Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Defeating a Laptop's BIOS Password

github.com

Post reply on HN
Print view View original

71–80 of 100 posts

Re: Defeating a Laptop's BIOS Password

#71

Post by 4cao »

ratiolat wrote: post #32
dogber1 wrote: post #26

Earlier quoted context omitted.

That's a great re-implementation from some stuff I did eons ago [0]. BIOS passwords are indeed a complete joke as means to secure access. There are a bunch of vendors out there who moved the authentication off from the BIOS/CPU to the KBC (keyboard controller) - Toshiba and Lenovo are among them. Still, it's ludicrously easy to circumvent these. [0] https://dogber1.blogspot.com/2009/05/table-of-reverse-engine...

The linked article did not have info about Thinkpads. I wonder how nowadays one can skip BIOS password of a T series thinkpad. So far it has always ended up with a motherboard change for me.

For slightly older ThinkPads, the method is to short clock and data lines (SCL and SDA), power on the laptop, and press F1 all at the right moment. This website has the locations for many models, for example the X220: http://www.ja.axxs.net/x220.htm (note that this person is/was selling a device to assist with the process but its use is not required, although, predictably, it doesn't say so on the website).

For newer ThinkPads, there is a method to replace the LenovoTranslateService EFI module with a modified version that passes control to another module, which in turn removes the password. This is supposed to be a paid solution (the module will ask for a code that has to be purchased) but apparently there is a "workaround" for that too.

I might not be up to date as I had no need for any of these and my most recent ThinkPad is an X220 but it's safe to say there is always going to be some solution without having to resort to motherboard replacement.

Re: Defeating a Laptop's BIOS Password

#72

Post by faceplanted »

akvadrako wrote: post #50
unnouinceput wrote: post #21

Earlier quoted context omitted.

They are not secure at all. Full disk encryption is the only way to protect your data in case a stranger has physical access to your device.

That doesn’t help. If they have physical access they can make the system boot into a fake login screen and capture your password. Securing the bios is necessary.

If someone has that much physical access to your machine they can capture your password far more easily with a physical keylogger assuming you use an external keyboard like one time.

Re: Defeating a Laptop's BIOS Password

#73

Post by jasonhansel »

Galanwe wrote: post #7
jasonhansel wrote: post #4

Question: how secure are BIOS passwords, really? If you have full-disk encryption anyway, is the BIOS password adding anything?

The BIOS does control the boot order sequence for instance. I guess if you have access to it, you could force boot from a malicious USB stick, or the network, that would simulate the disk decryption prompt. I guess you could also remove security measures that your company put in place to e.g. prevent the usage of USB to prevention information leak.

But to do that you could also just (say) clone the disk drive and install the fake prompt on the disk drive itself, right?

Re: Defeating a Laptop's BIOS Password

#75

Post by tomatocracy »

mafriese wrote: post #67

can someone tell me which flash programmer is used here? I also want to play around with UEFI.

Not sure what they used here, but I've had good success using a FlashcatUSB on various embedded devices and it has support for a pretty broad variety of flash memory chips.

Re: Defeating a Laptop's BIOS Password

#76

Post by pjc50 »

anaisbetts wrote: post #40

This is cool, but if this is how SkySafe engineers spend their time, they're not gonna be a business for long. There's absolutely zero way that NUM_ENGINEERS * SALARY_PER_HOUR * HOURS_SPENT for this task is even remotely sane compared to just tossing the laptop and buying a new one. I get that this is kind of content marketing for their engineering department, but damn if they could've prooooobably spent that money o…

Doing it once is R&D. Doing it multiple times is a service. Having the capability if it's needed for something more valuable? Priceless.

Re: Defeating a Laptop's BIOS Password

#78

Post by bluedino »

sph wrote: post #68

I "cracked" my father's laptop's password when he passed away 15 years ago by buying a similar, broken laptop on eBay for cheap, and unsoldering and switching the ROM/EEPROM containing the BIOS. Probably one of the coolest things I've done as a teenager.

You can buy just the chip on eBay these days. Depending on the model laptop they send you a different chip and they pre-load a BIOS on it for you.

Re: Defeating a Laptop's BIOS Password

#79

Post by HHad3 »

cure wrote: post #77
mafriese wrote: post #67

can someone tell me which flash programmer is used here? I also want to play around with UEFI.

Not sure what they used, but even a Raspberry Pi + a Pomona clip will do the trick. Have a look at the flashrom wiki, see https://flashrom.org/ISP .

Careful though, and read the datasheet first! AM4, for example, uses 1.8V SPI flash chips. Connecting them to Raspberry Pi directly will at the very least fry the chip, if not the whole board.

Re: Defeating a Laptop's BIOS Password

#80

Post by criddell »

faceplanted wrote: post #72
akvadrako wrote: post #50

Earlier quoted context omitted.

That doesn’t help. If they have physical access they can make the system boot into a fake login screen and capture your password. Securing the bios is necessary.

If someone has that much physical access to your machine they can capture your password far more easily with a physical keylogger assuming you use an external keyboard like one time.

Or apply rubber hose cryptanalysis.

https://xkcd.com/538/

Post reply on HN