Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Defeating a Laptop's BIOS Password

github.com

Post reply on HN
Print view View original

51–60 of 100 posts

Re: Defeating a Laptop's BIOS Password

#51

Post by Zod666 »

blkhawk wrote: post #34
ratiolat wrote: post #32

Earlier quoted context omitted.

The linked article did not have info about Thinkpads. I wonder how nowadays one can skip BIOS password of a T series thinkpad. So far it has always ended up with a motherboard change for me.

There is a guy in hungary that offers unlocking services for about 50EUR. He is a bit difficult to work with (insists on a NDA) but the procedure is as follows: you dump the bios via SPI and send it to him. Afterwards you get a patched image back you flash onto the bios chip. Then you boot and you need to enter some numbers he also sends you (I assume some type of copy protection) and it will unlock and reset the bio…

If you don't mind physically opening the laptop, you open it and take out the CMOS battery, boot it up without it then shut it down and put the CMOS battery back in and boot. The BIOS password will no longer bet set. I don't know if this still works but it used to on older laptops.

Re: Defeating a Laptop's BIOS Password

#52

Post by oneplane »

Zod666 wrote: post #51
blkhawk wrote: post #34

Earlier quoted context omitted.

There is a guy in hungary that offers unlocking services for about 50EUR. He is a bit difficult to work with (insists on a NDA) but the procedure is as follows: you dump the bios via SPI and send it to him. Afterwards you get a patched image back you flash onto the bios chip. Then you boot and you need to enter some numbers he also sends you (I assume some type of copy protection) and it will unlock and reset the bio…

If you don't mind physically opening the laptop, you open it and take out the CMOS battery, boot it up without it then shut it down and put the CMOS battery back in and boot. The BIOS password will no longer bet set. I don't know if this still works but it used to on older laptops.

Doesn't work anymore. The data is no longer stored in CMOS.

Re: Defeating a Laptop's BIOS Password

#53

Post by oneplane »

anaisbetts wrote: post #40

This is cool, but if this is how SkySafe engineers spend their time, they're not gonna be a business for long. There's absolutely zero way that NUM_ENGINEERS * SALARY_PER_HOUR * HOURS_SPENT for this task is even remotely sane compared to just tossing the laptop and buying a new one. I get that this is kind of content marketing for their engineering department, but damn if they could've prooooobably spent that money o…

Or you can bill it as internal education. Not everything has to be min/maxed like that, even in this late stage capitalism world.

Re: Defeating a Laptop's BIOS Password

#54

Post by oneplane »

rekoil wrote: post #41
unnouinceput wrote: post #19

Earlier quoted context omitted.

A bit, as posted in this blog, but for most part having physical unlimited access to a device it's game over. Hence why encrypting your sensitive data should be the norm (I am aware that is not the norm, not by far)

Depends on your definition of encrypted I suppose. Many laptop SSDs are technically encrypted by default, but unless otherwise specified use a default key to unlock the drive. Sure, they are still not encrypted in any meaningful sense by default, but the barrier to entry is quite far removed by not requiring a long process to enable it. A process which sometimes would require reinstallation, something an average pers…

Catalina doesn't use in-SSD encryption. You either get T2 encryption or FDE via software (FileVault2) which is slower but not disk-dependant either.

Re: Defeating a Laptop's BIOS Password

#55

Post by oneplane »

Razengan wrote: post #2

> Even today's modern 64-bit CPUs begin execution in 16-bit mode. In UEFI, this is called the SEC phase. Is that true even for the T2 Macs and such?

Yes, because the CPU boots after the T2, and the T2 emulates the SPI ROM to the PCH. There is no actual BIOS Flash chip, only T2 Flash.

Normally the CPU talks to the PCH and the PCH via SPI to a Flash ROM. The CPU has a BOOTROM which can cryptographically verify code blocks, the PCH has a CPU that can do the same, and the firmware has signed code blocks. It starts out with the CPU reading an authenticated code block which contains further code to verify other blocks.

Problem is that you still read SPI Flash which can be modified out of band, so after the CPU ROM reads the ACB it continues reading code which can be altered and if the UEFI firmware is set to 'verify but don't stop running' mode, you can modify all you want and it will work. On the other hand, if it is configured that way but a bit flip happens you can't boot anymore and can repair either. Apple's solution was to get rid of that completely and just emulate that SPI Flash from the T2 chip. The T2 is a complete SoC running an OS and has a secure enclave. Because it doesn't have to support 1980's Intel architecture they had a lot more freedom in designing security from the start, something Intel can't do unless they can break with backwards compatibility.

Re: Defeating a Laptop's BIOS Password

#56

Post by m_eiman »

selectodude wrote: post #22
Causality1 wrote: post #17

There are quite a few laptops on ebay at considerable discounts because the seller doesn't know the BIOS password. This could come in handy.

I'm not sure buying stolen laptops is really the direction we want to go in here.

Agreed. Ask to see the original receipt for anything you buy second hand.

Re: Defeating a Laptop's BIOS Password

#57

Post by DanBC »

numpad0 wrote: post #44
rustybolt wrote: post #35

Earlier quoted context omitted.

There is a trick that work for some (most?) models in the T-series: if you short the pins of some chip with the right timing, you can bypass the password check. See, for example: https://amp.reddit.com/r/thinkpad/comments/b7jbqq/reset_bios...

I believe you force BIOS to think that it had been lucky but checksums don’t match and EEPROM save is corrupt, then load default and let password go. Works for straightforward ones like most Lenovo, but not for weirdos like Toshiba. Sometimes I see lots of Toshiba office laptops with locked BIOS waiting to be recycled as the result.

Older Toshibas have pins near the RAM that can be shorted to clear the passwords. There's a big list here: https://biosbypass.com/how-to-clear-toshiba-bios-password/

Re: Defeating a Laptop's BIOS Password

#60

Post by jotm »

mschuster91 wrote: post #36
selectodude wrote: post #22

Earlier quoted context omitted.

I'm not sure buying stolen laptops is really the direction we want to go in here.

Stolen? I wouldn't jump to that conclusion so fast. A large source for these are mass sell-offs of old corporate or government gear after the usual 2-5 year upgrade cycle or government sales of impounded devices.

Funny story, I bought a system board on eBay that had a BIOS password on it. The seller didn't answer my messages asking for the password, so I assumed he knew there was a password, but didn't know it (and didn't say in the item description). He just ghosted me. Returning it seemed like a hassle, I really needed it and this was the only one on sale in Europe.

Found the former owner of the laptop where the board came from thanks to the corporate/user name displayed on the password prompt. It was a small IT company.

Contacted them on LinkedIn asking for the password and detailing the situation. Didn't get the password, but the CEO/owner of the company certainly had a surprise.

Turned out one of their guys was selling parts from their laptops/hardware without permission.

Suddenly, the seller on eBay found the message feature and wrote to me, saying I got them in trouble. Shouldn't have ghosted me, then? Just a "sorry, didn't know it had one" and I would've just proceeded to replace the BIOS chip, which was my plan B and it's what I ended up doing.

Post reply on HN