Fraud when buying a used MacBook: "And the number is, they say, is not real!"

All Apple computers have a similar design. Many models of one series can not be distinguished by external signs. This is used by scammers who overestimate the year of manufacture or specifications, in order to sell more expensive Mac. I have been working as an Apple computer repairman for many years, and have encountered cases of such fraud. Anyone who cares how not to let yourself be fooled when buying a used Mac, I invite you to the cat.

Apple Computer Identification

The identification system of MacBook models is not simple, it consists of several parameters. I will explain on the example of my Mac.

• Series: MacBook Pro
• Model Name: MacBook Pro Retina 15-inch
• Model Year: mid 2012
• Model Number: A1398
• Model ID: MacBookPro10,1
• Model number: MC976LL / A

Of the entire list on the case (on the bottom cover), only the model number is written - 1398. And this is, in fact, just a model of the case. This number does not carry information about the specifications of the Mac.
A1398 is a 15-inch MacBook Pro Retina, produced from 2012 to 2016, with 5 different models with different configurations.
')
Model year determines the technical characteristics, and hence the price for used Mac. The year of release can be viewed in the system, it is associated with the model identifier.

Another parameter determining the price is the equipment:

• the amount of RAM
• storage capacity (ssd / hdd),
• processor type and frequency
• graphics.

Factory equipment is encrypted in the model number (for example, MC976LL / A). But the article is written only on the box. The system does not have information about the article. It can be found on the Apple website or other resources by serial number. The serial number combines all identification parameters.

Serial number

The serial number is unique to each Apple device. The serial uniquely identifies any poppy. It is encrypted in:

• assembly factory
• year and week of assembly
• model and equipment

The serial number is engraved on the bottom cover. But you can replace the cover, or kill the number. You can write a story that "the lid changed to the used one, so the number there is not correct." The cover can be replaced with a new one and then it will be without a serial one.

→ A similar situation has already been described in this post .

The serial number is written in the "About this Mac" system. You probably already understood from the screenshot at the beginning of the post that you can not always trust him.

Serial number fake

The serial number is registered in the EEPROM memory chip, in the EFI firmware code. It is stored there explicitly, as a set of characters and not encrypted.


MacBook can be disassembled, unsolder the microcircuit, insert it into the programmer and rewrite the number to a more advanced, high-end one. The number can be replaced with a set of almost any characters and they will be displayed in the About this Mac system.

So I did:



The result of this experiment was a screenshot in the title of the post.

I do not exclude that it is also possible to rewrite the serial number in EFI programmatically. There is a service utility Apple Blank Board Serializer, which writes the serial number if it is empty. Repair boards that Apple sends come with an empty serial number. But then after the replacement, the serial number is prescribed for a specific case. But this utility does not allow to change the serial number.

Opinion: I admit that it is possible to modify this utility so that it allows you to change the prescribed serial.

The computer on which I conducted the experiment is an interesting sample. It was the MacBook Pro on the 13th of the end of 2011 with the top-end MD314 with an i7 processor. The processor was faulty and I replaced it, I sealed what was available - i5 2.3 GHz from MacBook Pro 13, started 2011 in a lower configuration. The result was a forced downgrade.

Such information will be if we run Apple Hardware Test on it.



And if we “break through” the serial number, we will see that there should be an i7 2.8 GHz processor.


Screenshot made from www.appleserialnumberinfo.com/Desktop/index.php

By the way, a good site for determining the technical characteristics and factory configuration by serial number of the poppy.

As a result of my repair, a ready-made version for fraud has turned out. The younger model has a number from the top. Fraudsters just do the opposite; the serial number from the top one is sewn up in the initially junior package bundle. Or completely change the firmware.

In addition to the serial number, the model and year of release are registered in the EFI firmware (MacBook Pro 13-inch, Late 2011), that is, they can also be modified. The situation is more complicated with the model identifier (MacBookPro8,1), it is registered in the firmware of the multicontroller SMC. It is much more difficult to work with this microchip.

Changing the serial number in the EFI firmware using a programmer is a hardcore way. Not everyone can do it. You will need soldering equipment, a programmer and a person who knows how to use it. Much more common manipulations easier. This is a modification of the Mac OS system.

Mac OS information spoofing

All characteristics of the computer are registered in the system "About this Mac." But this information, too, alas, you can not always believe. There are programs and hacks that can change this information. This has already been posts:

→ geektimes.ru/post/268778
→ geektimes.ru/post/157969

I did not understand and was not interested in how this is done, but several times I have seen cases of such fraud. I still have this screenshot from my practice.


A specialist will immediately be struck by the incompatibility of 2014 and the Intel Hd 4000 graphics (integrated graphics in Intel core i processors, the third generation Ivy Bridge, appeared in 2012).

In fact, it was the MacBook Air 11 mid 2012. Only the year of release was changed. But this was enough to deceive the buyer by about 10 kilo rubles (the market difference between these two models). To understand the fraud could be breaking through the serial number or comparing the characteristics of these two models.

Saw and more expensive deception. MacBook Pro Retina 15 2012 in the youngest set was purchased as 14 years in the top. Everything was changed in the system (year of manufacture, processor frequency, memory size, storage capacity, serial number). Overpayment was about 50t.

How not to fool yourself when buying?

We now turn to the main thing - how to deal with all this. The serial number cannot be trusted, information in the “About this Mac” system cannot be trusted either.

How then to live?

In similar posts to which I dropped the above links, the authors, in addition to punching by serial number, recommend running the Apple Hardware Test utility.

Checking through the hardware profile in the Apple Hardware Test utility is a reliable but not universal way. Let me explain: Apple Hardware Test is a built-in utility that installs on all new Macs on a hard disk. To start it, you need to press and hold button D when it is turned on. But if the disc is changed or formatted, then it will run only on models from 2011, which support Wi-FI download. To run on the network on some models, you must press ALT + D. Well, you need to connect to the network.

In poppies since 2014, this utility has become useless for verification. She simplified, there is now no tab "equipment profile". The utility will show only the test result and the serial number from the EFI firmware. And this number, as we remember, can be changed.

Simple universal way to check

All Mac identification parameters can be replaced in one way or another. It is impossible to replace only the characteristics of the hardware itself (processor frequency, RAM size, disk volume, graphics), because this information is taken from the hardware itself. Therefore, a simple universal way to open the fraud is to boot from an external drive (flash drive or disk) with the installed Mac OS system and compare the characteristics of hardware.

A feature of the Mac OS operating system is its unification for all Mac models. If you pull out the hard drive from the MacBook and connect it as an external to any other Mac, then it will be able to boot from it. There is only one condition - this is system compatibility. The new model will not boot from a very old version.

Another option is to rearrange the operating system, but installing over the network is a long process, and the installation disk will have to be done like a boot disk.

Making a bootable disk / flash drive with a system installed is very simple. To do this, you need to connect the disk to the MacBook and rearrange the system on it, simply select the connected disk as the installation path.

On all Macs from 2011, you can rearrange the system via Wi-Fi or you can make an installation disk. I will not tell you how the system is rearranged or how the boot disk is made. This information is full and on the network, and on the Apple site, and here you can find posts.

There is still an interesting option, instead of an external disk, use any other Mac. This requires only a Thunderbolt Thunderbolt cable. If you press and hold the T button when turning it on, the Mac will enter the external disk mode and you can boot from it as from a normal disk. And on the Mac you can install various test programs.

To identify Mack on the characteristics of iron, I recommend using the program Mactracker.

On this perhaps all that I wanted to tell about the risks of fraud associated with changing the serial number or modification of the system. But do not forget that there are other risks. Buying from hands, you do not receive any guarantees of technical serviceability.

If the topic is interesting, then I can write about it in the next post.