5 ms·

A ThinkPad supervisor password crack

67 points by BuuQu9hu 10y ago

new299 10y ago
It's great that they've never fixed this, as I regularly pick up old Thinkpads super-cheap because they have supervisor passwords. But I've always been a bit confused as to why they've never fixed (or at least tried to fix) this issue.
- jstanley 10y ago
  Even if you can't bypass the password by shorting these pins, you could just replace the entire EEPROM with one that has a known password. I don't think it's a serious enough security feature to be worth trying to defend against physical access.
  - new299 10y ago
    Right, but I'm still surprised they've not at least implemented "if can't read EEPROM at boot disable EEPROM writes". With the architecture used, they're never going to be too robust to physical access. Overall EEPROM reset button on motherboard would be best, and just admit there's no really security against physical access here.
  - new299 10y ago
    One other point. You don't even need to remove the EEPROM, you can reprogram them in-place using an SOOC-8 clip and an SPI interface (eg buspirate). There lot of info available.
- xiphmont 10y ago
  They did as of Haswell. New machines are crackable too with more effort, but this simple short trick doesn't work. No, I don't know a trick for new machines, and am unlikely to look for one. Modern Thinkpads aren't machines I'm very interested in.
userbinator 10y ago
DISCLAIMER: Any discussion of how to crack security on even vintage machines is banned on most ThinkPad forums. So much as mentioning this page can get you banned in some places. IBM/Lenovo also says the only way to "recover" from a lost password is a new motherboard. Meanwhile eveyone else has figured it out. Great example of security theater.
- satysin 10y ago
  If Lenovo were serious about security they would encourage such discussion and exploration to improve their product. Of course this is Lenovo we are talking about, the company that thought Superfish would be a super idea!
  - userbinator 10y ago
    On the other hand, as evidenced by a few other comments here, there are probably quite a few who don't want the security "improved" Apple-style, to the point that losing the password really means it's impossible to recover from. Note that this password only allows access to BIOS and being able to boot; if the HDD also has a password and/or is encrypted, this doesn't really affect security of data.
    - satysin 10y ago
      That is the trade off though. If you want a secure device you need to accept the risks that if you forget the passphrase you are fucked. A false sense of security isn't a good thing.
    - xiphmont 10y ago
      Correct. The HD password is a little closer to real security. My motivation here is the same as most people buying old Thinkpads off eBay-- getting past the SVP on machines with a dead CMOS battery. I don't give a fig about any data on the hard drive :-)
frozenice 10y ago
That reminds me of a trick I discovered nearly 10 years ago on an Acer to reset the BIOS Password from Windows. There was this eSettings.exe which let you change some BIOS Settings from Windows, including the password. Of course it first asked for the old password and showed a prompt, denying the request if it was wrong. I fired up good old OllyDbg and traced the prompt in the ASM code. I changed only one bit IIRC (jne to je, or similar), saved the .exe and tried my luck. It let me through the prompt and I entered the new password. Amazingly the BIOS gladly accepted it! I didn't bother to find out what functions it exactly called to set the new password to write a small tool, because I already had one. ;) I wonder if this still works... If not with an Acer, maybe with some other make?
- rincebrain 10y ago
  I haven't tried this on anything newer than Sandy Bridge, but yes. I've never seen a BIOS that actually had anything but application-level password check for the calls from OS mode to rewrite the BIOS passwords or settings. No idea whether you can leverage TPMs or some of the enterprise trusting features to change that, though.
- yuhong 10y ago
  With UEFI it is probably less common now.
justinsaccount 10y ago
Really more of a bypass than a crack, but good to know. I have a t420 that has the supervisor password enabled. The only thing it prevented me from doing was enabling virtualization on the cpu, but docker has mostly replaced vagrant for me so I haven't minded.
mkj 10y ago
Good to see nothing changes. Many years ago I found I could bypass a 760EL password by copying the boot sector from an IBM util floppy disk to any boot disk.
gima 10y ago
> "I'm telling you to use different pins than ~all the other instructions on the web." sigh Please, Please, provide reasons along with your arguments. Simply stating something doesn't help, especially when there is contradicting information floating around.
- xiphmont 10y ago
  I did. Keep reading.
  - gima 10y ago
    You said it's because of a mix-up when reading documentation, but you said nothing about /why/ changing the write-protect pin's state should work - or why tying clock and data pins together should not.
    - xiphmont 10y ago
      I also said 'SCL to SDA does not work everywhere, whereas in testing, PROT to GND does'. PROT is not the WP pin. They're different. Go read the spec sheets. The original hack as discovered was PROT to GND, not SCL to SDA. My only speculation was as to why the hack as reposted changed over time.
    - xiphmont 10y ago
      To be fair, I cannot say with certainty why it works; I don't have code for the BIOS or EC. The CoreBoot and LibreBoot people might be able to shed some light. The more interesting aspect, verified by testing, is that it does work. In my own testing, SCL to SDA will not work on the T2X, T3X, T4X, T60, X2X, X3X, X4X, or X60. It does work on the T61/X61 and T400/500. PROT to GND works on all of the above. I also tested it on an X230 (works), but I didn't check SCL to SDA on that machine.
      - sethos 10y ago
        thanks for the list of combinations of Thinkpad models regarding SCL/SDA and PROT/GND. I tried SCL/SDA on my T60, of course it did not work... Do you happen to know how to locate PROT and GND on the top of T60 mainboard? Unfortunately the guide on ja.axxs shows only where SCL and SDA is located. Really appreciate it, thanks!

67 points by BuuQu9hu 10y ago

It's great that they've never fixed this, as I regularly pick up old Thinkpads super-cheap because they have supervisor passwords. But I've always been a bit confused as to why they've never fixed (or at least tried to fix) this issue.

jstanley 10y ago
Even if you can't bypass the password by shorting these pins, you could just replace the entire EEPROM with one that has a known password. I don't think it's a serious enough security feature to be worth trying to defend against physical access.
- new299 10y ago
  Right, but I'm still surprised they've not at least implemented "if can't read EEPROM at boot disable EEPROM writes". With the architecture used, they're never going to be too robust to physical access. Overall EEPROM reset button on motherboard would be best, and just admit there's no really security against physical access here.
- new299 10y ago
  One other point. You don't even need to remove the EEPROM, you can reprogram them in-place using an SOOC-8 clip and an SPI interface (eg buspirate). There lot of info available.
xiphmont 10y ago
They did as of Haswell. New machines are crackable too with more effort, but this simple short trick doesn't work. No, I don't know a trick for new machines, and am unlikely to look for one. Modern Thinkpads aren't machines I'm very interested in.

userbinator 10y ago

DISCLAIMER: Any discussion of how to crack security on even vintage machines is banned on most ThinkPad forums. So much as mentioning this page can get you banned in some places. IBM/Lenovo also says the only way to "recover" from a lost password is a new motherboard. Meanwhile eveyone else has figured it out. Great example of security theater.

satysin 10y ago
If Lenovo were serious about security they would encourage such discussion and exploration to improve their product. Of course this is Lenovo we are talking about, the company that thought Superfish would be a super idea!
- userbinator 10y ago
  On the other hand, as evidenced by a few other comments here, there are probably quite a few who don't want the security "improved" Apple-style, to the point that losing the password really means it's impossible to recover from. Note that this password only allows access to BIOS and being able to boot; if the HDD also has a password and/or is encrypted, this doesn't really affect security of data.
  - satysin 10y ago
    That is the trade off though. If you want a secure device you need to accept the risks that if you forget the passphrase you are fucked. A false sense of security isn't a good thing.
  - xiphmont 10y ago
    Correct. The HD password is a little closer to real security. My motivation here is the same as most people buying old Thinkpads off eBay-- getting past the SVP on machines with a dead CMOS battery. I don't give a fig about any data on the hard drive :-)

frozenice 10y ago

That reminds me of a trick I discovered nearly 10 years ago on an Acer to reset the BIOS Password from Windows. There was this eSettings.exe which let you change some BIOS Settings from Windows, including the password. Of course it first asked for the old password and showed a prompt, denying the request if it was wrong. I fired up good old OllyDbg and traced the prompt in the ASM code. I changed only one bit IIRC (jne to je, or similar), saved the .exe and tried my luck. It let me through the prompt and I entered the new password. Amazingly the BIOS gladly accepted it! I didn't bother to find out what functions it exactly called to set the new password to write a small tool, because I already had one. ;) I wonder if this still works... If not with an Acer, maybe with some other make?

rincebrain 10y ago
I haven't tried this on anything newer than Sandy Bridge, but yes. I've never seen a BIOS that actually had anything but application-level password check for the calls from OS mode to rewrite the BIOS passwords or settings. No idea whether you can leverage TPMs or some of the enterprise trusting features to change that, though.
yuhong 10y ago
With UEFI it is probably less common now.

justinsaccount 10y ago

Really more of a bypass than a crack, but good to know. I have a t420 that has the supervisor password enabled. The only thing it prevented me from doing was enabling virtualization on the cpu, but docker has mostly replaced vagrant for me so I haven't minded.

mkj 10y ago

Good to see nothing changes. Many years ago I found I could bypass a 760EL password by copying the boot sector from an IBM util floppy disk to any boot disk.

gima 10y ago

> "I'm telling you to use different pins than ~all the other instructions on the web." sigh Please, Please, provide reasons along with your arguments. Simply stating something doesn't help, especially when there is contradicting information floating around.

xiphmont 10y ago
I did. Keep reading.
- gima 10y ago
  You said it's because of a mix-up when reading documentation, but you said nothing about /why/ changing the write-protect pin's state should work - or why tying clock and data pins together should not.
  - xiphmont 10y ago
    I also said 'SCL to SDA does not work everywhere, whereas in testing, PROT to GND does'. PROT is not the WP pin. They're different. Go read the spec sheets. The original hack as discovered was PROT to GND, not SCL to SDA. My only speculation was as to why the hack as reposted changed over time.
  - xiphmont 10y ago
    To be fair, I cannot say with certainty why it works; I don't have code for the BIOS or EC. The CoreBoot and LibreBoot people might be able to shed some light. The more interesting aspect, verified by testing, is that it does work. In my own testing, SCL to SDA will not work on the T2X, T3X, T4X, T60, X2X, X3X, X4X, or X60. It does work on the T61/X61 and T400/500. PROT to GND works on all of the above. I also tested it on an X230 (works), but I didn't check SCL to SDA on that machine.
    - sethos 10y ago
      thanks for the list of combinations of Thinkpad models regarding SCL/SDA and PROT/GND. I tried SCL/SDA on my T60, of course it did not work... Do you happen to know how to locate PROT and GND on the top of T60 mainboard? Unfortunately the guide on ja.axxs shows only where SCL and SDA is located. Really appreciate it, thanks!