First stage bootloaders such as BIOS (Basic Input/Output System) and UEFI (Unified Extensible Firmware Interface) or second stage bootloaders such as GNU GRUB (GNU GRand Unified Bootloader) and iBoot, generally provide the ability to configure a bootloader password as a security measure. This password restricts access to the computer’s firmware settings and, in some cases, the boot process.

When a bootloader password is set, it is stored in a non-volatile memory within the firmware. Upon powering on the system (and the bootloader settings being selected) the bootloader prompts the user to enter the password before allowing access to the firmware settings, thereby preventing unauthorized users from altering system settings or booting from unauthorized devices.

Sections

ID	Name	Description
PR011	Boot Order Manipulation	A subject has the ability to access the system startup firmware of a target device, typically through the Basic Input/Output System (BIOS) or Unified Extensible Firmware Interface (UEFI). This access may allow the subject to view or modify low-level hardware and startup configurations, including boot device priorities, firmware security settings, and device initialization options. Access to system startup firmware may enable the subject to alter how a device starts, initiate booting from external media, or modify security configurations that govern the startup process. Depending on the device configuration and available protections, these capabilities may facilitate subsequent unauthorized access to local storage, circumvention of operating system controls, or other preparatory activity.
ME016	System Startup Firmware Access	A subject has the ability to access the system startup firmware of a target system.
ME016.001	Target Disk Mode Access	A subject has the ability to place a compatible Intel-based Mac into Target Disk Mode, allowing the device to function as an external storage drive when connected to another computer through a supported interface, such as Thunderbolt or FireWire. This capability enables direct access to the target device's storage without booting into its normal operating system. Target Disk Mode may allow the subject to examine, copy, or modify files stored on the device, depending on the available permissions and disk encryption protections. This capability may facilitate unauthorized data access or subsequent exfiltration, particularly where the subject has physical access to the device and can control its startup options.
IF002.007	Exfiltration via Target Disk Mode	When a Mac is booted into Target Disk Mode (by powering the computer on whilst holding the ‘T’ key), it acts as an external storage device, accessible from another computer via Thunderbolt, USB, or FireWire connections. A subject with physical access to the computer, and the ability to control boot options, can copy any data present on the target disk, bypassing the need to authenticate to the target computer.
PR046.010	Boot or Firmware Modification	The subject modifies a bootloader, boot image, boot partition, firmware component, Unified Extensible Firmware Interface configuration, or network-device boot mechanism to preserve unauthorized execution or control.

References