T2 Macs Require Apple-Authorized Repair
Apple has recently documented a new data recovery process internally for Macs that utilize its T2 chip introduced with the iMac Pro and the 2018 MacBook Pro. The new process for repair staff is being introduced due to the T2 chip’s advanced security features including hardware encryption for SSD storage that isn’t compatible with Apple’s previous data recovery methods used on older machines.
Due to advanced security features of the Apple T2 chip, iMac Pro and 2018 MacBook Pro models must pass Apple diagnostics for certain repairs to be completed, according to an internal document from Apple obtained by MacRumors.
[…]
If any of these parts are repaired in an iMac Pro or 2018 MacBook Pro, and the Apple diagnostics are not run, this will result in an inoperative system and an incomplete repair, according to Apple’s directive to service providers.
The software lock will kick in for any repair which involves replacing a MacBook Pro’s display assembly, logic board, top case (the keyboard, touchpad, and internal housing), and Touch ID board. On iMac Pros, it will kick in if the Logic Board or flash storage are replaced. The computer will only begin functioning again after Apple or a member of one of Apple’s Authorized Service Provider repair program runs diagnostic software called Apple Service Toolkit 2.
A separate internal training presentation obtained by Motherboard about how to use the diagnostics states that the “Apple Service Toolkit and Apple Service Toolkit 2 are available only to persons working at Apple-authorized service facilities.” This means that it will become impossible for you to repair your new MacBook Pro at home, or for an independent repair provider to repair it for you.
I can’t imagine, if true, that this is an effort from Apple to keep all those sweet, sweet repair dollars all to themselves. I’d expect this has something to do with protecting the chain of security, preventing malware from somehow gaining a foothold.
Previously: Apple Fighting New “Right to Repair” Legislation.
This service document certainly paints a grim picture, but ever the optimists, we headed down to our friendly local Apple Store and bought a brand new 2018 13” MacBook Pro Touch Bar unit. Then we disassembled it and traded displays with our teardown unit from this summer. To our surprise, the displays and MacBooks functioned normally in every combination we tried. We also updated to Mojave and swapped logic boards with the same results.
That’s a promising sign, and it means the sky isn’t quite falling—yet. But as we’ve learned, nothing is certain.
Rather than compromising the security and privacy of their products, I’d like to see more progress made on certifying independent technicians and making Apple’s official tools more accessible. The security threat model isn’t the same as it once was; your phone probably has a lot more information on it than your computer of ten years ago. Yes, it’s more complicated to replace parts now, but it’s not entirely because companies like Apple want to lock out independent repair shops. Apple’s diagnostic tools could play a great role in this: imagine if you could take a printed report of a successful repair and type in a serial number on Apple’s website to verify that your device was serviced with genuine parts and passed Apple’s testing.
15 Comments RSS · Twitter
Not sure how this affects malware. I could see how it might be intended as a way to prevent law enforcement or other such agencies from accessing data on a Mac, but they will definitely be able to work around this. The only effect this has is that, once a Mac is out of warranty, it'll be thrown away when it stops working instead of given to a kid who can fix it and keep using it.
That kid can still fix it, and then bring the repaired out-of-warranty Mac to an authorized dealer, and there they can run the diagnostic software for a small fee. Out of warranty will surely not mean that you must throw the computer away. Apple would face hundreds of lawsuits immediately… per country.
> Out of warranty will surely not mean that
> you must throw the computer away
The point isn't that people must (although eventually, that will be the case), but that they will. I have a 2013 Retina MacBook Pro whose battery was swelling. I wouldn't have spent a penny getting it fixed, but because I could take it apart myself, I took out the battery (btw, thanks for gluing the battery into the computer, Apple), and now it's still useful. Sure, this probably wouldn't have required running this app, but another issue might have.
I also have an old PPC iBook and a Mac SE that I use for opening some really old stuff. I don't know what happens when I bring those to the Apple shop, but I'm pretty sure it'll involve being laughed at, so I'm quite glad I can fix them myself.
The most bewildering thing here, and the thing that will eventually make Macs useless for professionals, is that, instead of getting Apple to change, Mac users defend Apple when they do dumb things like this.
I have a 2013 Retina MacBook Pro whose battery was swelling. I wouldn't have spent a penny getting it fixed, but because I could take it apart myself, I took out the battery (btw, thanks for gluing the battery into the computer, Apple), and now it's still useful.
Exactly my case to! My 2013 Retina MBP 13" had swollen batteries and I order new batteries online and swithed them myself, that glue took forever to get through! (And what's up with all the swollen batteries? Happened to my other, older MBP's as well.)
"Mac users defend Apple when they do dumb things like this."
Nope, not Mac users. Mac pundits.
Mac security has always focused on external attacks, with the presumption that if someone has physical access to the hardware, you're toast. Apple is finally changing this, starting with full disk encryption.
T2 as a controller is expanding this security to the point that soon even nation-state attackers will have difficulty penetrating a confiscated Mac, just like they have for some time with iPhone hardware.
Security or unlimited convenience: pick one.
Dave: "I can’t imagine, if true, that this is an effort from Apple to keep all those sweet, sweet repair dollars all to themselves. I’d expect this has something to do with protecting the chain of security, preventing malware from somehow gaining a foothold."
Why not both? Though beyond busted phone screens—always a nice little earner—I doubt Apple gives a crap for repairs and would far rather customers just recycle the old and buy brand new.
Lukas: "The most bewildering thing here, and the thing that will eventually make Macs useless for professionals, is that, instead of getting Apple to change, Mac users defend Apple when they do dumb things like this."
Professionals don't rely on 5 year-old equipment for their work (never mind 15 or 25 year-old!). They have a standard IT policy that replaces old hardware with new every 2/3 years and shelves, sells, or scraps the retired units as appropriate. PC purchases, even Mac ones, are chicken feed next to revenue and salary. Hours spent happily fiddling in clapped out hardware guts is for amateur small-fry and second-hand shops.
@has "Professionals don't rely on 5 year-old equipment for their work (never mind 15 or 25 year-old!). They have a standard IT policy that replaces old hardware with new every 2/3 years and shelves, sells, or scraps the retired units as appropriate."
Well, this is definitely not the case in the real world.
Also, being able to replace old hardware every 2/3 years would require to have something worth to purchase. Which is not the case with the macOS platform for half of its line of products: i.e.. the Mac Pros and Mac minis.
"Professionals don't rely on 5 year-old equipment for their work (never mind 15 or 25 year-old!)."
Unless the pro relies on a piece of equipment that doesn't work with newer Macs. Such as a specialist PCI card.
>Professionals don't rely on 5 year-old equipment for their work (never mind 15 or 25 year-old!)
A lot of professionals who use Macs don't work for large companies; graphic designers, for example, are often self-employed, or work for companies that don't have a dedicated IT department with a stack of spare MacBook Pros ready to go. Being able to quickly recover from a hardware problem is pretty important. Finding an appointment at the Genius bar, driving there for an hour if you don't live in the US or in a huge city, and then possibly waiting a week to get your repaired laptop back, isn't a great choice. Just buying another 3K MacBook Pro may not be an option, either. Going to your local unofficial repair shop and having them fix it for you, or just doing it yourself, is often the only reasonable choice in these situations.
>Happened to my other, older MBP's as well.
A friend of mine also has a 2013 MacBook Pro, and after telling him about my battery issues, he checked his. Same problem. If you have a 2013 MacBook Pro, particularly if you notice that the trackpad isn't working 100% anymore, it's worth taking a peek inside. I think lots of people are sticking with these, because they don't want the new touchbar/crappy keyboard MacBook Pros, so there's probably a lot of them still in active use.
I think this is a common issue with old batteries that have seen a lot of use. I remember having a swollen battery that interfered with my trackpad button way back when. It was either with a titanium PowerBook G4 (beautiful design, though not nearly as sturdy as the modern unibody machines) or a white plastic iBook, can’t remember which.
Bulging batteries definitely caused problems with some client MacBooks about a decade or so back. Same symptoms, trackpad button not working. Not an Apple only thing to be fair, had a client just replace her phone (used as a dedicated LTE hotspot) because the battery was severely bulging.
[…] T2 Macs Require Apple-Authorized Repair […]
>I’d expect this has something to do with protecting the chain of security, preventing malware from somehow gaining a foothold.
Basically, yes. They're plugging a hole that would enable tampering.
However, they appear to be doing so through security by obscurity. Which, concerns about consumer rights aside, risks someone eventually reverse-engineering how Apple Service Toolkit 2 works, and rendering this protection moot.
What I'm trying to figure out is why this is necessary. Clearly, the T2 is detecting tampering, and setting a flag that needs to be reset. If that detection is reliable, why not instead invalidate the encryption key?