12 ms·
Defeating a Laptop's BIOS Password
- jasonhansel 7y agoQuestion: how secure are BIOS passwords, really? If you have full-disk encryption anyway, is the BIOS password adding anything?
- fortran77 7y agowell, you could make the machine boot on another device and potentially trick someone into entering their credentials on a "phishing" screen.
- Galanwe 7y agoThe BIOS does control the boot order sequence for instance. I guess if you have access to it, you could force boot from a malicious USB stick, or the network, that would simulate the disk decryption prompt. I guess you could also remove security measures that your company put in place to e.g. prevent the usage of USB to prevention information leak.
- jasonhansel 7y agoBut to do that you could also just (say) clone the disk drive and install the fake prompt on the disk drive itself, right?
- Galanwe 7y agoNot if secure boot is enabled, your boot loader most likely would not have a trusted signature.
- Avery3R 7y agoIf you have physical access and a flash programmer they're not secure at all. If you're trying to stop a random passerby from messing with your firmware settings they're great.
- unnouinceput 7y agoThey are not secure at all. Full disk encryption is the only way to protect your data in case a stranger has physical access to your device.
- akvadrako 7y agoThat doesn’t help. If they have physical access they can make the system boot into a fake login screen and capture your password. Securing the bios is necessary.
- faceplanted 7y agoIf someone has that much physical access to your machine they can capture your password far more easily with a physical keylogger assuming you use an external keyboard like one time.
- criddell 7y agoOr apply rubber hose cryptanalysis. https://xkcd.com/538/ https://xkcd.com/538/
- faceplanted 7y agoThat's not really the same situation, if someone's trying to bug you they don't want to be caught, if they were willing to do illegal violence they'd probably do it first, or if they're a government, you have way bigger problems.
- mehrdadn 7y agoOne is supposed to prevent access to the hardware, one is supposed to prevent access to the data. They're not meant to solve the same problem. But that say, you can only block access to hardware so well, so it's worse in that regard.
- Razengan 7y ago> Even today's modern 64-bit CPUs begin execution in 16-bit mode. In UEFI, this is called the SEC phase. Is that true even for the T2 Macs and such?
- Avery3R 7y agoI'm not that familiar with Macs, but if they're using an Intel CPU it almost definitely starts in 16-bit mode. From what I understand the T2 chip is more akin to what's called an embedded controller in other laptops.
- fortran77 7y agoAccording to the CPU processor manuals, they all boot in "real mode" which is a 16-bit legacy/bootstrap mode.
- pwg 7y agoYes, all Intel X86 CPU's start up in 'real mode' which is 16-bit mode. They start this way because at initial reset none of the required data structures for protected mode operation (page tables, GDT, IDT, etc.) are present. So the CPU starts up as a very fast 8086 who's purpose is to setup just enough page tables, a GDT, an IDT, etc. to be able to switch into protected mode and continue system bootstrap.
- nixgeek 7y agoThere's coverage of that in Apple's Platform Security documentation. https://support.apple.com/guide/security/uefi-firmware-overview-seced055bcf6/web https://support.apple.com/guide/security/uefi-firmware-overv...
- saagarjha 7y agoThe T2's job is to bring the main processor out of reset. The actual booting is standard UEFI, apparently.
- onedognight 7y agoApple has been moving their defenses earlier and earlier in the boot process. According to this talk[0] they are even able to foil malicious option ROM[1] and other early boot attacks. I don’t recall if they mention boot passwords specifically, but they claim to lead the industry in this regard. [0] https://youtu.be/3byNNUReyvE https://youtu.be/3byNNUReyvE [1] https://www.blackhat.com/us-19/briefings/schedule/#behind-the-scenes-of-ios-and-mac-security-17220 https://www.blackhat.com/us-19/briefings/schedule/#behind-th...
- TrueDuality 7y agoI'm curious if TPM measurements would catch these kind of manipulations. It's probably system specific but the configuration of the BIOS should (as far as I understand it) be captured as part of the measurement process. If requisite credentials or remote attestation is sealed against a certain measurement value it should protect the system.
- Avery3R 7y agoThe way locking a TPM to firmware config works is that the TPM has several registers called PCRs that contain a hash value. Anything can send data to the TPM and have it update the hash value, and you can lock TPM keys to the PCRs such that you can only use the key when the PCRs you choose have a specific value. The TCG spec defines some of these PCRs to be sent certain information [0], but it's up to the firmware to send it, the TPM doesn't magically know what the state is. If there's even a single setting or nvram variable that you can change to gain code execution that isn't part of the data that's sent to the PCRs that the crypto key is locked to, it's game over. [0]: https://trustedcomputinggroup.org/wp-content/uploads/TCG-EFI-Platform-Specification.pdf https://trustedcomputinggroup.org/wp-content/uploads/TCG-EFI...
- russfink 7y agoBIOS code is PCR 0, config is PCR 1. Software can "extend" certain PCRs as well. Look up Core Root of Trust for Measurement (CRTM) - lot of articles out there. BitLocker can use the capability you describe to protect the hard drive encryption keys. The TPM helps make sure the correct software is in control of the platform before releasing secrets.
- TACIXAT 7y agoIt helps but unless you are using the secure channel setup (no one is to my knowledge) attackers can intercept the PCRExtend operations and replace the data being extended.
- Causality1 7y agoThere are quite a few laptops on ebay at considerable discounts because the seller doesn't know the BIOS password. This could come in handy.
- sfgweilr4f 7y agoBeen a nice little side business for years. So, yeah. Considerable discounts.
- selectodude 7y agoI'm not sure buying stolen laptops is really the direction we want to go in here.
- toast0 7y agoStolen is certainly one way laptops (or desktops, I suppose) get locked with unknown passwords. But I've also seen listings for government surplus with unknown passwords.
- thenewnewguy 7y agoThieves are probably more likely to know how to bypass a BIO password than the legit owner.
- mschuster91 7y agoStolen? I wouldn't jump to that conclusion so fast. A large source for these are mass sell-offs of old corporate or government gear after the usual 2-5 year upgrade cycle or government sales of impounded devices.
- jotm 7y agoFunny story, I bought a system board on eBay that had a BIOS password on it. The seller didn't answer my messages asking for the password, so I assumed he knew there was a password, but didn't know it (and didn't say in the item description). He just ghosted me. Returning it seemed like a hassle, I really needed it and this was the only one on sale in Europe. Found the former owner of the laptop where the board came from thanks to the corporate/user name displayed on the password prompt. It was a small IT company. Contacted them on LinkedIn asking for the password and detailing the situation. Didn't get the password, but the CEO/owner of the company certainly had a surprise. Turned out one of their guys was selling parts from their laptops/hardware without permission. Suddenly, the seller on eBay found the message feature and wrote to me, saying I got them in trouble. Shouldn't have ghosted me, then? Just a "sorry, didn't know it had one" and I would've just proceeded to replace the BIOS chip, which was my plan B and it's what I ended up doing.
- beart 7y agoA lot of passwords can be derived from the serial number. This website will do a lot of the work for you. https://bios-pw.org/ https://bios-pw.org/
- dogber1 7y agoThat's a great re-implementation from some stuff I did eons ago [0]. BIOS passwords are indeed a complete joke as means to secure access. There are a bunch of vendors out there who moved the authentication off from the BIOS/CPU to the KBC (keyboard controller) - Toshiba and Lenovo are among them. Still, it's ludicrously easy to circumvent these. [0] https://dogber1.blogspot.com/2009/05/table-of-reverse-engineered-bios.html https://dogber1.blogspot.com/2009/05/table-of-reverse-engine...
- ratiolat 7y agoThe linked article did not have info about Thinkpads. I wonder how nowadays one can skip BIOS password of a T series thinkpad. So far it has always ended up with a motherboard change for me.
- blkhawk 7y agoThere is a guy in hungary that offers unlocking services for about 50EUR. He is a bit difficult to work with (insists on a NDA) but the procedure is as follows: you dump the bios via SPI and send it to him. Afterwards you get a patched image back you flash onto the bios chip. Then you boot and you need to enter some numbers he also sends you (I assume some type of copy protection) and it will unlock and reset the bios password. After that you just reflash the bios image you made earlier.
- Zod666 7y agoIf you don't mind physically opening the laptop, you open it and take out the CMOS battery, boot it up without it then shut it down and put the CMOS battery back in and boot. The BIOS password will no longer bet set. I don't know if this still works but it used to on older laptops.
- Legogris 7y agoI was of the impression that BIOS passwords were in general not something one should rely even as a layer when assuming physical access. In the (not that) old days it was usually just a matter of removing the internal battery to reset it. Has this assumption changed in past years?
- unnouinceput 7y agoA bit, as posted in this blog, but for most part having physical unlimited access to a device it's game over. Hence why encrypting your sensitive data should be the norm (I am aware that is not the norm, not by far)
- Legogris 7y agoSure, it's just that the only situation I see a BIOS password making sense is in the presence of some intrusion-detection mechanism that would perform some kind of destruction/lockdown/alarm so that attempting to bypass it would not be without consequences.
- tomlong 7y agoThey are good for stopping people fiddling in large scale corporate deployments where someones nephew knows how to make the work laptop go faster.
- rekoil 7y agoDepends on your definition of encrypted I suppose. Many laptop SSDs are technically encrypted by default, but unless otherwise specified use a default key to unlock the drive. Sure, they are still not encrypted in any meaningful sense by default, but the barrier to entry is quite far removed by not requiring a long process to enable it. A process which sometimes would require reinstallation, something an average person would likely not bother with. While installing macOS Catalina the user gets prompted to activate this encryption, providing the system has a disk that supports that kind of full disk encryption I mentioned above.
- throwawaynothx 7y agoTLDR; remove battery.
- NullPrefix 7y agoThis is about laptops, not desktops. Battery removal only resets the clock, but the password stays on.
- numpad0 7y agoDoesn’t matter if it’s laptop or desktop, depends more on how old PC is. I think UEFI machines use NAND or NOR ROM as actually nonvolatile NVRAM.
- jotm 7y agoSadly (or fortunately?) that stopped working around 2006
- dschuetz 7y agoOh sure, to defeat a BIOS password I'm supposed to have IDA Pro lying around, with license.
- busterarm 7y agoSo use ghidra or radare2 or free other alternatives instead?
- anaisbetts 7y agoThis is cool, but if this is how SkySafe engineers spend their time, they're not gonna be a business for long. There's absolutely zero way that NUM_ENGINEERS * SALARY_PER_HOUR * HOURS_SPENT for this task is even remotely sane compared to just tossing the laptop and buying a new one. I get that this is kind of content marketing for their engineering department, but damn if they could've prooooobably spent that money on something with more impact
- pjc50 7y agoDoing it once is R&D. Doing it multiple times is a service. Having the capability if it's needed for something more valuable? Priceless.
- tastroder 7y agoAccording to crunchbase they've been around since 2015 and had their last funding round in mid 2017. I doubt they're in such a crunch that they can't spend a few days for the team to focus on a fun and common interest without breaking the company.
- thaumasiotes 7y agoBut if you let them have fun once, they're going to want to have fun ALL THE TIME. ;D
- mike_d 7y ago> if this is how SkySafe engineers spend their time, they're not gonna be a business for long This is the cheapest way of recruiting people in their target field. I have a strong interest in reverse engineering and actually checked out their jobs page. Too bad they are in San Diego.
- oneplane 7y agoOr you can bill it as internal education. Not everything has to be min/maxed like that, even in this late stage capitalism world.
- yNeolh 7y ago> We found a laptop laying around the office that had BIOS password enabled. I really wanted to be a laptop from someone on vacation and that at his come back finds this post instead of the laptop xD
- ben_bai 7y agoTL;DR but why not "open laptop, disconnect BIOS battery for 10 sec, reassemble, done"
- abainbridge 7y agoI think the article explains that the state they needed to change was stored in flash.
- mikorym 7y agoDoes this also hold for Macbooks? Edit: A more precise question would be: What is the analogy to Secure Boot and the hardware being locked on a Macbook?
- diffeomorphism 7y agoIs there anything actually different? A Macbook is a relatively standard Intel laptop that happens to run MacOS. The only additional complication might be the T2 chip in the same way that TPMs might be an additional issue in other business laptops.
- mikorym 7y agoI don't know. The reason why I ask this is that I want to replace my Macbook's startup chime with something else.
- mafriese 7y agocan someone tell me which flash programmer is used here? I also want to play around with UEFI.
- tomatocracy 7y agoNot sure what they used here, but I've had good success using a FlashcatUSB on various embedded devices and it has support for a pretty broad variety of flash memory chips.
- cure 7y agoNot sure what they used, but even a Raspberry Pi + a Pomona clip will do the trick. Have a look at the flashrom wiki, see https://flashrom.org/ISP https://flashrom.org/ISP.
- HHad3 7y agoCareful though, and read the datasheet first! AM4, for example, uses 1.8V SPI flash chips. Connecting them to Raspberry Pi directly will at the very least fry the chip, if not the whole board.
- Avery3R 7y agoWe used J-Link with a J-Flash SPI license. https://www.segger.com/products/debug-probes/j-link/tools/j-flash-spi/ https://www.segger.com/products/debug-probes/j-link/tools/j-... Any SPI flash programmer should work though. The protocol is simple enough that you could even implement it with an arduino if you really needed too.
- 1_player 7y agoI "cracked" my father's laptop's password when he passed away 15 years ago by buying a similar, broken laptop on eBay for cheap, and unsoldering and switching the ROM/EEPROM containing the BIOS. Probably one of the coolest things I've done as a teenager.
- agumonkey 7y agofearless comes to mind
- bluedino 7y agoYou can buy just the chip on eBay these days. Depending on the model laptop they send you a different chip and they pre-load a BIOS on it for you.
- big_chungus 7y agoWhy re-solder the chip? It seems as though it would be easier to recover data by just yanking the drive, especially since full-disk encryption was quite rare fifteen years ago. Failing that, couldn't you have used a SPI flasher with the existing chip?
- snazz 7y agoSome laptop hard drives have a firmware password you have to enter at the BIOS stage to boot it.
- winternett 7y agoCan't you still just remove the battery on the mother board for a few seconds? I used to do that all the time back when I was a repair tech...
- 1_player 7y agoEEPROMs are non-volatile. They don't need power to keep their data. AFAIK removing the battery just resets the real time clock.
- 7y ago
- archi42 7y agoFor my Lenovo Helix 2nd Gen I just need to wait until the battery runs out. This clears the BIOS, including the password.
- ineedasername 7y agoWay back in the first years of the 00's, working IT support in college, BIOS passwords were common (though not mandatory) on the Faculty/Staff desktops. So, forgetting passwords was common as well, and at the time we could reset them by opening them up and swapping a jumper to another set of pins. It struck me as fairly useless to have a BIOS password at the time. Forever after, on bootup, "Warning! Case has been opened!" would flash up on the screen. I assumed that was for warranty purposes, but our IT department was certified for repairs so it didn't really matter.
- da_chicken 7y agoThe BIOS should have a reset option for the case open switch. It's just a warning you toggle off in the BIOS. The idea is that only a tech would know the BIOS password to turn it off, so that's how you know that someone knows about it. It's also unusual that discharging the CMOS removed the boot password. It shouldn't do that. I also worked on similar desktops (they were IBM desktops from before they were spun off) and they didn't have this problem that I can recall. Very few systems had boot passwords, however. I'm certain that the BIOS passwords didn't clear this way, however, because we had a few systems that had old passwords that nobody knew. Instead, we had a copy of the tech software used to program the BIOS. You had to boot that program and use it to clear the password. HP had a similar program, but that stopped working around 2010 when the computers started to ship with a TPM and you could no longer just clear the content.
- shakna 7y ago> It's also unusual that discharging the CMOS removed the boot password. It shouldn't do that. That's actually the official way to reset the password for a number of systems. [0][1][2] [0] https://www.dell.com/support/article/au/en/aubsd1/sln170684/how-to-clear-the-bios-password?lang=en https://www.dell.com/support/article/au/en/aubsd1/sln170684/... [1] https://forums.lenovo.com/t5/ThinkStation-Workstations/How-do-I-reset-the-BIOS-and-or-password-on-my-ThinkStation/ta-p/542883 https://forums.lenovo.com/t5/ThinkStation-Workstations/How-d... [2] https://h30434.www3.hp.com/t5/Desktop-Boot-and-Lockup/how-to-remove-bios-password/td-p/6022150 https://h30434.www3.hp.com/t5/Desktop-Boot-and-Lockup/how-to...
- deleted 7y ago[deleted]
- cashy 7y agowe just use this on the dells at work https://bios-pw.org/ https://bios-pw.org/
- deleted 7y ago[deleted]