21–30 of 100 posts
Question: how secure are BIOS passwords, really? If you have full-disk encryption anyway, is the BIOS password adding anything?
There are quite a few laptops on ebay at considerable discounts because the seller doesn't know the BIOS password. This could come in handy.
There are quite a few laptops on ebay at considerable discounts because the seller doesn't know the BIOS password. This could come in handy.
I'm not sure buying stolen laptops is really the direction we want to go in here.
There are quite a few laptops on ebay at considerable discounts because the seller doesn't know the BIOS password. This could come in handy.
I'm not sure buying stolen laptops is really the direction we want to go in here.
A lot of passwords can be derived from the serial number. This website will do a lot of the work for you. https://bios-pw.org/
BIOS passwords are indeed a complete joke as means to secure access. There are a bunch of vendors out there who moved the authentication off from the BIOS/CPU to the KBC (keyboard controller) - Toshiba and Lenovo are among them. Still, it's ludicrously easy to circumvent these.
[0] https://dogber1.blogspot.com/2009/05/table-of-reverse-engine...
I was of the impression that BIOS passwords were in general not something one should rely even as a layer when assuming physical access. In the (not that) old days it was usually just a matter of removing the internal battery to reset it. Has this assumption changed in past years?
A bit, as posted in this blog, but for most part having physical unlimited access to a device it's game over. Hence why encrypting your sensitive data should be the norm (I am aware that is not the norm, not by far)
TLDR; remove battery.
I'm curious if TPM measurements would catch these kind of manipulations. It's probably system specific but the configuration of the BIOS should (as far as I understand it) be captured as part of the measurement process. If requisite credentials or remote attestation is sealed against a certain measurement value it should protect the system.
The way locking a TPM to firmware config works is that the TPM has several registers called PCRs that contain a hash value. Anything can send data to the TPM and have it update the hash value, and you can lock TPM keys to the PCRs such that you can only use the key when the PCRs you choose have a specific value. The TCG spec defines some of these PCRs to be sent certain information [0], but it's up to the firmware to…
I was of the impression that BIOS passwords were in general not something one should rely even as a layer when assuming physical access. In the (not that) old days it was usually just a matter of removing the internal battery to reset it. Has this assumption changed in past years?