diff options
Diffstat (limited to 'docs/howtos/t60_security.html')
| -rw-r--r-- | docs/howtos/t60_security.html | 445 |
1 files changed, 0 insertions, 445 deletions
diff --git a/docs/howtos/t60_security.html b/docs/howtos/t60_security.html deleted file mode 100644 index f39c739b..00000000 --- a/docs/howtos/t60_security.html +++ /dev/null @@ -1,445 +0,0 @@ -<!DOCTYPE html> -<html> -<head> - <meta charset="utf-8"> - <meta name="viewport" content="width=device-width, initial-scale=1"> - - <style type="text/css"> - body { - background:#fff; - color:#000; - font-family:sans-serif; - font-size:1em; - } - </style> - - <title>Libreboot documentation: Security on the ThinkPad T60</title> -</head> - -<body> - - <header> - <h1>Security on the ThinkPad T60</h1> - <aside>Hardware modifications to enhance security on the ThinkPad T60. This tutorial is <b>incomplete</b> at the time of writing.</aside> - </header> - - <p>Or go <a href="../index.html">back to main index</a></p> - - <h2>Table of Contents</h2> - <ul> - <li><a href="#hardware_requirements">Hardware Requirements</a></li> - <li><a href="#software_requirements">Software Requirements</a></li> - <li><a href="#procedure">The procedure</a></li> - </ul> - - <h1 id="hardware_requirements">Hardware requirements</h1> - <ul> - <li>A T60</li> - <li>screwdriver</li> - <li>(in a later version of this tutorial: soldering iron and scalpel)</li> - </ul> - - <h1 id="software_requirements">Software requirements</h1> - <ul> - <li>none (at least in the scope of the article as-is)</li> - <li>You probably want to encrypt your GNU/Linux install using LUKS</li> - </ul> - - <h1> - Rationale - </h1> - <p> - Most people think of security on the software side: the hardware is important aswell. - Hardware security is useful in particular to journalists (or activists in a given movement) who need absolute privacy in their work. - It is also generally useful to all those that believe security and privacy are inalienable rights. - Security starts with the hardware; crypto and network security come later. - </p> - <p> - Paradoxically, going this far to increase your security also makes you a bigger target. - At the same time, it protects you in the case that someone does attack your machine. - This paradox only exists while few people take adequate steps to protect yourself: it is your <b>duty</b> - to protect yourself, not only for your benefit but to make strong security <i>normal</i> so - that those who do need protection (and claim it) are a smaller target against the masses. - </p> - <p> - Even if there are levels of security beyond your ability (technically, financially and so on) - doing at least <i>something</i> (what you are able to do) is extremely important. - If you use the internet and your computer without protection, attacking you is cheap (some say it is - only a few US cents). If everyone (majority of people) use strong security by default, - it makes attacks more costly and time consuming; in effect, making them disappear. - </p> - <p> - This tutorial deals with reducing the number of devices that have direct memory access that - could communicate with inputs/outputs that could be used to remotely - command the machine (or leak data). - </p> - - <h1 id="procedure">Disassembly</h1> - - <p> - Remove those screws and remove the HDD:<br/> - <img src="t60_dev/0001.JPG" alt="" /> <img src="t60_dev/0002.JPG" alt="" /> - </p> - - <p> - Lift off the palm rest:<br/> - <img src="t60_dev/0003.JPG" alt="" /> - </p> - - <p> - Lift up the keyboard, pull it back a bit, flip it over like that and then disconnect it from the board:<br/> - <img src="t60_dev/0004.JPG" alt="" /> <img src="t60_dev/0005.JPG" alt="" /> <img src="t60_dev/0006.JPG" alt="" /> - </p> - - <p> - Gently wedge both sides loose:<br/> - <img src="t60_dev/0007.JPG" alt="" /> <img src="t60_dev/0008.JPG" alt="" /> - </p> - - <p> - Remove that cable from the position:<br/> - <img src="t60_dev/0009.JPG" alt="" /> <img src="t60_dev/0010.JPG" alt="" /> - </p> - - <p> - Now remove that bezel. Remove wifi, nvram battery and speaker connector (also remove 56k modem, on the left of wifi):<br/> - <img src="t60_dev/0011.JPG" alt="" /><br/> - Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.<br/> - <b>Wifi:</b> The ath5k/ath9k cards might not have firmware at all. They might safe but could have - access to the computer's RAM trough DMA. If people have an intel - card(most T60's come with Intel wifi by default, until you change it),then that card runs - a non-free firwamre and has access to the computer's RAM trough DMA! So - it's risk-level is very high. - </p> - - <p> - Remove those screws:<br/> - <img src="t60_dev/0012.JPG" alt="" /> - </p> - - <p> - Disconnect the power jack:<br/> - <img src="t60_dev/0013.JPG" alt="" /> - </p> - - <p> - Remove nvram battery (we will put it back later):<br/> - <img src="t60_dev/0014.JPG" alt="" /> - </p> - - <p> - Disconnect cable (for 56k modem) and disconnect the other cable:<br/> - <img src="t60_dev/0015.JPG" alt="" /> <img src="t60_dev/0016.JPG" alt="" /> - </p> - - <p> - Disconnect speaker cable:<br/> - <img src="t60_dev/0017.JPG" alt="" /> - </p> - - <p> - Disconnect the other end of the 56k modem cable:<br/> - <img src="t60_dev/0018.JPG" alt="" /> - </p> - - <p> - Make sure you removed it:<br/> - <img src="t60_dev/0019.JPG" alt="" /> - </p> - - <p> - Unscrew those:<br/> - <img src="t60_dev/0020.JPG" alt="" /> - </p> - - <p> - Make sure you removed those:<br/> - <img src="t60_dev/0021.JPG" alt="" /> - </p> - - <p> - Disconnect LCD cable from board:<br/> - <img src="t60_dev/0022.JPG" alt="" /> - </p> - - <p> - Remove those screws then remove the LCD assembly:<br/> - <img src="t60_dev/0023.JPG" alt="" /> <img src="t60_dev/0024.JPG" alt="" /> <img src="t60_dev/0025.JPG" alt="" /> - </p> - - <p> - Once again, make sure you removed those:<br/> - <img src="t60_dev/0026.JPG" alt="" /> - </p> - - <p> - Remove the shielding containing the motherboard, then flip it over. Remove these screws, placing them on a steady - surface in the same layout as they were in before you removed them. Also, you should mark each screw hole after removing the - screw (a permanent marker pen will do), this is so that you have a point of reference when re-assembling the machine:<br/> - <img src="t60_dev/0027.JPG" alt="" /> <img src="t60_dev/0028.JPG" alt="" /> <img src="t60_dev/0029.JPG" alt="" /> - <img src="t60_dev/0031.JPG" alt="" /> <img src="t60_dev/0032.JPG" alt="" /> <img src="t60_dev/0033.JPG" alt="" /> - </p> - - <p> - Remove microphone (soldering iron not needed. Just wedge it out gently):<br/> - <img src="t60_dev/0039.JPG" alt="" /><br/> - <b>Rationale:</b><br/> - Another reason to remove the microphone: If your computer gets<a href="#ref1">[1]</a> compromised, it can - record what you say, and use it to receive data from nearby devices if - they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically - be programmed to accept remote commands from some speaker somewhere (remote security hole). <b>In other words, - the machine could already be compromised from the factory.</b> - </p> - - <p> - Remove infrared:<br/> - <img src="t60_dev/0040.JPG" alt="" /> <img src="t60_dev/0042.JPG" alt="" /> - </p> - - <p> - Remove cardbus (it's in a socket, no need to disable. Just remove the port itself):<br/> - <img src="t60_dev/0041.JPG" alt="" /><br/> - <b>Rationale:</b><br/> - It has direct memory access and can be used to extract sensitive details (such as LUKS keys). See - 'GoodBIOS' video linked at the end (speaker is Peter Stuge, a coreboot hacker). The video covers X60 - but the same topics apply to T60. - </p> - - <p> - Before re-installing the upper chassis, remove the speaker:<br/> - <img src="t60_dev/0043.JPG" alt="" /> <img src="t60_dev/0044.JPG" alt="" /><br/> - Reason: combined with the microphone issue, this could be used to leak data.<br/> - If your computer gets<a href="#ref1">[1]</a> compromised, it can be used to - transmit data to nearby compromised devices. It's unknown if it can be - turned into a microphone<a href="#ref2">[2]</a>.<br/> - Replacement: headphones/speakers (line-out) or external DAC (USB). - </p> - - <p> - Remove the wwan:<br/> - <img src="t60_dev/0045.JPG" alt="" /><br/> - <b>Wwan (3d modem):</b> They run proprietary software and have access to the - computer's RAM! So it's like AMT but over the GSM network which is - probably even worse.<br/> - Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). - </p> - - <p> - This is where the simcard connector is soldered. See notes above about wwan. Remove simcard by removing battery - and then it's accessible (so, remember to do this when you re-assemble. or you could do it now?)<br/> - <img src="t60_dev/0046.JPG" alt="" /> - </p> - - <p> - Put those screws back:<br/> - <img src="t60_dev/0047.JPG" alt="" /> - </p> - - <p> - Put it back into lower chassis:<br/> - <img src="t60_dev/0048.JPG" alt="" /> - </p> - - <p> - Attach LCD and insert screws (also, attach the lcd cable to the board):<br/> - <img src="t60_dev/0049.JPG" alt="" /> - </p> - - <p> - Insert those screws:<br/> - <img src="t60_dev/0050.JPG" alt="" /> - </p> - - <p> - On the CPU (and there is another chip south-east to it, sorry forgot to take pic) - clean off the old thermal paste (rubbing a1ocheal (misspelling intentional. halal internet)) and apply new (Artic Silver 5 is good, others are good too) - you should also clean the heatsink the same way<br/> - <img src="t60_dev/0051.JPG" alt="" /> - </p> - - <p> - Attach the heatsink and install the screws (also, make sure to install the AC jack as highlighted):<br/> - <img src="t60_dev/0052.JPG" alt="" /> - </p> - - <p> - Reinstall that upper bezel:<br/> - <img src="t60_dev/0053.JPG" alt="" /> - </p> - - <p> - Do that:<br/> - <img src="t60_dev/0054.JPG" alt="" /> <img src="t60_dev/0055.JPG" alt="" /> - </p> - - <p> - Attach keyboard and install nvram battery:<br/> - <img src="t60_dev/0056.JPG" alt="" /> <img src="t60_dev/0057.JPG" alt="" /> - </p> - - <p> - Place keyboard and (sorry, forgot to take pics) reinstall the palmrest and insert screws on the underside:<br/> - <img src="t60_dev/0058.JPG" alt="" /> - </p> - - <p> - Remove those covers and unscrew:<br/> - <img src="t60_dev/0059.JPG" alt="" /> <img src="t60_dev/0060.JPG" alt="" /> <img src="t60_dev/0061.JPG" alt="" /> - </p> - - <p> - Gently pry off the front bezel (sorry, forgot to take pics). - </p> - - <p> - Remove bluetooth module:<br/> - <img src="t60_dev/0062.JPG" alt="" /> <img src="t60_dev/0063.JPG" alt="" /> - </p> - - <p> - Re-attach the front bezel and re-insert the screws (sorry, forgot to take pics). - </p> - - <p> - It lives!<br/> - <img src="t60_dev/0071.JPG" alt="" /> <img src="t60_dev/0072.JPG" alt="" /> <img src="t60_dev/0073.JPG" alt="" /> - </p> - - <p> - Always stress test ('stress -c 2' and xsensors. below 90C is ok) when replacing cpu paste/heatsink:<br/> - <img src="t60_dev/0074.JPG" alt="" /> - </p> - - <h2> - Not covered yet: - </h2> - <ul> - <li>Disable flashing the ethernet firmware</li> - <li>Disable SPI flash writes (can be re-enabled by unsoldering two parts)</li> - <li>Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)</li> - <li>Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)</li> - </ul> - <p> - Go to <a href="http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html">http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html</a> - or directly to the video: <a href="http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm">http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm</a>. - </p> - <p> - A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. - </p> - - <h2> - Also not covered yet: - </h2> - <ul> - <li> - Intrusion detection: randomized seal on screws<br/> - Just put nail polish with lot of glider on the important screws, take - some good pictures. Keep the pictueres and make sure of their integrity. - Compare the nail polish with the pictures before powering on the laptop. - </li> - <li> - Tips about preventing/mitigating risk of cold boot attack. - <ul> - <li>soldered RAM?</li> - <li>wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)</li> - <li>ask gnutoo about fallback patches (counts number of boots)</li> - </ul> - </li> - <li> - General tips/advice and web links showing how to detect physical intrusions. - </li> - <li> - For example: <a href="http://cs.tau.ac.il/~tromer/acoustic/">http://cs.tau.ac.il/~tromer/acoustic/</a> - </li> - <li> - https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: - </li> - </ul> - - <h1> - Extra notes - </h1> - <p> - EC: Cannot be removed but can be mitigated: it contains non-free - non-loadable code, but it has no access to the computer's RAM. - It has access to the on-switch of the wifi, bluetooth, modem and some - other power management features. The issue is that it has access to the - keyboard, however if the software security howto <b>(not yet written)</b> is followed correctly, - it won't be able to leak data to a local attacker. It has no network - access but it may still be able to leak data remotely, but that - requires someone to be nearby to recover the data with the help of an - SDR and some directional antennas<a href="#ref3">[3]</a>. - </p> - <p> - <a href="http://www.coreboot.org/Intel_82573_Ethernet_controller">Intel 82573 Ethernet controller</a> - on the X60 seems safe, according to Denis. - </p> - - <h2> - Risk level - </h2> - <ul> - <li>Modem (3g/wwan): highest</li> - <li>Intel wifi: Near highest</li> - <li>Atheros PCI wifi: unknown, but lower than intel wifi.</li> - <li>Microphone: only problematic if the computer gets compromised.</li> - <li>Speakers: only problematic if the computer gets compromised.</li> - <li>EC: can be mitigated if following the guide on software security.</li> - </ul> - - <h1> - Further reading material (software security) - </h1> - <ul> - <li><a href="encrypted_trisquel.html">Installing Trisquel GNU/Linux with full disk encryption (including /boot)</a></li> - <li><a href="encrypted_parabola.html">Installing Parabola GNU/Linux with full disk encryption (including /boot)</a></li> - <li><a href="dock.html">Notes about DMA access and the docking station</a></li> - </ul> - - <h1> - References - </h1> - <h2 id="ref1">[1] physical access</h2> - <p> - Explain that black hats, TAO, and so on might use a 0day to get in, - and explain that in this case it mitigates what the attacker can do. - Also the TAO do some evaluation before launching an attack: they take - the probability of beeing caught into account, along with the kind of - target. A 0day costs a lot of money, I heard that it was from 100000$ - to 400000$, some other websites had prices 10 times lower but that - but it was probably a typo. So if people increase their security it - makes it more risky and more costly to attack people. - </p> - <h2 id="ref2">[2] microphone</h2> - <p> - It's possible to turn headphones into a microphone, you could try - yourself, however they don't record loud at all. Also intel cards have - the capability to change a connector's function, for instance the - microphone jack can now become a headphone plug, that's called - retasking. There is some support for it in GNU/Linux but it's not very - well known. - </p> - <h2 id="ref3">[3] Video (CCC)</h2> - <p> - 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While - their demo is experimental(their hardware also got damaged during the - transport), the spies probably already have that since a long time. - <a href="http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm">http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm</a> - </p> - -<hr/> - - <p> - Copyright © 2014 Francis Rowe <info@gluglug.org.uk><br/> - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at <a href="../license.txt">../license.txt</a>. - </p> - - <p> - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See <a href="../license.txt">../license.txt</a> for more information. - </p> - -</body> -</html> |