From 8b2219bfa2da36e7809588ef723a10483a6e137f Mon Sep 17 00:00:00 2001 From: Francis Rowe Date: Wed, 05 Nov 2014 20:52:36 -0500 Subject: Documentation: *major* cleanup. Cleanup was long overdue. Old structure was messy and inefficient. --- (limited to 'docs/security') diff --git a/docs/security/dock.html b/docs/security/dock.html new file mode 100644 index 0000000..2b7fe75 --- /dev/null +++ b/docs/security/dock.html @@ -0,0 +1,154 @@ + + + + + + + + + Notes about DMA and the docking station (X60/T60) + + + +
+

Notes about DMA and the docking station (X60/T60)

+
+ +
+
+Use case:
+---------
+Usually when people do full disk encryption, it's not really full disk,
+instead they still have a /boot in clear.
+
+So an evil maid attack can still be done, in two passes:
+1) Clone the hdd, Infect the initramfs or the kernel.
+2) Wait for the user to enter its password, recover the password,
+luksOpen the hdd image.
+
+I wanted a real full-disk encryption so I've put grub in flash and I
+have the following: The HDD has a LUKS rootfs(containing /boot) on an
+lvm partition, so no partition is in clear.
+
+So when the computer boots it executes coreboot, then grub as a payload.
+Grub then opens the LUKS partition and loads the kernel and initramfs
+from there.
+
+To prevent hardware level tempering(like reflashing), I used nail
+polish with a lot of gilder, that acts like a seal. Then a high
+resolution picture of it is taken, to be able to tell the difference.
+
+The problem:
+------------
+But then comes the docking port issue: Some LPC pins are exported
+there, such as the CLKRUN and LDRQ#.
+
+LDRQ# is "Encoded DMA/Bus Master Request": "Only needed by
+peripherals that need DMA or bus mastering. Requires an
+individual signal per peripheral. Peripherals may not share
+an LDRQ# signal."
+
+So now DMA access is possible trough the dock connector.
+So I want to be able to turn that off.
+
+If I got it right, the X60 has 2 superio, one is in the dock, and the
+other one is in the laptop, so we have:
+                            ________________
+ _________________         |                |
+|                 |        | Dock connector:|
+|Dock: NSC pc87982|<--LPC--->D_LPC_DREQ0    |
+|_________________|        |_______^________|
+                                   |
+                                   |
+                                   |
+                                   |
+                ___________________|____
+               |                   v    |
+               | SuperIO:        DLDRQ# |
+               | NSC pc87382     LDRQ#  |
+               |___________________^____|
+                                   |
+                                   |
+                                   |
+                                   |
+                ___________________|___
+               |                   v   |
+               | Southbridge:    LDRQ0 |
+               | ICH7                  |
+               |_______________________|
+
+
+The code:
+---------
+Now if I look at the existing code, there is some superio drivers, like
+pc87382 in src/superio/nsc, the code is very small. 
+The only interesting part is the pnp_info pnp_dev_info struct.
+
+Now if I look inside src/mainboard/lenovo/x60 there is some more
+complete dock driver:
+
+Inside dock.c I see some dock_connect and dock_disconnect functions.
+
+Such functions are called during the initialisation (romstage.c) and
+from the x60's SMI handler (smihandler.c).
+
+Questions:
+----------
+1) Would the following be sufficent to prevent DMA access from the
+outside:
+> int dock_connect(void)
+> {
+>          int timeout = 1000;
+> +        int val;
+> +        
+> +        if (get_option(&val, "dock") != CB_SUCCESS)
+> +                val = 1;
+> +        if (val == 0)
+> +                return 0;
+>          [...]
+> }
+>
+> void dock_disconnect(void) {
+> +        if (dock_present())
+> +                return;
+>          [...]
+> }
+2) Would an nvram option be ok for that? Should a Kconfig option be
+added too?
+
+> config DOCK_AUTODETECT
+>         bool "Autodetect"
+>         help
+>           The dock is autodetected. If unsure select this option.
+>
+> config DOCK_DISABLED
+>         bool "Disabled"
+>         help
+>           The dock is always disabled.
+>
+> config DOCK_NVRAM_ENABLE
+>         bool "Nvram"
+>         help
+>           The dock autodetection is tried only if it is also enabled
+> trough nvram.
+
+
+ +
+ +

+ Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

+ +

+ This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

+ + + diff --git a/docs/security/index.html b/docs/security/index.html new file mode 100644 index 0000000..64008b8 --- /dev/null +++ b/docs/security/index.html @@ -0,0 +1,40 @@ + + + + + + + + + Security topics + + + + +

Security topics

+

+ Or Back to main index. +

+ + +
+ +

+ Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

+ +

+ This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

+ + + diff --git a/docs/security/t60_security.html b/docs/security/t60_security.html new file mode 100644 index 0000000..eb3db03 --- /dev/null +++ b/docs/security/t60_security.html @@ -0,0 +1,440 @@ + + + + + + + + + Libreboot documentation: Security on the ThinkPad T60 + + + + +
+

Security on the ThinkPad T60

+ +
+ +

Or go back to main index

+ +

Table of Contents

+ + +

Hardware requirements

+ + +

Software requirements

+ + +

+ Rationale +

+

+ Most people think of security on the software side: the hardware is important aswell. + Hardware security is useful in particular to journalists (or activists in a given movement) who need absolute privacy in their work. + It is also generally useful to all those that believe security and privacy are inalienable rights. + Security starts with the hardware; crypto and network security come later. +

+

+ Paradoxically, going this far to increase your security also makes you a bigger target. + At the same time, it protects you in the case that someone does attack your machine. + This paradox only exists while few people take adequate steps to protect yourself: it is your duty + to protect yourself, not only for your benefit but to make strong security normal so + that those who do need protection (and claim it) are a smaller target against the masses. +

+

+ Even if there are levels of security beyond your ability (technically, financially and so on) + doing at least something (what you are able to do) is extremely important. + If you use the internet and your computer without protection, attacking you is cheap (some say it is + only a few US cents). If everyone (majority of people) use strong security by default, + it makes attacks more costly and time consuming; in effect, making them disappear. +

+

+ This tutorial deals with reducing the number of devices that have direct memory access that + could communicate with inputs/outputs that could be used to remotely + command the machine (or leak data). +

+ +

Disassembly

+ +

+ Remove those screws and remove the HDD:
+ +

+ +

+ Lift off the palm rest:
+ +

+ +

+ Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:
+ +

+ +

+ Gently wedge both sides loose:
+ +

+ +

+ Remove that cable from the position:
+ +

+ +

+ Now remove that bezel. Remove wifi, nvram battery and speaker connector (also remove 56k modem, on the left of wifi):
+
+ Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
+ Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have + access to the computer's RAM trough DMA. If people have an intel + card(most T60's come with Intel wifi by default, until you change it),then that card runs + a non-free firwamre and has access to the computer's RAM trough DMA! So + it's risk-level is very high. +

+ +

+ Remove those screws:
+ +

+ +

+ Disconnect the power jack:
+ +

+ +

+ Remove nvram battery (we will put it back later):
+ +

+ +

+ Disconnect cable (for 56k modem) and disconnect the other cable:
+ +

+ +

+ Disconnect speaker cable:
+ +

+ +

+ Disconnect the other end of the 56k modem cable:
+ +

+ +

+ Make sure you removed it:
+ +

+ +

+ Unscrew those:
+ +

+ +

+ Make sure you removed those:
+ +

+ +

+ Disconnect LCD cable from board:
+ +

+ +

+ Remove those screws then remove the LCD assembly:
+ +

+ +

+ Once again, make sure you removed those:
+ +

+ +

+ Remove the shielding containing the motherboard, then flip it over. Remove these screws, placing them on a steady + surface in the same layout as they were in before you removed them. Also, you should mark each screw hole after removing the + screw (a permanent marker pen will do), this is so that you have a point of reference when re-assembling the machine:
+ + +

+ +

+ Remove microphone (soldering iron not needed. Just wedge it out gently):
+
+ Rationale:
+ Another reason to remove the microphone: If your computer gets[1] compromised, it can + record what you say, and use it to receive data from nearby devices if + they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically + be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, + the machine could already be compromised from the factory. +

+ +

+ Remove infrared:
+ +

+ +

+ Remove cardbus (it's in a socket, no need to disable. Just remove the port itself):
+
+ Rationale:
+ It has direct memory access and can be used to extract sensitive details (such as LUKS keys). See + 'GoodBIOS' video linked at the end (speaker is Peter Stuge, a coreboot hacker). The video covers X60 + but the same topics apply to T60. +

+ +

+ Before re-installing the upper chassis, remove the speaker:
+
+ Reason: combined with the microphone issue, this could be used to leak data.
+ If your computer gets[1] compromised, it can be used to + transmit data to nearby compromised devices. It's unknown if it can be + turned into a microphone[2].
+ Replacement: headphones/speakers (line-out) or external DAC (USB). +

+ +

+ Remove the wwan:
+
+ Wwan (3d modem): They run proprietary software and have access to the + computer's RAM! So it's like AMT but over the GSM network which is + probably even worse.
+ Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). +

+ +

+ This is where the simcard connector is soldered. See notes above about wwan. Remove simcard by removing battery + and then it's accessible (so, remember to do this when you re-assemble. or you could do it now?)
+ +

+ +

+ Put those screws back:
+ +

+ +

+ Put it back into lower chassis:
+ +

+ +

+ Attach LCD and insert screws (also, attach the lcd cable to the board):
+ +

+ +

+ Insert those screws:
+ +

+ +

+ On the CPU (and there is another chip south-east to it, sorry forgot to take pic) + clean off the old thermal paste (rubbing a1ocheal (misspelling intentional. halal internet)) and apply new (Artic Silver 5 is good, others are good too) + you should also clean the heatsink the same way
+ +

+ +

+ Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):
+ +

+ +

+ Reinstall that upper bezel:
+ +

+ +

+ Do that:
+ +

+ +

+ Attach keyboard and install nvram battery:
+ +

+ +

+ Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:
+ +

+ +

+ Remove those covers and unscrew:
+ +

+ +

+ Gently pry off the front bezel (sorry, forgot to take pics). +

+ +

+ Remove bluetooth module:
+ +

+ +

+ Re-attach the front bezel and re-insert the screws (sorry, forgot to take pics). +

+ +

+ It lives!
+ +

+ +

+ Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:
+ +

+ +

+ Not covered yet: +

+ +

+ Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html + or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. +

+

+ A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. +

+ +

+ Also not covered yet: +

+ + +

+ Extra notes +

+

+ EC: Cannot be removed but can be mitigated: it contains non-free + non-loadable code, but it has no access to the computer's RAM. + It has access to the on-switch of the wifi, bluetooth, modem and some + other power management features. The issue is that it has access to the + keyboard, however if the software security howto (not yet written) is followed correctly, + it won't be able to leak data to a local attacker. It has no network + access but it may still be able to leak data remotely, but that + requires someone to be nearby to recover the data with the help of an + SDR and some directional antennas[3]. +

+

+ Intel 82573 Ethernet controller + on the X60 seems safe, according to Denis. +

+ +

+ Risk level +

+ + +

+ Further reading material (software security) +

+ + +

+ References +

+

[1] physical access

+

+ Explain that black hats, TAO, and so on might use a 0day to get in, + and explain that in this case it mitigates what the attacker can do. + Also the TAO do some evaluation before launching an attack: they take + the probability of beeing caught into account, along with the kind of + target. A 0day costs a lot of money, I heard that it was from 100000$ + to 400000$, some other websites had prices 10 times lower but that + but it was probably a typo. So if people increase their security it + makes it more risky and more costly to attack people. +

+

[2] microphone

+

+ It's possible to turn headphones into a microphone, you could try + yourself, however they don't record loud at all. Also intel cards have + the capability to change a connector's function, for instance the + microphone jack can now become a headphone plug, that's called + retasking. There is some support for it in GNU/Linux but it's not very + well known. +

+

[3] Video (CCC)

+

+ 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While + their demo is experimental(their hardware also got damaged during the + transport), the spies probably already have that since a long time. + http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm +

+ +
+ +

+ Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

+ +

+ This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

+ + + diff --git a/docs/security/x60_security.html b/docs/security/x60_security.html new file mode 100644 index 0000000..33ccb6d --- /dev/null +++ b/docs/security/x60_security.html @@ -0,0 +1,301 @@ + + + + + + + + + Libreboot documentation: Security on the ThinkPad X60 + + + + +
+

Security on the ThinkPad X60

+ +
+ +

Or go back to main index

+ +

Table of Contents

+ + +

Hardware requirements

+ + +

Software requirements

+ + +

+ Rationale +

+

+ Most people think of security on the software side: the hardware is important aswell. + Hardware security is useful in particular to journalists (or activists in a given movement) who need absolute privacy in their work. + It is also generally useful to all those that believe security and privacy are inalienable rights. + Security starts with the hardware; crypto and network security come later. +

+

+ Paradoxically, going this far to increase your security also makes you a bigger target. + At the same time, it protects you in the case that someone does attack your machine. + This paradox only exists while few people take adequate steps to protect yourself: it is your duty + to protect yourself, not only for your benefit but to make strong security normal so + that those who do need protection (and claim it) are a smaller target against the masses. +

+

+ Even if there are levels of security beyond your ability (technically, financially and so on) + doing at least something (what you are able to do) is extremely important. + If you use the internet and your computer without protection, attacking you is cheap (some say it is + only a few US cents). If everyone (majority of people) use strong security by default, + it makes attacks more costly and time consuming; in effect, making them disappear. +

+

+ This tutorial deals with reducing the number of devices that have direct memory access that + could communicate with inputs/outputs that could be used to remotely + command the machine (or leak data). +

+ +

Disassembly

+ +

+ Firstly remove the bluetooth (if your X60 has this):
+ The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):
+
+ Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):
+
+

+ +

+ If your model was WWAN, remove the simcard (check anyway):
+ Uncover those 2 screws at the bottom:
+
+ SIM card (not present in the picture) is in the marked location:
+
+ Replacement: USB dongle. +

+ +

+ Now get into the motherboard. +

+ +

+ Remove those screws:
+ +

+

+ Push the keyboard forward (carefully):
+ +

+

+ Lift the keyboard up and disconnect it from the board:
+ +

+

+ Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
+ +

+

+ You should now have this:
+ +

+ +

+ The following is a summary of what you will remove (already done to this machine):
+
+ Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want + (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and + also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). This is optional +

+ +

+ Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:
+
+ Rationale:
+ Another reason to remove the microphone: If your computer gets[1] compromised, it can + record what you say, and use it to receive data from nearby devices if + they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically + be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, + the machine could already be compromised from the factory. +

+ +

+ Remove the modem:
+
+ (useless, obsolete device) +

+ +

+ Remove the speaker:
+
+ Reason: combined with the microphone issue, this could be used to leak data.
+ If your computer gets[1] compromised, it can be used to + transmit data to nearby compromised devices. It's unknown if it can be + turned into a microphone[2].
+ Replacement: headphones/speakers (line-out) or external DAC (USB). +

+ +

+ Remove the wlan (also remove wwan if you have it):
+
+ Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
+ Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have + access to the computer's RAM trough DMA. If people have an intel + card(most X60's come with Intel wifi by default, until you change it),then that card runs + a non-free firwamre and has access to the computer's RAM trough DMA! So + it's risk-level is very high.
+ Wwan (3d modem): They run proprietary software and have access to the + computer's RAM! So it's like AMT but over the GSM network which is + probably even worse.
+ Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). +

+ +

+ Not covered yet: +

+ +

+ Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html + or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. +

+

+ A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. +

+ +

+ Also not covered yet: +

+ + +

+ Extra notes +

+

+ EC: Cannot be removed but can be mitigated: it contains non-free + non-loadable code, but it has no access to the computer's RAM. + It has access to the on-switch of the wifi, bluetooth, modem and some + other power management features. The issue is that it has access to the + keyboard, however if the software security howto (not yet written) is followed correctly, + it won't be able to leak data to a local attacker. It has no network + access but it may still be able to leak data remotely, but that + requires someone to be nearby to recover the data with the help of an + SDR and some directional antennas[3]. +

+

+ Intel 82573 Ethernet controller + on the X60 seems safe, according to Denis. +

+ +

+ Risk level +

+ + +

+ Further reading material (software security) +

+ + +

+ References +

+

[1] physical access

+

+ Explain that black hats, TAO, and so on might use a 0day to get in, + and explain that in this case it mitigates what the attacker can do. + Also the TAO do some evaluation before launching an attack: they take + the probability of beeing caught into account, along with the kind of + target. A 0day costs a lot of money, I heard that it was from 100000$ + to 400000$, some other websites had prices 10 times lower but that + but it was probably a typo. So if people increase their security it + makes it more risky and more costly to attack people. +

+

[2] microphone

+

+ It's possible to turn headphones into a microphone, you could try + yourself, however they don't record loud at all. Also intel cards have + the capability to change a connector's function, for instance the + microphone jack can now become a headphone plug, that's called + retasking. There is some support for it in GNU/Linux but it's not very + well known. +

+

[3] Video (CCC)

+

+ 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While + their demo is experimental(their hardware also got damaged during the + transport), the spies probably already have that since a long time. + http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm +

+ +
+ +

+ Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

+ +

+ This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

+ + + -- cgit v0.9.1