Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Defeating a Laptop's BIOS Password

github.com

Post reply on HN
Print view View original

41–50 of 100 posts

Re: Defeating a Laptop's BIOS Password

#41

Post by rekoil »

unnouinceput wrote: post #19
Legogris wrote: post #16

I was of the impression that BIOS passwords were in general not something one should rely even as a layer when assuming physical access. In the (not that) old days it was usually just a matter of removing the internal battery to reset it. Has this assumption changed in past years?

A bit, as posted in this blog, but for most part having physical unlimited access to a device it's game over. Hence why encrypting your sensitive data should be the norm (I am aware that is not the norm, not by far)

Depends on your definition of encrypted I suppose. Many laptop SSDs are technically encrypted by default, but unless otherwise specified use a default key to unlock the drive.

Sure, they are still not encrypted in any meaningful sense by default, but the barrier to entry is quite far removed by not requiring a long process to enable it. A process which sometimes would require reinstallation, something an average person would likely not bother with.

While installing macOS Catalina the user gets prompted to activate this encryption, providing the system has a disk that supports that kind of full disk encryption I mentioned above.

Re: Defeating a Laptop's BIOS Password

#42

Post by numpad0 »

NullPrefix wrote: post #28
throwawaynothx wrote: post #24

TLDR; remove battery.

This is about laptops, not desktops. Battery removal only resets the clock, but the password stays on.

Doesn’t matter if it’s laptop or desktop, depends more on how old PC is. I think UEFI machines use NAND or NOR ROM as actually nonvolatile NVRAM.

Re: Defeating a Laptop's BIOS Password

#43

Post by tastroder »

anaisbetts wrote: post #40

This is cool, but if this is how SkySafe engineers spend their time, they're not gonna be a business for long. There's absolutely zero way that NUM_ENGINEERS * SALARY_PER_HOUR * HOURS_SPENT for this task is even remotely sane compared to just tossing the laptop and buying a new one. I get that this is kind of content marketing for their engineering department, but damn if they could've prooooobably spent that money o…

According to crunchbase they've been around since 2015 and had their last funding round in mid 2017. I doubt they're in such a crunch that they can't spend a few days for the team to focus on a fun and common interest without breaking the company.

Re: Defeating a Laptop's BIOS Password

#44

Post by numpad0 »

rustybolt wrote: post #35
ratiolat wrote: post #32

Earlier quoted context omitted.

The linked article did not have info about Thinkpads. I wonder how nowadays one can skip BIOS password of a T series thinkpad. So far it has always ended up with a motherboard change for me.

There is a trick that work for some (most?) models in the T-series: if you short the pins of some chip with the right timing, you can bypass the password check. See, for example: https://amp.reddit.com/r/thinkpad/comments/b7jbqq/reset_bios...

I believe you force BIOS to think that it had been lucky but checksums don’t match and EEPROM save is corrupt, then load default and let password go.

Works for straightforward ones like most Lenovo, but not for weirdos like Toshiba. Sometimes I see lots of Toshiba office laptops with locked BIOS waiting to be recycled as the result.

Re: Defeating a Laptop's BIOS Password

#45

Post by TACIXAT »

russfink wrote: post #29
Avery3R wrote: post #18

Earlier quoted context omitted.

The way locking a TPM to firmware config works is that the TPM has several registers called PCRs that contain a hash value. Anything can send data to the TPM and have it update the hash value, and you can lock TPM keys to the PCRs such that you can only use the key when the PCRs you choose have a specific value. The TCG spec defines some of these PCRs to be sent certain information [0], but it's up to the firmware to…

BIOS code is PCR 0, config is PCR 1. Software can "extend" certain PCRs as well. Look up Core Root of Trust for Measurement (CRTM) - lot of articles out there. BitLocker can use the capability you describe to protect the hard drive encryption keys. The TPM helps make sure the correct software is in control of the platform before releasing secrets.

It helps but unless you are using the secure channel setup (no one is to my knowledge) attackers can intercept the PCRExtend operations and replace the data being extended.

Re: Defeating a Laptop's BIOS Password

#46

Post by tonyedgecombe »

rustybolt wrote: post #35
ratiolat wrote: post #32

Earlier quoted context omitted.

The linked article did not have info about Thinkpads. I wonder how nowadays one can skip BIOS password of a T series thinkpad. So far it has always ended up with a motherboard change for me.

There is a trick that work for some (most?) models in the T-series: if you short the pins of some chip with the right timing, you can bypass the password check. See, for example: https://amp.reddit.com/r/thinkpad/comments/b7jbqq/reset_bios...

I seem to remember the last model that works on is the T420, after that you are out of luck.

Re: Defeating a Laptop's BIOS Password

#47

Post by thaumasiotes »

tastroder wrote: post #43
anaisbetts wrote: post #40

This is cool, but if this is how SkySafe engineers spend their time, they're not gonna be a business for long. There's absolutely zero way that NUM_ENGINEERS * SALARY_PER_HOUR * HOURS_SPENT for this task is even remotely sane compared to just tossing the laptop and buying a new one. I get that this is kind of content marketing for their engineering department, but damn if they could've prooooobably spent that money o…

According to crunchbase they've been around since 2015 and had their last funding round in mid 2017. I doubt they're in such a crunch that they can't spend a few days for the team to focus on a fun and common interest without breaking the company.

But if you let them have fun once, they're going to want to have fun ALL THE TIME. ;D

Re: Defeating a Laptop's BIOS Password

#49

Post by mike_d »

anaisbetts wrote: post #40

This is cool, but if this is how SkySafe engineers spend their time, they're not gonna be a business for long. There's absolutely zero way that NUM_ENGINEERS * SALARY_PER_HOUR * HOURS_SPENT for this task is even remotely sane compared to just tossing the laptop and buying a new one. I get that this is kind of content marketing for their engineering department, but damn if they could've prooooobably spent that money o…

> if this is how SkySafe engineers spend their time, they're not gonna be a business for long

This is the cheapest way of recruiting people in their target field. I have a strong interest in reverse engineering and actually checked out their jobs page. Too bad they are in San Diego.

Re: Defeating a Laptop's BIOS Password

#50

Post by akvadrako »

unnouinceput wrote: post #21
jasonhansel wrote: post #4

Question: how secure are BIOS passwords, really? If you have full-disk encryption anyway, is the BIOS password adding anything?

They are not secure at all. Full disk encryption is the only way to protect your data in case a stranger has physical access to your device.

That doesn’t help. If they have physical access they can make the system boot into a fake login screen and capture your password.

Securing the bios is necessary.

Post reply on HN