Date: Wed, 04 Feb 2015 04:14:49 -0500 Subject: Documentation: implement theme, drastically improve readability --- (limited to 'docs/security') diff --git a/docs/security/dock.html b/docs/security/dock.html index 30f23d5..b2fdc7e 100644 --- a/docs/security/dock.html +++ b/docs/security/dock.html @@ -5,17 +5,18 @@ Notes about DMA and the docking station (X60/T60) -

Notes about DMA and the docking station (X60/T60)

+ +

 
 Use case:
@@ -135,20 +136,23 @@ added too?
 > trough nvram.

- -

- Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
- This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at ../license.txt. -

- -

- This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. -

+ +

+ Copyright © 2014, 2015 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

+ +

+ This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

+ +

diff --git a/docs/security/index.html b/docs/security/index.html index 64008b8..73ced45 100644 --- a/docs/security/index.html +++ b/docs/security/index.html @@ -13,28 +13,32 @@ -

Security topics

+ Or Back to main index. +

+ +

- Or Back to main index. + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information.

- -

+ +

diff --git a/docs/security/t60_security.html b/docs/security/t60_security.html index 279d301..ad07878 100644 --- a/docs/security/t60_security.html +++ b/docs/security/t60_security.html @@ -13,283 +13,288 @@ -

Security on the ThinkPad T60

- -

Or go back to main index

- -

Hardware Requirements
Software Requirements
The procedure

- -

Hardware requirements

A T60
screwdriver
Rubbing or isopropyl alcohol, and thermal compound.
(in a later version of this tutorial: soldering iron and scalpel)

- -

Software requirements

none (at least in the scope of the article as-is)
You probably want to encrypt your GNU/Linux install using LUKS

- -

- Rationale -

- Most people think of security on the software side: the hardware is important aswell. - work. -

- This tutorial deals with reducing the number of devices that have direct memory access that - could communicate with inputs/outputs that could be used to remotely - command the machine (or leak data). All of this is purely theoretical for the time being. -

Hardware modifications to enhance security on the ThinkPad T60. This tutorial is incomplete at the time of writing.

Back to previous index

+ -

Disassembly

Hardware Requirements
Software Requirements
The procedure

Hardware requirements

A T60
screwdriver
Rubbing or isopropyl alcohol, and thermal compound.
(in a later version of this tutorial: soldering iron and scalpel)

Software requirements

none (at least in the scope of the article as-is)
You probably want to encrypt your GNU/Linux install using LUKS

- Remove those screws and remove the HDD:
- -

+ Rationale +

+ Most people think of security on the software side: the hardware is important aswell. +

+ This tutorial deals with reducing the number of devices that have direct memory access that + could communicate with inputs/outputs that could be used to remotely + command the machine (or leak data). All of this is purely theoretical for the time being. +

- Lift off the palm rest:
- -

- Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
- -

Disassembly

- Gently wedge both sides loose:
- -

+ Remove those screws and remove the HDD:
+ +

- Remove that cable from the position:
- -

+ Lift off the palm rest:
+ +

- Now remove that bezel. Remove wifi, nvram battery and speaker connector (also remove 56k modem, on the left of wifi):
-
- Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
- Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have - access to the computer's RAM trough DMA. If people have an intel - card(most T60 laptops come with Intel wifi by default, until you change it),then that card runs - a non-free firwamre and has access to the computer's RAM trough DMA! So - the risk-level is very high. -

+ Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
+ +

- Remove those screws:
- -

+ Gently wedge both sides loose:
+ +

- Disconnect the power jack:
- -

+ Remove that cable from the position:
+ +

- Remove nvram battery (we will put it back later):
- -

+ Now remove that bezel. Remove wifi, nvram battery and speaker connector (also remove 56k modem, on the left of wifi):
+
+ Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
+ Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have + access to the computer's RAM trough DMA. If people have an intel + card(most T60 laptops come with Intel wifi by default, until you change it),then that card runs + a non-free firwamre and has access to the computer's RAM trough DMA! So + the risk-level is very high. +

- Disconnect cable (for 56k modem) and disconnect the other cable:
- -

+ Remove those screws:
+ +

- Disconnect speaker cable:
- -

+ Disconnect the power jack:
+ +

- Disconnect the other end of the 56k modem cable:
- -

+ Remove nvram battery (we will put it back later):
+ +

- Make sure you removed it:
- -

+ Disconnect cable (for 56k modem) and disconnect the other cable:
+ +

- Unscrew those:
- -

+ Disconnect speaker cable:
+ +

- Make sure you removed those:
- -

+ Disconnect the other end of the 56k modem cable:
+ +

- Disconnect LCD cable from board:
- -

+ Make sure you removed it:
+ +

- Remove those screws then remove the LCD assembly:
- -

+ Unscrew those:
+ +

- Once again, make sure you removed those:
- -

+ Make sure you removed those:
+ +

- Remove the shielding containing the motherboard, then flip it over. Remove these screws, placing them on a steady - surface in the same layout as they were in before you removed them. Also, you should mark each screw hole after removing the - screw (a permanent marker pen will do), this is so that you have a point of reference when re-assembling the machine:
- - -

+ Disconnect LCD cable from board:
+ +

- Remove microphone (soldering iron not needed. Just wedge it out gently):
-
- Rationale:
- Another reason to remove the microphone: If your computer gets[1] compromised, it can - record what you say, and use it to receive data from nearby devices if - they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically - be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, - the machine could already be compromised from the factory. -

+ Remove those screws then remove the LCD assembly:
+ +

- Remove infrared:
- -

+ Once again, make sure you removed those:
+ +

- Remove cardbus (it's in a socket, no need to disable. Just remove the port itself):
-
- Rationale:
- It has direct memory access and can be used to extract sensitive details (such as LUKS keys). See - 'GoodBIOS' video linked at the end (speaker is Peter Stuge, a coreboot hacker). The video covers X60 - but the same topics apply to T60. -

+ Remove the shielding containing the motherboard, then flip it over. Remove these screws, placing them on a steady + surface in the same layout as they were in before you removed them. Also, you should mark each screw hole after removing the + screw (a permanent marker pen will do), this is so that you have a point of reference when re-assembling the machine:
+ + +

- Before re-installing the upper chassis, remove the speaker:
-
- Reason: combined with the microphone issue, this could be used to leak data.
- If your computer gets[1] compromised, it can be used to - transmit data to nearby compromised devices. It's unknown if it can be - turned into a microphone[2].
- Replacement: headphones/speakers (line-out) or external DAC (USB). -

+ Remove microphone (soldering iron not needed. Just wedge it out gently):
+
+ Rationale:
+ Another reason to remove the microphone: If your computer gets[1] compromised, it can + record what you say, and use it to receive data from nearby devices if + they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically + be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, + the machine could already be compromised from the factory. +

- Remove the wwan:
-
- Wwan (3d modem): They run proprietary software and have access to the - computer's RAM! So it's like AMT but over the GSM network which is - probably even worse.
- Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). -

+ Remove infrared:
+ +

- This is where the simcard connector is soldered. See notes above about wwan. Remove simcard by removing battery - and then it's accessible (so, remember to do this when you re-assemble. or you could do it now?)
- -

+ Remove cardbus (it's in a socket, no need to disable. Just remove the port itself):
+
+ Rationale:
+ It has direct memory access and can be used to extract sensitive details (such as LUKS keys). See + 'GoodBIOS' video linked at the end (speaker is Peter Stuge, a coreboot hacker). The video covers X60 + but the same topics apply to T60. +

- Put those screws back:
- -

+ Before re-installing the upper chassis, remove the speaker:
+
+ Reason: combined with the microphone issue, this could be used to leak data.
+ If your computer gets[1] compromised, it can be used to + transmit data to nearby compromised devices. It's unknown if it can be + turned into a microphone[2].
+ Replacement: headphones/speakers (line-out) or external DAC (USB). +

- Put it back into lower chassis:
- -

+ Remove the wwan:
+
+ Wwan (3d modem): They run proprietary software and have access to the + computer's RAM! So it's like AMT but over the GSM network which is + probably even worse.
+ Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). +

- Attach LCD and insert screws (also, attach the lcd cable to the board):
- -

+ This is where the simcard connector is soldered. See notes above about wwan. Remove simcard by removing battery + and then it's accessible (so, remember to do this when you re-assemble. or you could do it now?)
+ +

- Insert those screws:
- -

+ Put those screws back:
+ +

- On the CPU (and there is another chip south-east to it, sorry forgot to take pic) - clean off the old thermal paste (with the alcohol) and apply new (Artic Silver 5 is good, others are good too) - you should also clean the heatsink the same way
- -

+ Put it back into lower chassis:
+ +

- Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
- -

+ Attach LCD and insert screws (also, attach the lcd cable to the board):
+ +

- Reinstall that upper bezel:
- -

+ Insert those screws:
+ +

- Do that:
- -

+ On the CPU (and there is another chip south-east to it, sorry forgot to take pic) + clean off the old thermal paste (with the alcohol) and apply new (Artic Silver 5 is good, others are good too) + you should also clean the heatsink the same way
+ +

- Attach keyboard and install nvram battery:
- -

+ Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
+ +

- Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
- -

+ Reinstall that upper bezel:
+ +

- Remove those covers and unscrew:
- -

+ Do that:
+ +

- Gently pry off the front bezel (sorry, forgot to take pics). -

+ Attach keyboard and install nvram battery:
+ +

- Remove bluetooth module:
- -

+ Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
+ +

- Re-attach the front bezel and re-insert the screws (sorry, forgot to take pics). -

+ Remove those covers and unscrew:
+ +

- It lives!
- -

+ Gently pry off the front bezel (sorry, forgot to take pics). +

- Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
- -

+ Remove bluetooth module:
+ +

+ +

+ Re-attach the front bezel and re-insert the screws (sorry, forgot to take pics). +

+ +

+ It lives!
+ +

+ +

+ Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
+ +

+ +

Not covered yet:

@@ -306,7 +311,9 @@

A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above.

Also not covered yet:

@@ -339,91 +346,108 @@ https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: +

- Extra notes -

- EC: Cannot be removed but can be mitigated: it contains non-free - non-loadable code, but it has no access to the computer's RAM. - It has access to the on-switch of the wifi, bluetooth, modem and some - other power management features. The issue is that it has access to the - keyboard, however if the software security howto (not yet written) is followed correctly, - it won't be able to leak data to a local attacker. It has no network - access but it may still be able to leak data remotely, but that - requires someone to be nearby to recover the data with the help of an - SDR and some directional antennas[3]. -

- Intel 82573 Ethernet controller - on the X60 seems safe, according to Denis. -

+ Extra notes +

+ EC: Cannot be removed but can be mitigated: it contains non-free + non-loadable code, but it has no access to the computer's RAM. + It has access to the on-switch of the wifi, bluetooth, modem and some + other power management features. The issue is that it has access to the + keyboard, however if the software security howto (not yet written) is followed correctly, + it won't be able to leak data to a local attacker. It has no network + access but it may still be able to leak data remotely, but that + requires someone to be nearby to recover the data with the help of an + SDR and some directional antennas[3]. +

+ Intel 82573 Ethernet controller + on the X60 seems safe, according to Denis. +

- Risk level -

+ Risk level +

Modem (3g/wwan): highest
Intel wifi: Near highest
Atheros PCI wifi: unknown, but lower than intel wifi.
Microphone: only problematic if the computer gets compromised.
Speakers: only problematic if the computer gets compromised.
EC: can be mitigated if following the guide on software security.

+ +

+ Further reading material (software security) +

Modem (3g/wwan): highest
Intel wifi: Near highest
Atheros PCI wifi: unknown, but lower than intel wifi.
Microphone: only problematic if the computer gets compromised.
Speakers: only problematic if the computer gets compromised.
EC: can be mitigated if following the guide on software security.
Installing Trisquel GNU/Linux with full disk encryption (including /boot)
Installing Parabola GNU/Linux with full disk encryption (including /boot)
Notes about DMA access and the docking station

- -

- Further reading material (software security) -

- -

- References -

[1] physical access

- Explain that black hats, TAO, and so on might use a 0day to get in, - and explain that in this case it mitigates what the attacker can do. - Also the TAO do some evaluation before launching an attack: they take - the probability of beeing caught into account, along with the kind of - target. A 0day costs a lot of money, I heard that it was from 100000$ - to 400000$, some other websites had prices 10 times lower but that - but it was probably a typo. So if people increase their security it - makes it more risky and more costly to attack people. -

[2] microphone

- It's possible to turn headphones into a microphone, you could try - yourself, however they don't record loud at all. Also intel cards have - the capability to change a connector's function, for instance the - microphone jack can now become a headphone plug, that's called - retasking. There is some support for it in GNU/Linux but it's not very - well known. -

[3] Video (CCC)

- 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While - their demo is experimental(their hardware also got damaged during the - transport), the spies probably already have that since a long time. - http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm -

- -

+ +

+ References +

[1] physical access

+ Explain that black hats, TAO, and so on might use a 0day to get in, + and explain that in this case it mitigates what the attacker can do. + Also the TAO do some evaluation before launching an attack: they take + the probability of beeing caught into account, along with the kind of + target. A 0day costs a lot of money, I heard that it was from 100000$ + to 400000$, some other websites had prices 10 times lower but that + but it was probably a typo. So if people increase their security it + makes it more risky and more costly to attack people. +

[2] microphone

+ It's possible to turn headphones into a microphone, you could try + yourself, however they don't record loud at all. Also intel cards have + the capability to change a connector's function, for instance the + microphone jack can now become a headphone plug, that's called + retasking. There is some support for it in GNU/Linux but it's not very + well known. +

[3] Video (CCC)

+ 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While + their demo is experimental(their hardware also got damaged during the + transport), the spies probably already have that since a long time. + http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm +

+ +

diff --git a/docs/security/x60_security.html b/docs/security/x60_security.html index c87c581..7b524c7 100644 --- a/docs/security/x60_security.html +++ b/docs/security/x60_security.html @@ -13,277 +13,301 @@ -

Security on the ThinkPad X60

- -

Hardware modifications to enhance security on the ThinkPad X60. This tutorial is incomplete at the time of writing.

Back to previous index

+ -

Or go back to main index

Hardware Requirements
Software Requirements
The procedure

Hardware Requirements
Software Requirements
The procedure

+ +

Hardware requirements

An X60
screwdriver
(in a later version of this tutorial: soldering iron and scalpel)

Hardware requirements

An X60
screwdriver
(in a later version of this tutorial: soldering iron and scalpel)

Software requirements

none (at least in the scope of the article as-is)
You probably want to encrypt your GNU/Linux install using LUKS

+ +

Software requirements

none (at least in the scope of the article as-is)
You probably want to encrypt your GNU/Linux install using LUKS

- Rationale -

- Most people think of security on the software side: the hardware is important aswell. - work. -

+ Rationale +

+ Most people think of security on the software side: the hardware is important aswell. +

Disassembly

- Firstly remove the bluetooth (if your X60 has this):
- The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):
-
- Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):
-
-

+ Firstly remove the bluetooth (if your X60 has this):
+ The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):
+
+ Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):
+
+

- If your model was WWAN, remove the simcard (check anyway):
- Uncover those 2 screws at the bottom:
-
- SIM card (not present in the picture) is in the marked location:
-
- Replacement: USB dongle. -

+ If your model was WWAN, remove the simcard (check anyway):
+ Uncover those 2 screws at the bottom:
+
+ SIM card (not present in the picture) is in the marked location:
+
+ Replacement: USB dongle. +

- Now get into the motherboard. -

+ Now get into the motherboard. +

- Remove those screws:
- -

- Push the keyboard forward (carefully):
- -

- Lift the keyboard up and disconnect it from the board:
- -

- Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
- -

- You should now have this:
- -

+ Remove those screws:
+ +

+ Push the keyboard forward (carefully):
+ +

+ Lift the keyboard up and disconnect it from the board:
+ +

+ Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
+ +

+ You should now have this:
+ +

- The following is a summary of what you will remove (already done to this machine):
-
- Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want - (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and - also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). This is optional -

+ The following is a summary of what you will remove (already done to this machine):
+
+ Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want + (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and + also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). This is optional +

- Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:
-
- Rationale:
- Another reason to remove the microphone: If your computer gets[1] compromised, it can - record what you say, and use it to receive data from nearby devices if - they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically - be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, - the machine could already be compromised from the factory. -

+ Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:
+
+ Rationale:
+ Another reason to remove the microphone: If your computer gets[1] compromised, it can + record what you say, and use it to receive data from nearby devices if + they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically + be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, + the machine could already be compromised from the factory. +

- Remove the modem:
-
- (useless, obsolete device) -

+ Remove the modem:
+
+ (useless, obsolete device) +

- Remove the speaker:
-
- Reason: combined with the microphone issue, this could be used to leak data.
- If your computer gets[1] compromised, it can be used to - transmit data to nearby compromised devices. It's unknown if it can be - turned into a microphone[2].
- Replacement: headphones/speakers (line-out) or external DAC (USB). -

+ Remove the speaker:
+
+ Reason: combined with the microphone issue, this could be used to leak data.
+ If your computer gets[1] compromised, it can be used to + transmit data to nearby compromised devices. It's unknown if it can be + turned into a microphone[2].
+ Replacement: headphones/speakers (line-out) or external DAC (USB). +

- Remove the wlan (also remove wwan if you have it):
-
- Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
- Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have - access to the computer's RAM trough DMA. If people have an intel - card(most X60s come with Intel wifi by default, until you change it),then that card runs - a non-free firwamre and has access to the computer's RAM trough DMA! So - the risk-level is very high.
- Wwan (3d modem): They run proprietary software and have access to the - computer's RAM! So it's like AMT but over the GSM network which is - probably even worse.
- Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). -

+ Remove the wlan (also remove wwan if you have it):
+
+ Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
+ Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have + access to the computer's RAM trough DMA. If people have an intel + card(most X60s come with Intel wifi by default, until you change it),then that card runs + a non-free firwamre and has access to the computer's RAM trough DMA! So + the risk-level is very high.
+ Wwan (3d modem): They run proprietary software and have access to the + computer's RAM! So it's like AMT but over the GSM network which is + probably even worse.
+ Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). +

- Not covered yet: -

Disable cardbus (has fast/direct memory access)
Disable firewire (has fast/direct memory access)
Disable flashing the ethernet firmware
Disable SPI flash writes (can be re-enabled by unsoldering two parts)
Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)
Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)

+ Not covered yet: +

Disable cardbus (has fast/direct memory access)
Disable firewire (has fast/direct memory access)
Disable flashing the ethernet firmware
Disable SPI flash writes (can be re-enabled by unsoldering two parts)
Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)
Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)

+ Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html + or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. +

+ A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. +

+ +

+ Also not covered yet: +

+ Intrusion detection: randomized seal on screws
+ Just put nail polish with lot of glider on the important screws, take + some good pictures. Keep the pictueres and make sure of their integrity. + Compare the nail polish with the pictures before powering on the laptop. +
+ Tips about preventing/mitigating risk of cold boot attack. +
- soldered RAM?
- seal RAM door shut (possibly modified lower chassis) so that system has to be disassembled (which has to go through the nail polish)
- wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)
- ask gnutoo about fallback patches (counts number of boots)
+
+ General tips/advice and web links showing how to detect physical intrusions. +
+ For example: http://cs.tau.ac.il/~tromer/acoustic/ + or http://cyber.bgu.ac.il/content/how-leak-sensitive-data-isolated-computer-air-gap-near-mobile-phone-airhopper. +
+ https://en.wikipedia.org/wiki/Tempest_%28codename%29 +
+ https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: +

+ +

+ Extra notes +

- Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html - or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. + EC: Cannot be removed but can be mitigated: it contains non-free + non-loadable code, but it has no access to the computer's RAM. + It has access to the on-switch of the wifi, bluetooth, modem and some + other power management features. The issue is that it has access to the + keyboard, however if the software security howto (not yet written) is followed correctly, + it won't be able to leak data to a local attacker. It has no network + access but it may still be able to leak data remotely, but that + requires someone to be nearby to recover the data with the help of an + SDR and some directional antennas[3].

- A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. + Intel 82573 Ethernet controller + on the X60 seems safe, according to Denis.

- Also not covered yet: -

- Intrusion detection: randomized seal on screws
- Just put nail polish with lot of glider on the important screws, take - some good pictures. Keep the pictueres and make sure of their integrity. - Compare the nail polish with the pictures before powering on the laptop. -
- Tips about preventing/mitigating risk of cold boot attack. +
+
+ Risk level +
- soldered RAM?
- seal RAM door shut (possibly modified lower chassis) so that system has to be disassembled (which has to go through the nail polish)
- wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)
- ask gnutoo about fallback patches (counts number of boots)
- Modem (3g/wwan): highest
- Intel wifi: Near highest
- Atheros PCI wifi: unknown, but lower than intel wifi.
- Microphone: only problematic if the computer gets compromised.
- Speakers: only problematic if the computer gets compromised.
- EC: can be mitigated if following the guide on software security.
-
- General tips/advice and web links showing how to detect physical intrusions. -
- For example: http://cs.tau.ac.il/~tromer/acoustic/ - or http://cyber.bgu.ac.il/content/how-leak-sensitive-data-isolated-computer-air-gap-near-mobile-phone-airhopper. -
- https://en.wikipedia.org/wiki/Tempest_%28codename%29 -
- https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: -

+ -

- Extra notes -

- Intel 82573 Ethernet controller - on the X60 seems safe, according to Denis. -

- -

- Risk level -

+ Further reading material (software security) +

Modem (3g/wwan): highest
Intel wifi: Near highest
Atheros PCI wifi: unknown, but lower than intel wifi.
Microphone: only problematic if the computer gets compromised.
Speakers: only problematic if the computer gets compromised.
EC: can be mitigated if following the guide on software security.
Installing Trisquel GNU/Linux with full disk encryption (including /boot)
Installing Parabola GNU/Linux with full disk encryption (including /boot)
Notes about DMA access and the docking station

- Further reading material (software security) -

+ References +

[1] physical access

[2] microphone

[3] Video (CCC)

- References -

[1] physical access

[2] microphone

[3] Video (CCC)

- -

+ +

-- cgit v0.9.1

Security topics

Security topics

Table of Contents

Hardware requirements

Software requirements

- Rationale -

Disassembly

Table of Contents

Hardware requirements

Software requirements

+ Rationale +

Disassembly

Not covered yet:

Also not covered yet:

- Extra notes -

+ Extra notes +

- Risk level -

+ Risk level +

+ Further reading material (software security) +

- Further reading material (software security) -

- References -

[1] physical access

[2] microphone

[3] Video (CCC)

+ References +

[1] physical access

[2] microphone

[3] Video (CCC)

Table of Contents

Table of Contents

Hardware requirements

Hardware requirements

Software requirements

Software requirements

- Rationale -

+ Rationale +

Disassembly

Disassembly

- Not covered yet: -

+ Not covered yet: +

+ Also not covered yet: +

+ Extra notes +

- Also not covered yet: -

+ Risk level +

- Extra notes -

- Risk level -

+ Further reading material (software security) +

- Further reading material (software security) -

+ References +

[1] physical access

[2] microphone

[3] Video (CCC)

- References -

[1] physical access

[2] microphone

[3] Video (CCC)