6 ms·

Bypassing the WiFi Hardware Switch on the Lenovo X201 (2023)

76 points by bradley_taunt 3y ago

AequitasOmnibus 3y ago
It warms my heart to see people still taking about the X201’s faulty WiFi switch. I loved that laptop but ended up mothballing it over the switch. It remains a perfect example of how cheaping out on an extremely minor component (a plastic slide-switch) can sabotage an otherwise fantastic product.
- csydas 3y ago
  Yes I used to run into these cards all the time in the past (maybe ancestors of the one from the article) but they were always a pain to deal with. I usually just recommended new wi-fi card if the card was showing these symptoms and i cannot recall anyone ever coming back with wi-fi complaints after that. but definitely if this trick would have worked i would have used it.
  - numpad0 3y ago
    Wi-Fi cards do wear out and needs replacement, especially old ones. There was also a widespread manufacturing issue in some Wi-Fi/Bluetooth chipsets around 2007-2012, which had to do with amplifier SAW/BAW filter(?) that lead to rapid and thorough degradation in radio performance. I think at least Qualcomm did notify rather silently on B2B news channels but it wasn't communicated to the public.
5- 3y ago
a larger hardware fix for the x200/x201 is the x2100 upgrade (intel comet lake motherboard, nvme, up to 64gb ddr4, 13" 3000x2000 ips panel). see https://www.xyte.ch/mods/x210-x2100/ https://www.xyte.ch/mods/x210-x2100/ for an overview, although sadly the availability is diminishing (and the hardware is far from bleeding edge four years later) -- the above linked vendor is awol. i've got myself 2.5 x2100s, hoping that will tide me over until something new becomes available.
- graphe 3y ago
  Buying a new motherboard to replace the Thinkpad is hardly a fix. Otherwise I could 'fix' my Thinkpad x200 by buying a x230. You could make a case for the ship of Theseus but it's more like you are taking off the captains wheel and replacing the whole thing and calling it the same ship. I never got the appeal of those laptops either. It's not a Thinkpad, its an Chinese motherboard that is overpriced to get it working with a nice keyboard, and yet you'll still have to bend your neck to use it unless you're using the dock.
  - justaj 3y ago
    I was going to say you'd also lose out on the Libreboot compatibility, but apparently X201 support was urgently removed from LB: https://libreboot.org/news/x201.html https://libreboot.org/news/x201.html
  - 5- 3y ago
    even though i have the x2100 as a 'fix for x201', which would make sense in the context of the original post, for me it was just a new laptop purchase, and i have considered the x2100 on its own merits as a laptop i could get -- for me it was decent (i.e. non-chiclet) keyboard, trackpoint, good screen, and autonomy (plenty of disk, ram and battery).
tra3 3y ago
Wait so the kill switch is really just a suggestion that is then handled in the card”s firmware? I guess that’s how things like cameras status led is compromised?
- w-ll 3y ago
  Wait till you learn about Apple toggles
  - Lammy 3y ago
    The ones that turn themselves back on at 3 AM so it can update itself whether you like it or not
- numpad0 3y ago
  No. I suggest you do skim the article. The author taped the switch readout pin (mPCIe pin 20) at the card side, and the card was so designed that it assumes the switch is set to not-kill when the switch is not present at all. We do not know how deep the mechanism goes within the card. It is only shown that the card do work if the pin is open.
  - stavros 3y ago
    Which means that then the switch is _exactly_ "just a suggestion that is then handled in the card”s firmware". It doesn't cut the power to the card.
    - lagadu 3y ago
      We don't actually know that. It's possible that connecting that pin shorts some circuit on the card that prevents it from operating. I suspect you're right though.
      - sue_real 3y ago
        It's pretty much just a button, if it doesn't physically cuts power, I'd suggest. I think with billion dollar budget year after year, you pretty much go for firmware level attacks thees days. 0click 0day as-a-service is private economy and.. cheap and very different from what they want: long term backdoor access to everything, without the possiblility to spot it in user space or OS.
szundi 3y ago
I just imagine how that piece of tape will stick to the tiny pin in the socket and tears it out when the module is removed next time
- ImPostingOnHN 3y ago
  "Good" news!: if that happens, it will likely make the "fix" permanent!
deleted 3y ago
[deleted]
albert_e 3y ago
isn't there a simpler way to bypass the hardware switch ...like shorting the switch terminals on the inside to permanently leave it "on"?
- parsimo2010 3y ago
  The author mentioned that but didn’t know how to solder, so they chose this method instead. If they knew how to solder this would have been a different fix.
nyanpasu64 3y ago
It's possible that thinner kapton tape would be easier to cut into a narrow sliver and place over a pin, while having the card still fit in the socket without being too thick?
- stzsch 3y ago
  I recently performed this exact procedure on a wifi card and yes, kapton tape works better. Electrical tape tends to tear or slide.
zer0x4d 3y ago
My experience with ACPI is limited to tinkering with it a bit for installing macOS on unsupported systems, but shouldn't it be possible to avoid any physical modification and do the same with an SSDT that disables the power to the kill switch?
- mjg59 3y ago
  No, the kill switch is a literal electronic connection to the pin on the WiFi card that tells the firmware on that card to disable itself. ACPI may provide an alternative mechanism to trigger the same pin, but that doesn't mean ACPI can be modified to disable the physical switch. (What may actually be happening is that they switch is telling the embedded controller to toggle the WiFi card pin, in which case modifying the EC firmware might let you achieve the desired outcome, but that's still not an ACPI hack)
consumer451 3y ago
The following breaks my heart, as I love the ThinkPad keyboard, but it's just not worth it. If your work is sensitive in any way, this is what you can expect from Lenovo: > In February 2021, Bloomberg Businessweek reported that U.S. investigators found in 2008 that military units in Iraq were using Lenovo laptops in which the hardware had been altered. According to a testimony from the case in 2010, "A large amount of Lenovo laptops were sold to the U.S. military that had a chip encrypted on the motherboard that would record all the data that was being inputted into that laptop and send it back to China." [0] How is this company still allowed to do business in the USA? There are ThinkPads in the most important of places. Not just in government, but in research... There are apparently no adults in the room, so make your own decisions. [0] https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_incidents https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_in...
- dzdt 3y ago
  The Bloomberg story referenced in your [0] was refuted by pretty much everyone and independently confirmed by no one. See [1]. It was not retracted by the authors but the consensus seems to be it is intelligent speculation rather than confirmed fact. In particular the quote you pulled seems like a garbled and further exaggerated secondary source based on the unvalidated Bloomber article. Note the incorrect technical word usage ("encrypted" is not a correct verb to describe how a chip could be integrated into a motherboard design) and the implausible scope of the allegations (sending literally all data inputted to the laptop to China would be a large obvious datastream that would be quickly noticed and independently confirmed, which has not happened). [1] https://pxlnv.com/blog/one-year-after-big-hack/ https://pxlnv.com/blog/one-year-after-big-hack/
  - consumer451 3y ago
    If that is indeed the case, you should update the Wikipedia entry which I quoted.
    - catach 3y ago
      The article's talk page already has a request for an impartial editor to weigh in, though several months old.
pengaru 3y ago
There are issues with trusting a pci attached wifi device running a pile of closed firmware anyways. If you're concerned about this type of thing discard the internal wifi card and use an usb-attached wifi dongle you can unplug to achieve a "wifi physically disconnected" state with certainty. The other advantage is whatever firmware's running on the wifi dongle isn't going to be potentially accessing host memory over usb, which a pci bus master could theoretically do.
Grepnux 3y ago
It’s an extremely comfy laptop. Still handles the modern web OK, especially if you use uMatrix to block third party garbage.

76 points by bradley_taunt 3y ago

It warms my heart to see people still taking about the X201’s faulty WiFi switch. I loved that laptop but ended up mothballing it over the switch. It remains a perfect example of how cheaping out on an extremely minor component (a plastic slide-switch) can sabotage an otherwise fantastic product.

csydas 3y ago
Yes I used to run into these cards all the time in the past (maybe ancestors of the one from the article) but they were always a pain to deal with. I usually just recommended new wi-fi card if the card was showing these symptoms and i cannot recall anyone ever coming back with wi-fi complaints after that. but definitely if this trick would have worked i would have used it.
- numpad0 3y ago
  Wi-Fi cards do wear out and needs replacement, especially old ones. There was also a widespread manufacturing issue in some Wi-Fi/Bluetooth chipsets around 2007-2012, which had to do with amplifier SAW/BAW filter(?) that lead to rapid and thorough degradation in radio performance. I think at least Qualcomm did notify rather silently on B2B news channels but it wasn't communicated to the public.

5- 3y ago

a larger hardware fix for the x200/x201 is the x2100 upgrade (intel comet lake motherboard, nvme, up to 64gb ddr4, 13" 3000x2000 ips panel). see https://www.xyte.ch/mods/x210-x2100/ https://www.xyte.ch/mods/x210-x2100/ for an overview, although sadly the availability is diminishing (and the hardware is far from bleeding edge four years later) -- the above linked vendor is awol. i've got myself 2.5 x2100s, hoping that will tide me over until something new becomes available.

graphe 3y ago
Buying a new motherboard to replace the Thinkpad is hardly a fix. Otherwise I could 'fix' my Thinkpad x200 by buying a x230. You could make a case for the ship of Theseus but it's more like you are taking off the captains wheel and replacing the whole thing and calling it the same ship. I never got the appeal of those laptops either. It's not a Thinkpad, its an Chinese motherboard that is overpriced to get it working with a nice keyboard, and yet you'll still have to bend your neck to use it unless you're using the dock.
- justaj 3y ago
  I was going to say you'd also lose out on the Libreboot compatibility, but apparently X201 support was urgently removed from LB: https://libreboot.org/news/x201.html https://libreboot.org/news/x201.html
- 5- 3y ago
  even though i have the x2100 as a 'fix for x201', which would make sense in the context of the original post, for me it was just a new laptop purchase, and i have considered the x2100 on its own merits as a laptop i could get -- for me it was decent (i.e. non-chiclet) keyboard, trackpoint, good screen, and autonomy (plenty of disk, ram and battery).

tra3 3y ago

Wait so the kill switch is really just a suggestion that is then handled in the card”s firmware? I guess that’s how things like cameras status led is compromised?

w-ll 3y ago
Wait till you learn about Apple toggles
- Lammy 3y ago
  The ones that turn themselves back on at 3 AM so it can update itself whether you like it or not
numpad0 3y ago
No. I suggest you do skim the article. The author taped the switch readout pin (mPCIe pin 20) at the card side, and the card was so designed that it assumes the switch is set to not-kill when the switch is not present at all. We do not know how deep the mechanism goes within the card. It is only shown that the card do work if the pin is open.
- stavros 3y ago
  Which means that then the switch is _exactly_ "just a suggestion that is then handled in the card”s firmware". It doesn't cut the power to the card.
  - lagadu 3y ago
    We don't actually know that. It's possible that connecting that pin shorts some circuit on the card that prevents it from operating. I suspect you're right though.
    - sue_real 3y ago
      It's pretty much just a button, if it doesn't physically cuts power, I'd suggest. I think with billion dollar budget year after year, you pretty much go for firmware level attacks thees days. 0click 0day as-a-service is private economy and.. cheap and very different from what they want: long term backdoor access to everything, without the possiblility to spot it in user space or OS.

szundi 3y ago

I just imagine how that piece of tape will stick to the tiny pin in the socket and tears it out when the module is removed next time

ImPostingOnHN 3y ago
"Good" news!: if that happens, it will likely make the "fix" permanent!

deleted 3y ago

[deleted]

albert_e 3y ago

isn't there a simpler way to bypass the hardware switch ...like shorting the switch terminals on the inside to permanently leave it "on"?

parsimo2010 3y ago
The author mentioned that but didn’t know how to solder, so they chose this method instead. If they knew how to solder this would have been a different fix.

nyanpasu64 3y ago

It's possible that thinner kapton tape would be easier to cut into a narrow sliver and place over a pin, while having the card still fit in the socket without being too thick?

stzsch 3y ago
I recently performed this exact procedure on a wifi card and yes, kapton tape works better. Electrical tape tends to tear or slide.

zer0x4d 3y ago

My experience with ACPI is limited to tinkering with it a bit for installing macOS on unsupported systems, but shouldn't it be possible to avoid any physical modification and do the same with an SSDT that disables the power to the kill switch?

mjg59 3y ago
No, the kill switch is a literal electronic connection to the pin on the WiFi card that tells the firmware on that card to disable itself. ACPI may provide an alternative mechanism to trigger the same pin, but that doesn't mean ACPI can be modified to disable the physical switch. (What may actually be happening is that they switch is telling the embedded controller to toggle the WiFi card pin, in which case modifying the EC firmware might let you achieve the desired outcome, but that's still not an ACPI hack)

consumer451 3y ago

The following breaks my heart, as I love the ThinkPad keyboard, but it's just not worth it. If your work is sensitive in any way, this is what you can expect from Lenovo: > In February 2021, Bloomberg Businessweek reported that U.S. investigators found in 2008 that military units in Iraq were using Lenovo laptops in which the hardware had been altered. According to a testimony from the case in 2010, "A large amount of Lenovo laptops were sold to the U.S. military that had a chip encrypted on the motherboard that would record all the data that was being inputted into that laptop and send it back to China." [0] How is this company still allowed to do business in the USA? There are ThinkPads in the most important of places. Not just in government, but in research... There are apparently no adults in the room, so make your own decisions. [0] https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_incidents https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_in...

dzdt 3y ago
The Bloomberg story referenced in your [0] was refuted by pretty much everyone and independently confirmed by no one. See [1]. It was not retracted by the authors but the consensus seems to be it is intelligent speculation rather than confirmed fact. In particular the quote you pulled seems like a garbled and further exaggerated secondary source based on the unvalidated Bloomber article. Note the incorrect technical word usage ("encrypted" is not a correct verb to describe how a chip could be integrated into a motherboard design) and the implausible scope of the allegations (sending literally all data inputted to the laptop to China would be a large obvious datastream that would be quickly noticed and independently confirmed, which has not happened). [1] https://pxlnv.com/blog/one-year-after-big-hack/ https://pxlnv.com/blog/one-year-after-big-hack/
- consumer451 3y ago
  If that is indeed the case, you should update the Wikipedia entry which I quoted.
  - catach 3y ago
    The article's talk page already has a request for an impartial editor to weigh in, though several months old.

pengaru 3y ago

There are issues with trusting a pci attached wifi device running a pile of closed firmware anyways. If you're concerned about this type of thing discard the internal wifi card and use an usb-attached wifi dongle you can unplug to achieve a "wifi physically disconnected" state with certainty. The other advantage is whatever firmware's running on the wifi dongle isn't going to be potentially accessing host memory over usb, which a pci bus master could theoretically do.

Grepnux 3y ago

It’s an extremely comfy laptop. Still handles the modern web OK, especially if you use uMatrix to block third party garbage.