diff options
Diffstat (limited to 'docs/security/x60_security.html')
| -rw-r--r-- | docs/security/x60_security.html | 504 |
1 files changed, 264 insertions, 240 deletions
diff --git a/docs/security/x60_security.html b/docs/security/x60_security.html index c87c581e..7b524c76 100644 --- a/docs/security/x60_security.html +++ b/docs/security/x60_security.html @@ -13,277 +13,301 @@ <body> - <header> + <div class="section"> <h1>Security on the ThinkPad X60</h1> - <aside>Hardware modifications to enhance security on the ThinkPad X60. This tutorial is <b>incomplete</b> at the time of writing.</aside> - </header> + <p>Hardware modifications to enhance security on the ThinkPad X60. This tutorial is <b>incomplete</b> at the time of writing.</p> + <p><a href="index.html">Back to previous index</a></p> + </div> - <p>Or go <a href="index.html">back to main index</a></p> + <div class="section"> + <h1>Table of Contents</h1> + <ul> + <li><a href="#hardware_requirements">Hardware Requirements</a></li> + <li><a href="#software_requirements">Software Requirements</a></li> + <li><a href="#procedure">The procedure</a></li> + </ul> + </div> - <h2>Table of Contents</h2> - <ul> - <li><a href="#hardware_requirements">Hardware Requirements</a></li> - <li><a href="#software_requirements">Software Requirements</a></li> - <li><a href="#procedure">The procedure</a></li> - </ul> + <div class="section"> + + <h1 id="hardware_requirements">Hardware requirements</h1> + <ul> + <li>An X60</li> + <li>screwdriver</li> + <li>(in a later version of this tutorial: soldering iron and scalpel)</li> + </ul> - <h1 id="hardware_requirements">Hardware requirements</h1> - <ul> - <li>An X60</li> - <li>screwdriver</li> - <li>(in a later version of this tutorial: soldering iron and scalpel)</li> - </ul> + <h1 id="software_requirements">Software requirements</h1> + <ul> + <li>none (at least in the scope of the article as-is)</li> + <li>You probably want to encrypt your GNU/Linux install using LUKS</li> + </ul> + + </div> - <h1 id="software_requirements">Software requirements</h1> - <ul> - <li>none (at least in the scope of the article as-is)</li> - <li>You probably want to encrypt your GNU/Linux install using LUKS</li> - </ul> + <div class="section"> - <h1> - Rationale - </h1> - <p> - Most people think of security on the software side: the hardware is important aswell. - work. - </p> - <p> - This tutorial deals with reducing the number of devices that have direct memory access that - could communicate with inputs/outputs that could be used to remotely - command the machine (or leak data). All of this is purely theoretical for the time being. - </p> + <h1> + Rationale + </h1> + <p> + Most people think of security on the software side: the hardware is important aswell. + </p> + <p> + This tutorial deals with reducing the number of devices that have direct memory access that + could communicate with inputs/outputs that could be used to remotely + command the machine (or leak data). All of this is purely theoretical for the time being. + </p> - <h1 id="procedure">Disassembly</h1> + <h1 id="procedure">Disassembly</h1> - <p> - Firstly remove the bluetooth (if your X60 has this):<br/> - The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):<br/> - <img src="../images/x60_security/0000_bluetooth0.jpg" alt="" /><br/> - Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):<br/> - <img src="../images/x60_security/0000_bluetooth.jpg" alt="" /><br/> - </p> + <p> + Firstly remove the bluetooth (if your X60 has this):<br/> + The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):<br/> + <img src="../images/x60_security/0000_bluetooth0.jpg" alt="" /><br/> + Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):<br/> + <img src="../images/x60_security/0000_bluetooth.jpg" alt="" /><br/> + </p> - <p> - If your model was WWAN, remove the simcard (check anyway):<br/> - Uncover those 2 screws at the bottom:<br/> - <img src="../images/x60_security/0000_simcard0.jpg" alt="" /><br/> - SIM card (not present in the picture) is in the marked location:<br/> - <img src="../images/x60_security/0000_simcard1.jpg" alt="" /><br/> - Replacement: USB dongle. - </p> + <p> + If your model was WWAN, remove the simcard (check anyway):<br/> + Uncover those 2 screws at the bottom:<br/> + <img src="../images/x60_security/0000_simcard0.jpg" alt="" /><br/> + SIM card (not present in the picture) is in the marked location:<br/> + <img src="../images/x60_security/0000_simcard1.jpg" alt="" /><br/> + Replacement: USB dongle. + </p> - <p> - Now get into the motherboard. - </p> + <p> + Now get into the motherboard. + </p> - <p> - Remove those screws:<br/> - <img src="../images/x60_security/0000.jpg" alt="" /> - </p> - <p> - Push the keyboard forward (carefully):<br/> - <img src="../images/x60_security/0001.jpg" alt="" /> - </p> - <p> - Lift the keyboard up and disconnect it from the board:<br/> - <img src="../images/x60_security/0002.jpg" alt="" /> - </p> - <p> - Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:<br/> - <img src="../images/x60_security/0003.jpg" alt="" /> - </p> - <p> - You should now have this:<br/> - <img src="../images/x60_security/0004.jpg" alt="" /> - </p> + <p> + Remove those screws:<br/> + <img src="../images/x60_security/0000.jpg" alt="" /> + </p> + <p> + Push the keyboard forward (carefully):<br/> + <img src="../images/x60_security/0001.jpg" alt="" /> + </p> + <p> + Lift the keyboard up and disconnect it from the board:<br/> + <img src="../images/x60_security/0002.jpg" alt="" /> + </p> + <p> + Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:<br/> + <img src="../images/x60_security/0003.jpg" alt="" /> + </p> + <p> + You should now have this:<br/> + <img src="../images/x60_security/0004.jpg" alt="" /> + </p> - <p> - The following is a summary of what you will remove (already done to this machine):<br/> - <img src="../images/x60_security/0001_overview.jpg" alt="" /><br/> - Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want - (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and - also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). <b>This is optional</b> - </p> + <p> + The following is a summary of what you will remove (already done to this machine):<br/> + <img src="../images/x60_security/0001_overview.jpg" alt="" /><br/> + Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want + (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and + also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). <b>This is optional</b> + </p> - <p> - Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:<br/> - <img src="../images/x60_security/0001_microphone.jpg" alt="" /><br/> - <b>Rationale:</b><br/> - Another reason to remove the microphone: If your computer gets<a href="#ref1">[1]</a> compromised, it can - record what you say, and use it to receive data from nearby devices if - they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically - be programmed to accept remote commands from some speaker somewhere (remote security hole). <b>In other words, - the machine could already be compromised from the factory.</b> - </p> + <p> + Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:<br/> + <img src="../images/x60_security/0001_microphone.jpg" alt="" /><br/> + <b>Rationale:</b><br/> + Another reason to remove the microphone: If your computer gets<a href="#ref1">[1]</a> compromised, it can + record what you say, and use it to receive data from nearby devices if + they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically + be programmed to accept remote commands from some speaker somewhere (remote security hole). <b>In other words, + the machine could already be compromised from the factory.</b> + </p> - <p> - Remove the modem:<br/> - <img src="../images/x60_security/0001_modem.jpg" alt="" /><br/> - (useless, obsolete device) - </p> + <p> + Remove the modem:<br/> + <img src="../images/x60_security/0001_modem.jpg" alt="" /><br/> + (useless, obsolete device) + </p> - <p> - Remove the speaker:<br/> - <img src="../images/x60_security/0001_speaker.jpg" alt="" /><br/> - Reason: combined with the microphone issue, this could be used to leak data.<br/> - If your computer gets<a href="#ref1">[1]</a> compromised, it can be used to - transmit data to nearby compromised devices. It's unknown if it can be - turned into a microphone<a href="#ref2">[2]</a>.<br/> - Replacement: headphones/speakers (line-out) or external DAC (USB). - </p> + <p> + Remove the speaker:<br/> + <img src="../images/x60_security/0001_speaker.jpg" alt="" /><br/> + Reason: combined with the microphone issue, this could be used to leak data.<br/> + If your computer gets<a href="#ref1">[1]</a> compromised, it can be used to + transmit data to nearby compromised devices. It's unknown if it can be + turned into a microphone<a href="#ref2">[2]</a>.<br/> + Replacement: headphones/speakers (line-out) or external DAC (USB). + </p> - <p> - Remove the wlan (also remove wwan if you have it):<br/> - <img src="../images/x60_security/0001_wlan_wwan.jpg" alt="" /><br/> - Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.<br/> - <b>Wifi:</b> The ath5k/ath9k cards might not have firmware at all. They might safe but could have - access to the computer's RAM trough DMA. If people have an intel - card(most X60s come with Intel wifi by default, until you change it),then that card runs - a non-free firwamre and has access to the computer's RAM trough DMA! So - the risk-level is very high.<br/> - <b>Wwan (3d modem):</b> They run proprietary software and have access to the - computer's RAM! So it's like AMT but over the GSM network which is - probably even worse.<br/> - Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). - </p> + <p> + Remove the wlan (also remove wwan if you have it):<br/> + <img src="../images/x60_security/0001_wlan_wwan.jpg" alt="" /><br/> + Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.<br/> + <b>Wifi:</b> The ath5k/ath9k cards might not have firmware at all. They might safe but could have + access to the computer's RAM trough DMA. If people have an intel + card(most X60s come with Intel wifi by default, until you change it),then that card runs + a non-free firwamre and has access to the computer's RAM trough DMA! So + the risk-level is very high.<br/> + <b>Wwan (3d modem):</b> They run proprietary software and have access to the + computer's RAM! So it's like AMT but over the GSM network which is + probably even worse.<br/> + Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). + </p> - <h2> - Not covered yet: - </h2> - <ul> - <li>Disable cardbus (has fast/direct memory access)</li> - <li>Disable firewire (has fast/direct memory access)</li> - <li>Disable flashing the ethernet firmware</li> - <li>Disable SPI flash writes (can be re-enabled by unsoldering two parts)</li> - <li>Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)</li> - <li>Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)</li> - </ul> + <h2> + Not covered yet: + </h2> + <ul> + <li>Disable cardbus (has fast/direct memory access)</li> + <li>Disable firewire (has fast/direct memory access)</li> + <li>Disable flashing the ethernet firmware</li> + <li>Disable SPI flash writes (can be re-enabled by unsoldering two parts)</li> + <li>Disable use of xrandr/edid on external monitor (cut 2 pins on VGA)</li> + <li>Disable docking station (might be possible to do it in software, in coreboot upstream as a Kconfig option)</li> + </ul> + <p> + Go to <a href="http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html">http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html</a> + or directly to the video: <a href="http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm">http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm</a>. + </p> + <p> + A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. + </p> + + <h2> + Also not covered yet: + </h2> + <ul> + <li> + Intrusion detection: randomized seal on screws<br/> + Just put nail polish with lot of glider on the important screws, take + some good pictures. Keep the pictueres and make sure of their integrity. + Compare the nail polish with the pictures before powering on the laptop. + </li> + <li> + Tips about preventing/mitigating risk of cold boot attack. + <ul> + <li>soldered RAM?</li> + <li>seal RAM door shut (possibly modified lower chassis) so that system has to be disassembled (which has to go through the nail polish)</li> + <li>wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)</li> + <li>ask gnutoo about fallback patches (counts number of boots)</li> + </ul> + </li> + <li> + General tips/advice and web links showing how to detect physical intrusions. + </li> + <li> + For example: <a href="http://cs.tau.ac.il/~tromer/acoustic/">http://cs.tau.ac.il/~tromer/acoustic/</a> + or <a href="http://cyber.bgu.ac.il/content/how-leak-sensitive-data-isolated-computer-air-gap-near-mobile-phone-airhopper">http://cyber.bgu.ac.il/content/how-leak-sensitive-data-isolated-computer-air-gap-near-mobile-phone-airhopper</a>. + </li> + <li> + <a href="https://en.wikipedia.org/wiki/Tempest_%28codename%29">https://en.wikipedia.org/wiki/Tempest_%28codename%29</a> + </li> + <li> + https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: + </li> + </ul> + + </div> + + <div class="section"> + <h1> + Extra notes + </h1> <p> - Go to <a href="http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html">http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html</a> - or directly to the video: <a href="http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm">http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm</a>. + EC: Cannot be removed but can be mitigated: it contains non-free + non-loadable code, but it has no access to the computer's RAM. + It has access to the on-switch of the wifi, bluetooth, modem and some + other power management features. The issue is that it has access to the + keyboard, however if the software security howto <b>(not yet written)</b> is followed correctly, + it won't be able to leak data to a local attacker. It has no network + access but it may still be able to leak data remotely, but that + requires someone to be nearby to recover the data with the help of an + SDR and some directional antennas<a href="#ref3">[3]</a>. </p> <p> - A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. + <a href="http://www.coreboot.org/Intel_82573_Ethernet_controller">Intel 82573 Ethernet controller</a> + on the X60 seems safe, according to Denis. </p> - <h2> - Also not covered yet: - </h2> - <ul> - <li> - Intrusion detection: randomized seal on screws<br/> - Just put nail polish with lot of glider on the important screws, take - some good pictures. Keep the pictueres and make sure of their integrity. - Compare the nail polish with the pictures before powering on the laptop. - </li> - <li> - Tips about preventing/mitigating risk of cold boot attack. + <div class="subsection"> + <h2> + Risk level + </h2> <ul> - <li>soldered RAM?</li> - <li>seal RAM door shut (possibly modified lower chassis) so that system has to be disassembled (which has to go through the nail polish)</li> - <li>wipe all RAM at boot/power-off/power-on? (patch in coreboot upstream?)</li> - <li>ask gnutoo about fallback patches (counts number of boots)</li> + <li>Modem (3g/wwan): highest</li> + <li>Intel wifi: Near highest</li> + <li>Atheros PCI wifi: unknown, but lower than intel wifi.</li> + <li>Microphone: only problematic if the computer gets compromised.</li> + <li>Speakers: only problematic if the computer gets compromised.</li> + <li>EC: can be mitigated if following the guide on software security.</li> </ul> - </li> - <li> - General tips/advice and web links showing how to detect physical intrusions. - </li> - <li> - For example: <a href="http://cs.tau.ac.il/~tromer/acoustic/">http://cs.tau.ac.il/~tromer/acoustic/</a> - or <a href="http://cyber.bgu.ac.il/content/how-leak-sensitive-data-isolated-computer-air-gap-near-mobile-phone-airhopper">http://cyber.bgu.ac.il/content/how-leak-sensitive-data-isolated-computer-air-gap-near-mobile-phone-airhopper</a>. - </li> - <li> - <a href="https://en.wikipedia.org/wiki/Tempest_%28codename%29">https://en.wikipedia.org/wiki/Tempest_%28codename%29</a> - </li> - <li> - https://gitorious.org/gnutoo-for-coreboot/grub-assemble/source/a61f636797777a742f65f4c9c58032aa6a9b23c3: - </li> - </ul> + </div> + </div> - <h1> - Extra notes - </h1> - <p> - EC: Cannot be removed but can be mitigated: it contains non-free - non-loadable code, but it has no access to the computer's RAM. - It has access to the on-switch of the wifi, bluetooth, modem and some - other power management features. The issue is that it has access to the - keyboard, however if the software security howto <b>(not yet written)</b> is followed correctly, - it won't be able to leak data to a local attacker. It has no network - access but it may still be able to leak data remotely, but that - requires someone to be nearby to recover the data with the help of an - SDR and some directional antennas<a href="#ref3">[3]</a>. - </p> - <p> - <a href="http://www.coreboot.org/Intel_82573_Ethernet_controller">Intel 82573 Ethernet controller</a> - on the X60 seems safe, according to Denis. - </p> - - <h2> - Risk level - </h2> + <div class="section"> + <h1> + Further reading material (software security) + </h1> <ul> - <li>Modem (3g/wwan): highest</li> - <li>Intel wifi: Near highest</li> - <li>Atheros PCI wifi: unknown, but lower than intel wifi.</li> - <li>Microphone: only problematic if the computer gets compromised.</li> - <li>Speakers: only problematic if the computer gets compromised.</li> - <li>EC: can be mitigated if following the guide on software security.</li> + <li><a href="../gnulinux/encrypted_trisquel.html">Installing Trisquel GNU/Linux with full disk encryption (including /boot)</a></li> + <li><a href="../gnulinux/encrypted_parabola.html">Installing Parabola GNU/Linux with full disk encryption (including /boot)</a></li> + <li><a href="dock.html">Notes about DMA access and the docking station</a></li> </ul> + </div> - <h1> - Further reading material (software security) - </h1> - <ul> - <li><a href="../gnulinux/encrypted_trisquel.html">Installing Trisquel GNU/Linux with full disk encryption (including /boot)</a></li> - <li><a href="../gnulinux/encrypted_parabola.html">Installing Parabola GNU/Linux with full disk encryption (including /boot)</a></li> - <li><a href="dock.html">Notes about DMA access and the docking station</a></li> - </ul> + <div class="section"> + <h1> + References + </h1> + <div class="subsection"> + <h2 id="ref1">[1] physical access</h2> + <p> + Explain that black hats, TAO, and so on might use a 0day to get in, + and explain that in this case it mitigates what the attacker can do. + Also the TAO do some evaluation before launching an attack: they take + the probability of beeing caught into account, along with the kind of + target. A 0day costs a lot of money, I heard that it was from 100000$ + to 400000$, some other websites had prices 10 times lower but that + but it was probably a typo. So if people increase their security it + makes it more risky and more costly to attack people. + </p> + </div> + <div class="subsection"> + <h2 id="ref2">[2] microphone</h2> + <p> + It's possible to turn headphones into a microphone, you could try + yourself, however they don't record loud at all. Also intel cards have + the capability to change a connector's function, for instance the + microphone jack can now become a headphone plug, that's called + retasking. There is some support for it in GNU/Linux but it's not very + well known. + </p> + </div> + <div class="subsection"> + <h2 id="ref3">[3] Video (CCC)</h2> + <p> + 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While + their demo is experimental(their hardware also got damaged during the + transport), the spies probably already have that since a long time. + <a href="http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm">http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm</a> + </p> + </div> + </div> - <h1> - References - </h1> - <h2 id="ref1">[1] physical access</h2> - <p> - Explain that black hats, TAO, and so on might use a 0day to get in, - and explain that in this case it mitigates what the attacker can do. - Also the TAO do some evaluation before launching an attack: they take - the probability of beeing caught into account, along with the kind of - target. A 0day costs a lot of money, I heard that it was from 100000$ - to 400000$, some other websites had prices 10 times lower but that - but it was probably a typo. So if people increase their security it - makes it more risky and more costly to attack people. - </p> - <h2 id="ref2">[2] microphone</h2> - <p> - It's possible to turn headphones into a microphone, you could try - yourself, however they don't record loud at all. Also intel cards have - the capability to change a connector's function, for instance the - microphone jack can now become a headphone plug, that's called - retasking. There is some support for it in GNU/Linux but it's not very - well known. - </p> - <h2 id="ref3">[3] Video (CCC)</h2> - <p> - 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While - their demo is experimental(their hardware also got damaged during the - transport), the spies probably already have that since a long time. - <a href="http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm">http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm</a> - </p> + <div class="section"> -<hr/> - - <p> - Copyright © 2014 Francis Rowe <info@gluglug.org.uk><br/> - This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. - A copy of the license can be found at <a href="../license.txt">../license.txt</a>. - </p> + <p> + Copyright © 2014, 2015 Francis Rowe <info@gluglug.org.uk><br/> + This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at <a href="../license.txt">../license.txt</a>. + </p> - <p> - This document is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See <a href="../license.txt">../license.txt</a> for more information. - </p> + <p> + This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See <a href="../license.txt">../license.txt</a> for more information. + </p> + + </div> </body> </html> |