12-24-2015 at 07:28 AM.
    Just_Me_D likes this.
    12-24-2015 07:03 AM
  3. SirMP's Avatar
    Thank you for your comment.
    Should my son still be able to find the MacBook through Find my iPhone when online although it is blocked?
    Do I understand correctly? Is the MacBook useless? Even if it is opened up and the HDD is replaced?
    How do I do a "Remote Wipe"?
    I doubt my son will ever see his MacBook again so whether he made a backup or not ...
    12-24-2015 04:37 PM
  4. Just_Me_D's Avatar
    Thank you for your comment.
    Should my son still be able to find the MacBook through Find my iPhone when online although it is blocked?
    The Find My device feature only works when the device is online. You can keep trying to locate it, if you'd like, but since you don't know who has it or his or her knowledge of the feature, there are no guarantees you'll get it back.
    Do I understand correctly? Is the MacBook useless? Even if it is opened up and the HDD is replaced?
    Yes
    How do I do a "Remote Wipe"?
    I doubt my son will ever see his MacBook again so whether he made a backup or not ...
    You can remotely wipe the MacBook via the Find my iPhone app, however, remotely wiping it should done as a last resort in my opinion. Locking the MacBook remotely should be sufficient.

    https://support.apple.com/kb/PH2700?...ewlocale=en_US
    firedept10 likes this.
    12-24-2015 05:21 PM
  5. SirMP's Avatar
    Thanks for your comments. Aappreciate it.
    12-25-2015 02:40 PM
  6. Ariel Babalao's Avatar
    The only way who ever found the MacBook will not be able to by pass the lock screen will be only an only if the owner of the MacBook have setup a firmware password into the MacBook. A firmware password is store into a dedicated tiny memory in the CPU of new models MacBooks (2012, 2013, 2014, 2015 generations of MacBooks). Then whenever the CPU noticed that the main storage changes, it trigger the request to enter the Firmware password before grant access any further into booting up the computer.
    If the owner of the computer have never set up the Firmaware password, any well award person can easily get into the computer and use it, simply by changing the SSD into a new one. Having setup find my Mac, and/or lock screen password will not help much if the internal storage is swapped out.
    In case you didn't know about Firmware password protection, I highly advice you to read about it and have it set up on your Apple computers next time. Hackers can still pass by firmware password, because it's technology but, they will have such a hell of hard time cracking the CPU, specially the most recent ones.
    12-25-2015 05:16 PM
  7. Just_Me_D's Avatar
    The only way who ever found the MacBook will not be able to by pass the lock screen will be only an only if the owner of the MacBook have setup a firmware password into the MacBook. A firmware password is store into a dedicated tiny memory in the CPU of new models MacBooks (2012, 2013, 2014, 2015 generations of MacBooks). Then whenever the CPU noticed that the main storage changes, it trigger the request to enter the Firmware password before grant access any further into booting up the computer.
    If the owner of the computer have never set up the Firmaware password, any well award person can easily get into the computer and use it, simply by changing the SSD into a new one. Having setup find my Mac, and/or lock screen password will not help much if the internal storage is swapped out.
    In case you didn't know about Firmware password protection, I highly advice you to read about it and have it set up on your Apple computers next time. Hackers can still pass by firmware password, because it's technology but, they will have such a hell of hard time cracking the CPU, specially the most recent ones.
    I read about it a while ago, and you're absolutely right...
    12-25-2015 06:03 PM
  8. SirMP's Avatar
    Hi Ariel Babalao,
    When you write about the "firmware password", do you mean the password needed when for example the screen went down after not using the laptop some minutes? or when installing a new software application or a new update to an application in use?
    12-26-2015 12:13 PM
  9. Ariel Babalao's Avatar
    Hi Ariel Babalao,
    When you write about the "firmware password", do you mean the password needed when for example the screen went down after not using the laptop some minutes? or when installing a new software application or a new update to an application in use?
    No. Firmware password is setup up out of the GUI, that is as soon as you boot up the computer, press command + r keys to boot into recovery mode. Then you enter the OS X Utility, that is where you can set up the Firmware password which will be save into the CPU.
    By trying to reach the recovery mode now that I have Firmware password is enable on my computer, I can't access it until I enter the Firmware password where by i could still access recovery mode if there was no Firmware password but lock screen password (the one you are talking about). Lock screen password simply protect your GUI. Think of it like "find my iPhone" and "lock screen pass word" on iPhone. Where Firmware password act like find my phone and lock screen password act like lock screen password.
    Here are some screen shoot so to find there is the Firmware password after you press command+r as soon as you boot up the computer.
    Last edited by Ariel Babalao; 12-26-2015 at 06:00 PM.
    12-26-2015 03:47 PM
  10. Ariel Babalao's Avatar
    Then anyone who will try to do a recovery will be ask to enter the Firmware password.
    If the CPU notice that the storage drive has change, the Firmware password becomes even aggressive and not only you will enter the firmware password, but you will also have to authenticate that you are the owner by entering your iCloud password (that is if you select that option when setting up Firmware password)
    Basically, with firmware password, there is almost no chance for even a tech savy guy to by pass Firmware password when both Firmware password and iCloud recovery password is enable in the computer. Even stronger than the way "find my iPhone" act when it's enable.
    After setting up Firmware password, bellow image showing how it request password for anything you will want to do off GUI.
    Please do note that if you do not secure your internal hard drive with FileVault, anyone can physically remove it, have access to your data, thus to keychain and retrieve your firmware password from keychain. Keychain exist to store your password and allow you to retrieve your password should you forget it. Keychain only rely on your GUI password, encrypting your internal hard drive is a good thing just in case.
    12-26-2015 03:54 PM
  11. SirMP's Avatar
    Wow! This is a lot of info. I am going to study this thoroughly. Although I think I will have to get back to you for some more help. Thanks a lot for now.

    PS: What does GUI and CPU stand for?
    12-26-2015 05:33 PM
  12. Ariel Babalao's Avatar
    Wow! This is a lot of info. I am going to study this thoroughly. Although I think I will have to get back to you for some more help. Thanks a lot for now.

    PS: What does GUI and CPU stand for?
    No worries if anything I can help with.
    GUI is the "Graphic User Interface" that is the user interface you use to work in, you will see the status bar, the doc bar, the folders or items on your desktop, application folder, applications etc... You work in that environment base on graphic unlike in terminal where you have no graphic.
    CPU is the "Central Process Unit" which is the main brain of your computer.
    12-26-2015 05:57 PM

Similar Threads

  1. Macbook Air or a Windows laptop?
    By Closingracer in forum MacBook Air
    Replies: 21
    Last Post: 03-09-2016, 12:29 PM
  2. 15" MacBook Pro Compatible Briefcase Suggestions
    By TheBikerPoet in forum MacBook Pro
    Replies: 1
    Last Post: 01-07-2016, 09:43 AM
  3. Replies: 0
    Last Post: 12-22-2015, 02:12 AM
  4. Why won't my iPhone5 connect to iTunes on my MacBook?
    By tempanys16 in forum Ask a Question
    Replies: 1
    Last Post: 12-21-2015, 07:34 PM
  5. No, a new MacBook didn't leak on 60 Minutes
    By iMore.com in forum iMore.com News Discussion
    Replies: 0
    Last Post: 12-21-2015, 03:51 PM
LINK TO POST COPIED TO CLIPBOARD