From 488242eb941305ef61319b8499d4a1e8ccf218a1 Mon Sep 17 00:00:00 2001 From: Francis Rowe Date: Sun, 20 Jul 2014 03:37:00 -0400 Subject: Libreboot release 6 beta 3. - Fixed typo that existed in 2nd beta where the release date of the 2nd beta was listed as being in year 2016, when in actual fact it was 2014. - Documentation: added (preliminary) details about (rare) buggy CPU's on the ThinkPad T60 that were found to fail (instability, kernel panics, etc) without the microcode updates. - Documentation: added docs/howtos/x60_heatsink.html for showing how to change the heatsink on the Thinkpad X60 - Added ROM images for Azerty (French) keyboard layout in GRUB (courtesy of Olivier Mondoloni) - Tidied up some scripts: - Re-factored those scripts (made easier to read/maintain): build-x60, build-x60t, build-t60, build-macbook21 - Reduced the number of grub configs to 2 (or 1, for macbook21), the build scripts now generate the other configs at build time. - Deleted build-x60, build-x60t, build-t60, build-macbook21 and replaced with intelligent (generic) buildrom-withgrub script - Updated build to use buildrom-withgrub script for building the ROM images. - coreboot.rom and coreboot_serial.rom renamed to coreboot_usqwerty.rom and coreboot_serial_usqwerty.rom - coreboot_dvorak and coreboot_serial_dvorak.rom renamed to coreboot_usdvorak.rom and coreboot_serial_usdvorak.rom - Renamed coreboot*rom to libreboot*rom - Made flash, lenovobios_firstflash and lenovobios_secondflash scripts fail if the specified file does not exist. - Updated all relevant parts of the documentation to reflect the above. - Replaced background.png with background.jpg. added gnulove.jpg. (resources/grub/background/) - Updated buildrom-withgrub to use background.jpg instead of background.png - Updated buildrom-withgrub to use gnulove.jpg aswell - Updated resources/grub/config/macbook21/grub*cfg to use gnulove.jpg background. - Updated resources/grub/config/{x60,t60,x60t}/grub*cfg to use background.jpg background. - Documentation: updated docs/index.html#grub_custom_keyboard to be more generally useful. - nvramtool: - Updated builddeps-coreboot script to build it - Updated build script to include it in libreboot_bin - Documentation: added docs/howtos/x60_security.html (security hardening for X60) --- (limited to 'docs/howtos/x60_security.html') diff --git a/docs/howtos/x60_security.html b/docs/howtos/x60_security.html new file mode 100644 index 0000000..fc9cb0b --- /dev/null +++ b/docs/howtos/x60_security.html @@ -0,0 +1,171 @@ + + + + + + + + + Libreboot documentation: Security on the ThinkPad X60 + + + + +
+

Security on the ThinkPad X60

+ +
+ +

Or go back to main index

+ +

Table of Contents

+ + +

Hardware requirements

+ + +

Software requirements

+ + +

Disassembly

+ +

+ Firstly remove the bluetooth (if your X60 has this):
+ The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):
+
+ Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):
+
+

+ +

+ If your model was WWAN, remove the simcard (check anyway):
+ Uncover those 2 screws at the bottom:
+
+ SIM card is in the marked location:
+
+ Replacement: USB dongle. +

+ +

+ Now get into the motherboard. +

+ +

+ Remove those screws:
+ +

+

+ Push the keyboard forward (carefully):
+ +

+

+ Lift the keyboard up and disconnect it from the board:
+ +

+

+ Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
+ +

+

+ You should now have this:
+ +

+ +

+ The following is a summary of what you will remove (already done to this machine):
+
+ Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want + (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and + also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). This is optional +

+ +

+ Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:
+
+ We do not know what the built-in microcode (on the CPU) is doing. The theory is that it could be programmed to take commands that do something + and then the CPU returns results. (meaning, remote security hole). So we remove it, just in case.
+ Replacement: external microphone on USB or line-in jack. +

+ +

+ Remove the modem:
+
+ (useless, obsolete device) +

+ +

+ Remove the speaker:
+
+ Reason: combined with the microphone issue, this could be used to leak data.
+ Replacement: headphones/speakers (line-out) or external DAC (USB). +

+ +

+ Remove the wlan (also remove wwan if you have it):
+
+ Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel. +

+ +

+ Not covered yet: +

+ +

+ Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html + or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. +

+

+ A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the abev. +

+ +

+ Also not covered yet: +

+ + +
+ +

+ Copyright © 2014 Francis Rowe, All Rights Reserved.
+ See ../license.html for license conditions. +

+ + + -- cgit v0.9.1