Does Remote Wipe securely wipe the contents of the drive?

I've done a remote wipe on a MacBook Pro with an SSD running Mountain Lion because I wasn't sure how else to securely wipe the SSD. So I can answer some of your questions.

To start with, Mat Honan was wrong when he said that the purpose of the PIN was so that "the process can be reversed." It is to prevent the thief from using the computer. I believe the thinking is that if the computer has to be taken to Apple to be unlocked, then it is much more likely that a stolen computer would be recovered.

Yes, when you remotely wipe the computer it does a secure wipe. Apple even warns you that it could take as long as a day. However, if your drive was encrypted with FileVault 2, then it is not necessary to erase the disk. It is sufficient to securely erase the encryption key(s) stored on the disk, so that's what they do. It's very quick and as secure as the underlying encryption system is, which for now is very secure. You cannot recover the drive with the recovery key once the encryption key(s) have been erased.

Before starting to wipe the disk, though, Apple installs some kind of lock on the system that prevents you from booting it up from the internal or an external drive. I don't know the details of how this works, I only know that I did not find an obvious way around it.

EDIT

I did this a second time and this time I wrote down the steps.

• After the laptop received the remote wipe instruction it emitted 2 short beeps and then froze, displaying the spinner (not a beach ball), and then rebooted
• After reboot, it displayed a Grey screen with the message “Enter your system lock PIN code to unlock this Mac” and options to sleep, restart, or shut down.
• I entered the PIN code pretty much right away
• After a brief delay the laptop rebooted into the Recovery partition and asked about installing a system (either a new system via the internet or an old system via a Time Machine backup or other computer to clone)
• I then rebooted the computer into Target Disk mode and examined the drive from another computer. The drive is no longer seen as an encrypted drive and I could find no signs of useable data on the drive, though to be fair I did not try anything too fancy. I have faith that the encryption key was wiped and that all I would find is encrypted data for which I no longer had the key.

Now back to our original story...

Below is from memory, so might be slightly wrong in some details. You can read another person's account of the process from MacObserver. (They were able to recover files from their unencrypted mechanical drive, but I believe it was because they entered the passcode and interrupted the wipe before it finished.) I think that after the remote wipe started and the lock screen came up on the MacBook Pro I did not wait very long for it to finish wiping the drive and entered the PIN to see what I could see on the drive. (I never saw anything on the drive, but I also did not take it out of the computer and send it to DriveSavers for them to check out.) I don't recall exactly how I got to powering down the machine post-wipe.

Anyway, after the wipe and power-down, I attached an external Mountain Lion Install drive and powered up the computer. I got a flashing folder with a question mark (meaning it cannot find a boot drive).

I rebooted, holding down the option key to get a choice of boot disks. I had a choice between Macintosh HD (the internal drive) and the external drive. I picked the external drive and again got the flashing folder with a question mark.

I rebooted again, holding down the option key again, but this time chose "Macintosh HD". Then I was presented with a screen to enter the unlock PIN. Which I did. I was then back to the screen where I could choose a boot drive, but this time the internal drive was labeled "10.8 Recovery HD" or something like that. I again chose the external drive and it booted fine. I was then able to reinstall the OS and all was normal from there.

I didn't see about trying to put the computer into target disk mode but Apple is pretty savvy about encryption and security so I expect that the PIN code lock is in the firmware and the computer just won't do anything until it's unlocked. I also suspect that Apple can unlock the computer with some secret procedure, but that would only restore the computer to normal operation: whatever was on the disk would still be gone to the extent the computer was able to erase it before you got it to Apple. (The MacObserver article states that they were not able to put the computer into target disk mode until they unlocked it when it was just remote locked. Mat Honan stated in a follow-up to his original article about getting hacked that the Apple Genius he eventually got to help him "had been able to reset the firmware password" even though he "couldn’t crack the PIN".) What makes the encrypted drives so secure is that all you need to erase is probably just one file system block containing the encryption key(s), so it's done in under a second.

No, it's not a secure wipe, and technically it's not even a "wipe" according to Apple's Technical White Paper "OS X Security":

"FileVault 2 provides IT departments with the ability to erase the encryption key from a given Mac at any time to ensure that encrypted data cannot be accessed by either user login or data recovery tools. This process is referred to as a remote wipe."

Source: Apple Technical White Paper OS X Security (March 2012)