Libreboot release 6 beta 3.

- Fixed typo that existed in 2nd beta where the release date of the 2nd beta was listed as being in year 2016, when in actual fact it was 2014. - Documentation: added (preliminary) details about (rare) buggy CPU's on the ThinkPad T60 that were found to fail (instability, kernel panics, etc) without the microcode updates. - Documentation: added docs/howtos/x60_heatsink.html for showing how to change the heatsink on the Thinkpad X60 - Added ROM images for Azerty (French) keyboard layout in GRUB (courtesy of Olivier Mondoloni) - Tidied up some scripts: - Re-factored those scripts (made easier to read/maintain): build-x60, build-x60t, build-t60, build-macbook21 - Reduced the number of grub configs to 2 (or 1, for macbook21), the build scripts now generate the other configs at build time. - Deleted build-x60, build-x60t, build-t60, build-macbook21 and replaced with intelligent (generic) buildrom-withgrub script - Updated build to use buildrom-withgrub script for building the ROM images. - coreboot.rom and coreboot_serial.rom renamed to coreboot_usqwerty.rom and coreboot_serial_usqwerty.rom - coreboot_dvorak and coreboot_serial_dvorak.rom renamed to coreboot_usdvorak.rom and coreboot_serial_usdvorak.rom - Renamed coreboot*rom to libreboot*rom - Made flash, lenovobios_firstflash and lenovobios_secondflash scripts fail if the specified file does not exist. - Updated all relevant parts of the documentation to reflect the above. - Replaced background.png with background.jpg. added gnulove.jpg. (resources/grub/background/) - Updated buildrom-withgrub to use background.jpg instead of background.png - Updated buildrom-withgrub to use gnulove.jpg aswell - Updated resources/grub/config/macbook21/grub*cfg to use gnulove.jpg background. - Updated resources/grub/config/{x60,t60,x60t}/grub*cfg to use background.jpg background. - Documentation: updated docs/index.html#grub_custom_keyboard to be more generally useful. - nvramtool: - Updated builddeps-coreboot script to build it - Updated build script to include it in libreboot_bin - Documentation: added docs/howtos/x60_security.html (security hardening for X60)
author: Francis Rowe <info@gluglug.org.uk> 2014-07-20 07:37:00 +0000
committer: Michał Masłowski <mtjm@mtjm.eu> 2014-08-22 19:15:07 +0200
commit: 488242eb941305ef61319b8499d4a1e8ccf218a1 (patch)
tree: b0347f360df51ac5a8edd06068e7ae24510864d6 /docs/howtos/x60_security.html
parent: 8b484a19b51fb0591d938b3b7cf4fcb8f06c7a2f (diff)
download: librebootfr-488242eb941305ef61319b8499d4a1e8ccf218a1.tar.gz
librebootfr-488242eb941305ef61319b8499d4a1e8ccf218a1.zip
1 files changed, 171 insertions, 0 deletions
diff --git a/docs/howtos/x60_security.html b/docs/howtos/x60_security.html
new file mode 100644
index 00000000..fc9cb0b4
--- /dev/null
+++ b/docs/howtos/x60_security.html
@@ -0,0 +1,171 @@
+<!DOCTYPE html>
+<html>
+<head>
+	<meta charset="utf-8">
+	<meta name="viewport" content="width=device-width, initial-scale=1">
+
+	<style type="text/css">
+		body {
+			background:#fff;
+			color:#000;
+			font-family:sans-serif;
+			font-size:1em;
+		}
+	</style>
+
+	<title>Libreboot documentation: Security on the ThinkPad X60</title>
+</head>
+
+<body>
+
+	<header>
+		<h1>Security on the ThinkPad X60</h1>
+		<aside>Hardware modifications to enhance security on the ThinkPad X60. This tutorial is <b>incomplete</b> at the time of writing.</aside>
+	</header>
+
+	<p>Or go <a href="../index.html">back to main index</a></p>
+
+	<h2>Table of Contents</h2>
+		<ul>
+			<li><a href="#hardware_requirements">Hardware Requirements</a></li>
+			<li><a href="#software_requirements">Software Requirements</a></li>
+			<li><a href="#procedure">The procedure</a></li>
+		</ul>
+
+	<h1 id="hardware_requirements">Hardware requirements</h1>
+		<ul>
+			<li>An X60</li>
+			<li>screwdriver</li>
+			<li>(in a later version of this tutorial: soldering iron and scalpel)</li>
+		</ul>
+
+	<h1 id="software_requirements">Software requirements</h1>
+		<ul>
+			<li>none (at least in the scope of the article as-is)</li>
+		</ul>
+
+	<h1 id="procedure">Disassembly</h1>
+
+		<p>
+			Firstly remove the bluetooth (if your X60 has this):<br/>
+			The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):<br/>
+			<img src="x60_security/0000_bluetooth0.jpg" alt="" /><br/>
+			Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):<br/>
+			<img src="x60_security/0000_bluetooth.jpg" alt="" /><br/>
+		</p>
+
+		<p>
+			If your model was WWAN, remove the simcard (check anyway):<br/>
+			Uncover those 2 screws at the bottom:<br/>
+			<img src="x60_security/0000_simcard0.jpg" alt="" /><br/>
+			SIM card is in the marked location:<br/>
+			<img src="x60_security/0000_simcard1.jpg" alt="" /><br/>
+			Replacement: USB dongle.
+		</p>
+
+		<p>
+			Now get into the motherboard.
+		</p>
+
+		<p>
+			Remove those screws:<br/>
+			<img src="x60_security/0000.jpg" alt="" />
+		</p>
+		<p>
+			Push the keyboard forward (carefully):<br/>
+			<img src="x60_security/0001.jpg" alt="" />
+		</p>
+		<p>
+			Lift the keyboard up and disconnect it from the board:<br/>
+			<img src="x60_security/0002.jpg" alt="" />
+		</p>
+		<p>
+			Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:<br/>
+			<img src="x60_security/0003.jpg" alt="" />
+		</p>
+		<p>
+			You should now have this:<br/>
+			<img src="x60_security/0004.jpg" alt="" />
+		</p>
+
+		<p>
+			The following is a summary of what you will remove (already done to this machine):<br/>
+			<img src="x60_security/0001_overview.jpg" alt="" /><br/>
+			Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want
+			(to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and
+			also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). <b>This is optional</b>
+		</p>
+
+		<p>
+			Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:<br/>
+			<img src="x60_security/0001_microphone.jpg" alt="" /><br/>
+			We do not know what the built-in microcode (on the CPU) is doing. The theory is that it could be programmed to take commands that do something
+			and then the CPU returns results. (meaning, remote security hole). So we remove it, just in case.<br/>
+			Replacement: external microphone on USB or line-in jack.
+		</p>
+
+		<p>
+			Remove the modem:<br/>
+			<img src="x60_security/0001_modem.jpg" alt="" /><br/>
+			(useless, obsolete device)
+		</p>
+
+		<p>
+			Remove the speaker:<br/>
+			<img src="x60_security/0001_speaker.jpg" alt="" /><br/>
+			Reason: combined with the microphone issue, this could be used to leak data.<br/>
+			Replacement: headphones/speakers (line-out) or external DAC (USB).
+		</p>
+
+		<p>
+			Remove the wlan (also remove wwan if you have it):<br/>
+			<img src="x60_security/0001_wlan_wwan.jpg" alt="" /><br/>
+			Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
+		</p>	
+
+		<h2>
+			Not covered yet:
+		</h2>	
+			<ul>
+				<li>Disable cardbus/pcmcia (has fast/direct memory access)</li>
+				<li>Disable firewire (has fast/direct memory access)</li>
+				<li>Disable flashing the ethernet firmware</li>
+				<li>Disable SPI flash writes (can be re-enabled by unsoldering two parts)</li>
+				<li>Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)</li>
+				<li>Disable docking station</li>
+			</ul>
+			<p>
+				Go to <a href="http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html">http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html</a>
+				or directly to the video: <a href="http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm">http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm</a>.
+			</p>
+			<p>
+				A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the abev.
+			</p>
+
+		<h2>
+			Also not covered yet:
+		</h2>
+			<ul>
+				<li>
+					Intrusion detection: randomized seal on screws (need to research)
+				</li>
+				<li>
+					Tips about preventing/mitigating risk of cold boot attack.
+				</li>
+				<li>
+					Software-based security hardening (GRUB trust/cryptomount, kernel LUKS/ecryptfs, etc).
+				</li>
+				<li>
+					General tips/advice and web links showing how to detect physical intrusions.
+				</li>
+			</ul>
+
+<hr/>
+
+	<p>
+		Copyright &copy; 2014 Francis Rowe, All Rights Reserved.<br/>
+		See <a href="../license.html">../license.html</a> for license conditions.
+	</p>
+
+</body>
+</html>
author	Francis Rowe <info@gluglug.org.uk>	2014-07-20 07:37:00 +0000
committer	Michał Masłowski <mtjm@mtjm.eu>	2014-08-22 19:15:07 +0200
commit	488242eb941305ef61319b8499d4a1e8ccf218a1 (patch)
tree	b0347f360df51ac5a8edd06068e7ae24510864d6 /docs/howtos/x60_security.html
parent	8b484a19b51fb0591d938b3b7cf4fcb8f06c7a2f (diff)
download	librebootfr-488242eb941305ef61319b8499d4a1e8ccf218a1.tar.gz librebootfr-488242eb941305ef61319b8499d4a1e8ccf218a1.zip