summaryrefslogtreecommitdiffstats
path: root/docs/howtos/x60_security.html
diff options
context:
space:
mode:
authorFrancis Rowe <info@gluglug.org.uk>2014-07-20 03:37:00 (EDT)
committer Michał Masłowski <mtjm@mtjm.eu>2014-08-22 13:15:07 (EDT)
commit488242eb941305ef61319b8499d4a1e8ccf218a1 (patch)
treeb0347f360df51ac5a8edd06068e7ae24510864d6 /docs/howtos/x60_security.html
parent8b484a19b51fb0591d938b3b7cf4fcb8f06c7a2f (diff)
downloadlibreboot-488242eb941305ef61319b8499d4a1e8ccf218a1.zip
libreboot-488242eb941305ef61319b8499d4a1e8ccf218a1.tar.gz
libreboot-488242eb941305ef61319b8499d4a1e8ccf218a1.tar.bz2
Libreboot release 6 beta 3.r20140720
- Fixed typo that existed in 2nd beta where the release date of the 2nd beta was listed as being in year 2016, when in actual fact it was 2014. - Documentation: added (preliminary) details about (rare) buggy CPU's on the ThinkPad T60 that were found to fail (instability, kernel panics, etc) without the microcode updates. - Documentation: added docs/howtos/x60_heatsink.html for showing how to change the heatsink on the Thinkpad X60 - Added ROM images for Azerty (French) keyboard layout in GRUB (courtesy of Olivier Mondoloni) - Tidied up some scripts: - Re-factored those scripts (made easier to read/maintain): build-x60, build-x60t, build-t60, build-macbook21 - Reduced the number of grub configs to 2 (or 1, for macbook21), the build scripts now generate the other configs at build time. - Deleted build-x60, build-x60t, build-t60, build-macbook21 and replaced with intelligent (generic) buildrom-withgrub script - Updated build to use buildrom-withgrub script for building the ROM images. - coreboot.rom and coreboot_serial.rom renamed to coreboot_usqwerty.rom and coreboot_serial_usqwerty.rom - coreboot_dvorak and coreboot_serial_dvorak.rom renamed to coreboot_usdvorak.rom and coreboot_serial_usdvorak.rom - Renamed coreboot*rom to libreboot*rom - Made flash, lenovobios_firstflash and lenovobios_secondflash scripts fail if the specified file does not exist. - Updated all relevant parts of the documentation to reflect the above. - Replaced background.png with background.jpg. added gnulove.jpg. (resources/grub/background/) - Updated buildrom-withgrub to use background.jpg instead of background.png - Updated buildrom-withgrub to use gnulove.jpg aswell - Updated resources/grub/config/macbook21/grub*cfg to use gnulove.jpg background. - Updated resources/grub/config/{x60,t60,x60t}/grub*cfg to use background.jpg background. - Documentation: updated docs/index.html#grub_custom_keyboard to be more generally useful. - nvramtool: - Updated builddeps-coreboot script to build it - Updated build script to include it in libreboot_bin - Documentation: added docs/howtos/x60_security.html (security hardening for X60)
Diffstat (limited to 'docs/howtos/x60_security.html')
-rw-r--r--docs/howtos/x60_security.html171
1 files changed, 171 insertions, 0 deletions
diff --git a/docs/howtos/x60_security.html b/docs/howtos/x60_security.html
new file mode 100644
index 0000000..fc9cb0b
--- /dev/null
+++ b/docs/howtos/x60_security.html
@@ -0,0 +1,171 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <meta charset="utf-8">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+
+ <style type="text/css">
+ body {
+ background:#fff;
+ color:#000;
+ font-family:sans-serif;
+ font-size:1em;
+ }
+ </style>
+
+ <title>Libreboot documentation: Security on the ThinkPad X60</title>
+</head>
+
+<body>
+
+ <header>
+ <h1>Security on the ThinkPad X60</h1>
+ <aside>Hardware modifications to enhance security on the ThinkPad X60. This tutorial is <b>incomplete</b> at the time of writing.</aside>
+ </header>
+
+ <p>Or go <a href="../index.html">back to main index</a></p>
+
+ <h2>Table of Contents</h2>
+ <ul>
+ <li><a href="#hardware_requirements">Hardware Requirements</a></li>
+ <li><a href="#software_requirements">Software Requirements</a></li>
+ <li><a href="#procedure">The procedure</a></li>
+ </ul>
+
+ <h1 id="hardware_requirements">Hardware requirements</h1>
+ <ul>
+ <li>An X60</li>
+ <li>screwdriver</li>
+ <li>(in a later version of this tutorial: soldering iron and scalpel)</li>
+ </ul>
+
+ <h1 id="software_requirements">Software requirements</h1>
+ <ul>
+ <li>none (at least in the scope of the article as-is)</li>
+ </ul>
+
+ <h1 id="procedure">Disassembly</h1>
+
+ <p>
+ Firstly remove the bluetooth (if your X60 has this):<br/>
+ The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):<br/>
+ <img src="x60_security/0000_bluetooth0.jpg" alt="" /><br/>
+ Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):<br/>
+ <img src="x60_security/0000_bluetooth.jpg" alt="" /><br/>
+ </p>
+
+ <p>
+ If your model was WWAN, remove the simcard (check anyway):<br/>
+ Uncover those 2 screws at the bottom:<br/>
+ <img src="x60_security/0000_simcard0.jpg" alt="" /><br/>
+ SIM card is in the marked location:<br/>
+ <img src="x60_security/0000_simcard1.jpg" alt="" /><br/>
+ Replacement: USB dongle.
+ </p>
+
+ <p>
+ Now get into the motherboard.
+ </p>
+
+ <p>
+ Remove those screws:<br/>
+ <img src="x60_security/0000.jpg" alt="" />
+ </p>
+ <p>
+ Push the keyboard forward (carefully):<br/>
+ <img src="x60_security/0001.jpg" alt="" />
+ </p>
+ <p>
+ Lift the keyboard up and disconnect it from the board:<br/>
+ <img src="x60_security/0002.jpg" alt="" />
+ </p>
+ <p>
+ Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:<br/>
+ <img src="x60_security/0003.jpg" alt="" />
+ </p>
+ <p>
+ You should now have this:<br/>
+ <img src="x60_security/0004.jpg" alt="" />
+ </p>
+
+ <p>
+ The following is a summary of what you will remove (already done to this machine):<br/>
+ <img src="x60_security/0001_overview.jpg" alt="" /><br/>
+ Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want
+ (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and
+ also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). <b>This is optional</b>
+ </p>
+
+ <p>
+ Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:<br/>
+ <img src="x60_security/0001_microphone.jpg" alt="" /><br/>
+ We do not know what the built-in microcode (on the CPU) is doing. The theory is that it could be programmed to take commands that do something
+ and then the CPU returns results. (meaning, remote security hole). So we remove it, just in case.<br/>
+ Replacement: external microphone on USB or line-in jack.
+ </p>
+
+ <p>
+ Remove the modem:<br/>
+ <img src="x60_security/0001_modem.jpg" alt="" /><br/>
+ (useless, obsolete device)
+ </p>
+
+ <p>
+ Remove the speaker:<br/>
+ <img src="x60_security/0001_speaker.jpg" alt="" /><br/>
+ Reason: combined with the microphone issue, this could be used to leak data.<br/>
+ Replacement: headphones/speakers (line-out) or external DAC (USB).
+ </p>
+
+ <p>
+ Remove the wlan (also remove wwan if you have it):<br/>
+ <img src="x60_security/0001_wlan_wwan.jpg" alt="" /><br/>
+ Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
+ </p>
+
+ <h2>
+ Not covered yet:
+ </h2>
+ <ul>
+ <li>Disable cardbus/pcmcia (has fast/direct memory access)</li>
+ <li>Disable firewire (has fast/direct memory access)</li>
+ <li>Disable flashing the ethernet firmware</li>
+ <li>Disable SPI flash writes (can be re-enabled by unsoldering two parts)</li>
+ <li>Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)</li>
+ <li>Disable docking station</li>
+ </ul>
+ <p>
+ Go to <a href="http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html">http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html</a>
+ or directly to the video: <a href="http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm">http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm</a>.
+ </p>
+ <p>
+ A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the abev.
+ </p>
+
+ <h2>
+ Also not covered yet:
+ </h2>
+ <ul>
+ <li>
+ Intrusion detection: randomized seal on screws (need to research)
+ </li>
+ <li>
+ Tips about preventing/mitigating risk of cold boot attack.
+ </li>
+ <li>
+ Software-based security hardening (GRUB trust/cryptomount, kernel LUKS/ecryptfs, etc).
+ </li>
+ <li>
+ General tips/advice and web links showing how to detect physical intrusions.
+ </li>
+ </ul>
+
+<hr/>
+
+ <p>
+ Copyright &copy; 2014 Francis Rowe, All Rights Reserved.<br/>
+ See <a href="../license.html">../license.html</a> for license conditions.
+ </p>
+
+</body>
+</html>
generated by cgit v0.9.1 at 2024-11-15 07:01:00 (EST)