Documentation: *major* cleanup.

Cleanup was long overdue. Old structure was messy and inefficient.
author: Francis Rowe <info@gluglug.org.uk> 2014-11-05 20:52:36 (EST)
committer: Francis Rowe <info@gluglug.org.uk> 2014-11-05 20:52:36 (EST)
commit: 8b2219bfa2da36e7809588ef723a10483a6e137f (patch)
tree: 8c4d74b9efbdabc1a2604b8cbd508c006c225241 /docs/security/x60_security.html
parent: 7429bdcdbb4fc51c61897115112468642afeecfc (diff)
download: libreboot-8b2219bfa2da36e7809588ef723a10483a6e137f.zip
libreboot-8b2219bfa2da36e7809588ef723a10483a6e137f.tar.gz
libreboot-8b2219bfa2da36e7809588ef723a10483a6e137f.tar.bz2
1 files changed, 301 insertions, 0 deletions
diff --git a/docs/security/x60_security.html b/docs/security/x60_security.html
new file mode 100644
index 0000000..33ccb6d
--- /dev/null
+++ b/docs/security/x60_security.html
@@ -0,0 +1,301 @@
+<!DOCTYPE html>
+<html>
+<head>
+	<meta charset="utf-8">
+	<meta name="viewport" content="width=device-width, initial-scale=1">
+
+	<style type="text/css">
+		@import url('../css/main.css');
+	</style>
+
+	<title>Libreboot documentation: Security on the ThinkPad X60</title>
+</head>
+
+<body>
+
+	<header>
+		<h1>Security on the ThinkPad X60</h1>
+		<aside>Hardware modifications to enhance security on the ThinkPad X60. This tutorial is <b>incomplete</b> at the time of writing.</aside>
+	</header>
+
+	<p>Or go <a href="index.html">back to main index</a></p>
+
+	<h2>Table of Contents</h2>
+		<ul>
+			<li><a href="#hardware_requirements">Hardware Requirements</a></li>
+			<li><a href="#software_requirements">Software Requirements</a></li>
+			<li><a href="#procedure">The procedure</a></li>
+		</ul>
+
+	<h1 id="hardware_requirements">Hardware requirements</h1>
+		<ul>
+			<li>An X60</li>
+			<li>screwdriver</li>
+			<li>(in a later version of this tutorial: soldering iron and scalpel)</li>
+		</ul>
+
+	<h1 id="software_requirements">Software requirements</h1>
+		<ul>
+			<li>none (at least in the scope of the article as-is)</li>
+			<li>You probably want to encrypt your GNU/Linux install using LUKS</li>
+		</ul>
+
+	<h1>
+		Rationale
+	</h1>
+		<p>
+			Most people think of security on the software side: the hardware is important aswell.
+			Hardware security is useful in particular to journalists (or activists in a given movement) who need absolute privacy in their work.
+			It is also generally useful to all those that believe security and privacy are inalienable rights.
+			Security starts with the hardware; crypto and network security come later.
+		</p>
+		<p>
+			Paradoxically, going this far to increase your security also makes you a bigger target.
+			At the same time, it protects you in the case that someone does attack your machine.
+			This paradox only exists while few people take adequate steps to protect yourself: it is your <b>duty</b>
+			to protect yourself, not only for your benefit but to make strong security <i>normal</i> so
+			that those who do need protection (and claim it) are a smaller target against the masses.
+		</p>
+		<p>
+			Even if there are levels of security beyond your ability (technically, financially and so on)
+			doing at least <i>something</i> (what you are able to do) is extremely important.
+			If you use the internet and your computer without protection, attacking you is cheap (some say it is
+			only a few US cents). If everyone (majority of people) use strong security by default,
+			it makes attacks more costly and time consuming; in effect, making them disappear.
+		</p>
+		<p>
+			This tutorial deals with reducing the number of devices that have direct memory access that
+			could communicate with inputs/outputs that could be used to remotely
+			command the machine (or leak data).
+		</p>
+
+	<h1 id="procedure">Disassembly</h1>
+
+		<p>
+			Firstly remove the bluetooth (if your X60 has this):<br/>
+			The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):<br/>
+			<img src="../images/x60_security/0000_bluetooth0.jpg" alt="" /><br/>
+			Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):<br/>
+			<img src="../images/x60_security/0000_bluetooth.jpg" alt="" /><br/>
+		</p>
+
+		<p>
+			If your model was WWAN, remove the simcard (check anyway):<br/>
+			Uncover those 2 screws at the bottom:<br/>
+			<img src="../images/x60_security/0000_simcard0.jpg" alt="" /><br/>
+			SIM card (not present in the picture) is in the marked location:<br/>
+			<img src="../images/x60_security/0000_simcard1.jpg" alt="" /><br/>
+			Replacement: USB dongle.
+		</p>
+
+		<p>
+			Now get into the motherboard.
+		</p>
+
+		<p>
+			Remove those screws:<br/>
+			<img src="../images/x60_security/0000.jpg" alt="" />
+		</p>
+		<p>
+			Push the keyboard forward (carefully):<br/>
+			<img src="../images/x60_security/0001.jpg" alt="" />
+		</p>
+		<p>
+			Lift the keyboard up and disconnect it from the board:<br/>
+			<img src="../images/x60_security/0002.jpg" alt="" />
+		</p>
+		<p>
+			Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:<br/>
+			<img src="../images/x60_security/0003.jpg" alt="" />
+		</p>
+		<p>
+			You should now have this:<br/>
+			<img src="../images/x60_security/0004.jpg" alt="" />
+		</p>
+
+		<p>
+			The following is a summary of what you will remove (already done to this machine):<br/>
+			<img src="../images/x60_security/0001_overview.jpg" alt="" /><br/>
+			Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want
+			(to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and
+			also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). <b>This is optional</b>
+		</p>
+
+		<p>
+			Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:<br/>
+			<img src="../images/x60_security/0001_microphone.jpg" alt="" /><br/>
+			<b>Rationale:</b><br/>
+			Another reason to remove the microphone: If your computer gets<a href="#ref1">[1]</a> compromised, it can
+			record what you say, and use it to receive data from nearby devices if
+			they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically
+			be programmed to accept remote commands from some speaker somewhere (remote security hole). <b>In other words,
+			the machine could already be compromised from the factory.</b>
+		</p>
+
+		<p>
+			Remove the modem:<br/>
+			<img src="../images/x60_security/0001_modem.jpg" alt="" /><br/>
+			(useless, obsolete device)
+		</p>
+
+		<p>
+			Remove the speaker:<br/>
+			<img src="../images/x60_security/0001_speaker.jpg" alt="" /><br/>
+			Reason: combined with the microphone issue, this could be used to leak data.<br/>
+			If your computer gets<a href="#ref1">[1]</a> compromised, it can be used to
+			transmit data to nearby compromised devices. It's unknown if it can be
+			turned into a microphone<a href="#ref2">[2]</a>.<br/>
+			Replacement: headphones/speakers (line-out) or external DAC (USB).
+		</p>
+
+		<p>
+			Remove the wlan (also remove wwan if you have it):<br/>
+			<img src="../images/x60_security/0001_wlan_wwan.jpg" alt="" /><br/>
+			Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.<br/>
+			<b>Wifi:</b> The ath5k/ath9k cards might not have firmware at all. They might safe but could have
+			access to the computer's RAM trough DMA. If people have an intel
+			card(most X60's come with Intel wifi by default, until you change it),then that card runs
+			a non-free firwamre and has access to the computer's RAM trough DMA! So
+			it's risk-level is very high.<br/>
+			<b>Wwan (3d modem):</b> They run proprietary software and have access to the
+			computer's RAM! So it's like AMT but over the GSM network which is
+			probably even worse.<br/>
+			Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended).
+		</p>	
+
+		<h2>
+			Not covered yet:
+		</h2>	
+			<ul>
+				<li>Disable cardbus (has fast/direct memory access)</li>
+				<li>Disable firewire (has fast/direct memory access)</li>
+				<li>Disable flashing the ethernet firmware</li>
+				<li>Disable SPI flash writes (can be re-enabled by unsoldering two parts)</li>
+				<li>Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)</li>
+				<li>Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)</li>
+			</ul>
+			<p>
+				Go to <a href="http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html">http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html</a>
+				or directly to the video: <a href="http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm">http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm</a>.
+			</p>
+			<p>
+				A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above.
+			</p>
+
+		<h2>
+			Also not covered yet:
+		</h2>
+			<ul>
+				<li>
+					Intrusion detection: randomized seal on screws<br/>
+					Just put nail polish with lot of glider on the important screws, take
+					some good pictures. Keep the pictueres and make sure of their integrity.
+					Compare the nail polish with the pictures before powering on the laptop.
+				</li>
+				<li>
+					Tips about preventing/mitigating risk of cold boot attack.
+					<ul>
+						<li>soldered RAM?</li>
+						<li>seal RAM door shut (possibly modified lower chassis) so that system has to be disassembled (which has to go through the nail polish)</li>
+						<li>wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)</li>
+						<li>ask gnutoo about fallback patches (counts number of boots)</li>
+					</ul>
+				</li>
+				<li>
+					General tips/advice and web links showing how to detect physical intrusions.
+				</li>
+				<li>
+					For example: <a href="http://cs.tau.ac.il/~tromer/acoustic/">http://cs.tau.ac.il/~tromer/acoustic/</a>
+				</li>
+				<li>
+					https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3:
+				</li>
+			</ul>
+
+	<h1>
+		Extra notes
+	</h1>
+		<p>
+			EC: Cannot be removed but can be mitigated: it contains non-free
+			non-loadable code, but it has no access to the computer's RAM.
+			It has access to the on-switch of the wifi, bluetooth, modem and some
+			other power management features. The issue is that it has access to the
+			keyboard, however if the software security howto <b>(not yet written)</b> is followed correctly,
+			it won't be able to leak data to a local attacker. It has no network
+			access but it may still be able to leak data remotely, but that
+			requires someone to be nearby to recover the data with the help of an
+			SDR and some directional antennas<a href="#ref3">[3]</a>.
+		</p>
+		<p>
+			<a href="http://www.coreboot.org/Intel_82573_Ethernet_controller">Intel 82573 Ethernet controller</a>
+			on the X60 seems safe, according to Denis. 
+		</p>
+
+		<h2>
+			Risk level
+		</h2>
+			<ul>
+				<li>Modem (3g/wwan): highest</li>
+				<li>Intel wifi: Near highest</li>
+				<li>Atheros PCI wifi: unknown, but lower than intel wifi.</li>
+				<li>Microphone: only problematic if the computer gets compromised.</li>
+				<li>Speakers: only problematic if the computer gets compromised.</li>
+				<li>EC: can be mitigated if following the guide on software security.</li>
+			</ul>
+
+	<h1>
+		Further reading material (software security)
+	</h1>
+		<ul>
+			<li><a href="../gnulinux/encrypted_trisquel.html">Installing Trisquel GNU/Linux with full disk encryption (including /boot)</a></li>
+			<li><a href="../gnulinux/encrypted_parabola.html">Installing Parabola GNU/Linux with full disk encryption (including /boot)</a></li>
+			<li><a href="dock.html">Notes about DMA access and the docking station</a></li>
+		</ul>
+
+	<h1>
+		References
+	</h1>
+		<h2 id="ref1">[1] physical access</h2>
+			<p>
+				Explain that black hats, TAO, and so on might use a 0day to get in,
+				and explain that in this case it mitigates what the attacker can do.
+				Also the TAO do some evaluation before launching an attack: they take
+				the probability of beeing caught into account, along with the kind of
+				target. A 0day costs a lot of money, I heard that it was from 100000$
+				to 400000$, some other websites had prices 10 times lower but that
+				but it was probably a typo. So if people increase their security it
+				makes it more risky and more costly to attack people.
+			</p>
+		<h2 id="ref2">[2] microphone</h2>
+			<p>
+				It's possible to turn headphones into a microphone, you could try
+				yourself, however they don't record loud at all. Also intel cards have
+				the capability to change a connector's function, for instance the
+				microphone jack can now become a headphone plug, that's called
+				retasking. There is some support for it in GNU/Linux but it's not very
+				well known.
+			</p>
+		<h2 id="ref3">[3] Video (CCC)</h2>
+			<p>
+				30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While
+				their demo is experimental(their hardware also got damaged during the
+				transport), the spies probably already have that since a long time.
+				<a href="http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm">http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm</a>
+			</p>
+
+<hr/>
+
+	<p>
+		Copyright &copy; 2014 Francis Rowe &lt;info@gluglug.org.uk&gt;<br/>
+		This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions.
+		A copy of the license can be found at <a href="../license.txt">../license.txt</a>.
+	</p>
+
+	<p>
+		This document is distributed in the hope that it will be useful,
+		but WITHOUT ANY WARRANTY; without even the implied warranty of
+		MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See <a href="../license.txt">../license.txt</a> for more information.
+	</p>
+
+</body>
+</html>
author	Francis Rowe <info@gluglug.org.uk>	2014-11-05 20:52:36 (EST)
committer	Francis Rowe <info@gluglug.org.uk>	2014-11-05 20:52:36 (EST)
commit	8b2219bfa2da36e7809588ef723a10483a6e137f (patch)
tree	8c4d74b9efbdabc1a2604b8cbd508c006c225241 /docs/security/x60_security.html
parent	7429bdcdbb4fc51c61897115112468642afeecfc (diff)
download	libreboot-8b2219bfa2da36e7809588ef723a10483a6e137f.zip libreboot-8b2219bfa2da36e7809588ef723a10483a6e137f.tar.gz libreboot-8b2219bfa2da36e7809588ef723a10483a6e137f.tar.bz2