Bricked iMac Pro requires a 2nd Mac to restore

[NumLock21]

Apple's new iMac Pro features a new T2 security processor, where in the event of a update failure and system become unresponsive, it will require a 2nd Mac and Configurator 2 utility to restore the IMac Pro back to its working state. The 2nd Mac needs to be able to have access to the internet, have Configurator 2.6 or later installed, and must be running on OSX High Sierra. The user will then have to connect their bricked iMac Pro to their 2nd Mac via a thunderbolt cable and on the 2nd Mac, run the Configurator 2 utility. From here they will need to select iBridge device and then proceed with the restoring process.

Quote

This restore process is similar to what must be done for an iPhone or iPad that is unresponsive, and it is necessary due to the extra security afforded by the Apple-designed T2 chip.

The iMac Pro's T2 chip is a second generation version of the T1 chip that powers the Touch Bar in the MacBook Pro. The T2 chip integrates the system management controller, image signal processor for the camera, audio controller, SSD controller, a Secure Enclave, and a hardware encryption engine.

Quote

 

In certain circumstances, such as a power failure during a macOS upgrade, an iMac Pro may become unresponsive and must be restored. The requirements for doing an iMac Pro restore are:

• Apple Configurator 2.6 installed on any Mac that supports macOS High Sierra and has Internet access.

  You may need to configure your web proxy or firewall ports to allow all network traffic from Apple devices to Apple’s network 17.0.0.0/8.

• Supported USB-A or USB-C to USB-C or a Thunderbolt cable, such as the one sold by Apple.

  The USB-C cable:

  • Must support both power and data.

  • Can be used in conjunction with a supported Thunderbolt to USB-C adapter, such as the one sold by Apple.

 

 

https://www.macrumors.com/2017/12/15/bricked-mac-pro-how-to-restore/

https://help.apple.com/configurator/mac/2.6/#/apdebea5be51

[DrMacintosh]

Sounds secure. 

[captain_to_fire]

Typical Apple: You want something more secured, then it needs more restrictions. You want something easily accessible, then it needs fewer security features enabled.

 

I'm guessing this will only work if the iMac Pro doesn't have  File Vault enabled which is Apple's built in full disk encryption. If your Mac is encrypted and it got bricked, all that data is now random white noise.

[DrMacintosh]

Just now, hey_yo_ said:

Typical Apple: You want something more secured, then it needs more restrictions. You want something easily accessible, then it needs fewer security features enabled.

 

Thats usually tech goes, yes  

[captain_to_fire]

1 minute ago, DrMacintosh said:

Thats usually tech goes, yes  

Same goes for PCs. If someone enables Bitlocker or Veracrypt on a drive and they forgot their passwords or the drive fails while encrypted, all the data is now lost as white noise.

[XenosTech]

Just now, hey_yo_ said:

Same goes for PCs. If someone enables Bitlocker or Veracrypt on a drive and they forgot their passwords or the drive fails while encrypted, all the data is now lost as white noise.

Depends for bitlocker... If your TPM is external then you can decrypt it still

[TrigrH]

Its a brick in the first place, so i dont see an issue.

[sazrocks]

This actually makes sense to me. It keeps (or deters) compromised <things> from being loaded onto a mac in such a predicament. Also anyone with an iMac pro will probably have some way of getting access to another mac.

[captain_to_fire]

3 hours ago, XenosTech said:

Depends for bitlocker... If your TPM is external then you can decrypt it still

Probably one of the reasons why Veracrypt doesn't support TPM

Quote

If the attacker has administrator privileges, he can, for example, reset the TPM, capture the content of RAM (containing master keys) or content of files stored on mounted VeraCrypt volumes (decrypted on the fly), which can then be sent to the attacker over the Internet or saved to an unencrypted local drive (from which the attacker might be able to read it later, when he gains physical access to the computer). 

If the attacker can physically access the computer hardware (and you use it after such an access), he can, for example, attach a malicious component to it (such as a hardware keystroke logger) that will capture the password, the content of RAM (containing master keys) or content of files stored on mounted VeraCrypt volumes (decrypted on the fly), which can then be sent to the attacker over the Internet or saved to an unencrypted local drive (from which the attacker might be able to read it later, when he gains physical access to the computer again). 

The only thing that TPM is almost guaranteed to provide is a false sense of security (even the name itself, "Trusted Platform Module", is misleading and creates a false sense of security). As for real security, TPM is actually redundant (and implementing redundant features is usually a way to create so-called bloatware). 

Given how long it took someone to breach the Secure Enclave in iPhones and the hack alone is not enough to grant automatic access to user data, it's good that Apple is using something better than TPM.

Edited December 18, 2017 by hey_yo_

[sazrocks]

2 minutes ago, huilun02 said:

Its not like you can unbrick a Windows computer using a USB stick, or encrypt only select drives.

Yes, because both of those things are great for security.

/s

[DrMacintosh]

3 minutes ago, huilun02 said:

Better get two overpriced desktops I guess...

Any Thunderbolt 3 Mac would work.....

 

Also say that the iMac Pro is overpriced again? Try parting out an exactly equal machine using the same level of Workstation Hardware. 

[sazrocks]

15 minutes ago, hey_yo_ said:

Typical Apple: You want something more secured, then it needs more restrictions. You want something easily accessible, then it needs fewer security features enabled.

This is how literally all computers work.

[DrMacintosh]

Just now, sazrocks said:

This is how literally all computers work.

He knows, he was memeing. 

[XenosTech]

2 minutes ago, hey_yo_ said:

Probably one of the reasons why Veracrypt doesn't support TPM

Given how long it took someone to breach the Secure Enclave in iPhones and the hack alone is not enough to will not give automatic access to user data, it's good that Apple is using something better than TPM.

Well it's a double edge sword. Good in the sense it's probably more secure but bad that the user loses data. Especially if that's the backed up data

[NumLock21]

Note that Microsoft Bitlocker and TPM does not force the user to go buy a 2nd computer just for the purpose of restoring their primary one. Bitlocker and tpm hardware encrypts the content on your storage devices, but it does not prevent you from reinstalling your OS from a bootable USB drive or disc.

[captain_to_fire]

4 minutes ago, huilun02 said:

Its not like you can unbrick a Windows computer using a USB stick, or encrypt only select drives.

I'm thinking of getting one of these. It's good in plotting revenge. 

 

Granted, it's easier getting inside a Mac using recovery mode unless full disk encryption is enabled. https://www.macworld.co.uk/how-to/mac/what-do-if-forgotten-mac-password-3594395/

1 minute ago, XenosTech said:

Well it's a double edge sword. Good in the sense it's probably more secure but bad that the user loses data. Especially if that's the backed up data

I just hope those rich people who will use an iMac Pro as their workstation would also buy those expensive Thunderbolt drives or a NAS.

[XenosTech]

1 minute ago, hey_yo_ said:

I just hope those rich people who will use an iMac Pro as their workstation would also buy those expensive Thunderbolt drives or a NAS.

One can hope but just incase @leadeater profile pic says it all lol

[captain_to_fire]

3 minutes ago, NumLock21 said:

Note that Microsoft Bitlocker and TPM does not force the user to go buy a 2nd computer just for the purpose of restoring their primary one

Or just use a USB drive for TPM which I think is better

[sazrocks]

Just now, huilun02 said:

Or you know some people are more concerned about having a working computer instead of security? 

Some people are more concerned with the data that is stored on their computer and how its value may go far beyond that of a single desktop computer.

If that isn't you then perhaps this isn't the product for you.

3 minutes ago, huilun02 said:

And how is encrypting select drives insecure? 

Compromised OSes/bootloaders can be loaded onto the computer, thus leading to the capture of encryption keys and other credentials. Apple's method prevents (or deters at least) this.

[NumLock21]

Just now, hey_yo_ said:

Or just use a USB drive for TPM which I think is better

Bitlocker prefers a TPM module. Don't have,  then USB will work too, but it requires some modifications. I've done it before, but I forgot what they were. There is also Bitlocker for your external usb drives called Bitlock to Go. Just right click on drive and turn on Bitlocker.

[XenosTech]

Just now, NumLock21 said:

Bitlocker prefers a TPM module. Don't have,  then USB will work too, but it requires some modifications. I've done it before, but I forgot what they were. There is also Bitlocker for your external usb drives called Bitlock to Go. Just right click on drive and turn on Bitlocker.

Pretty much forgot all that stuff when I passed A+ to be honest. Just remember bitlocker can be used with internal or external TMP's

[NumLock21]

3 minutes ago, XenosTech said:

Pretty much forgot all that stuff when I passed A+ to be honest. Just remember bitlocker can be used with internal or external TMP's

Yes, as long as you have a TPM module, then you can use Bitlocker. Most board don't have TPM modules, but they do have a header for them. 95% of the users here should have that header on their boards.

[XenosTech]

1 minute ago, NumLock21 said:

Yes, as long as you have a TPM module, then you can use Bitlocker. Most board don't have TPM modules, but they do have a header for them. 95% of the users here should have that header on their boards.

Yup unless you're using OEM specific boards. Don't think all of those have them

[sazrocks]

1 minute ago, huilun02 said:

Ok maybe I get one (two) if I decided to have my workstation in some random public space where there is no physical/network security.

If physical and network security are so impenetrable, then why does encryption exist at all? Why not just disable all encryption in work environments so as to get a 10% productivity boost from not dealing with passwords?

[DrMacintosh]

4 minutes ago, valdyrgramr said:

I saved a grand plus

Not seeing any Xeons nor any ECC RAM........

 

I said Workstation grade components. There is also a lack of Thunderbolt 3.