From 4b0287c46f10e12dd80d13acba930b0f64532a65 Mon Sep 17 00:00:00 2001 From: Leah Rowe Date: Sat, 3 Sep 2016 17:32:43 +0100 Subject: docs: move hw security documents to hw maintenance section --- docs/hardware/x60_security.html | 344 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 344 insertions(+) create mode 100644 docs/hardware/x60_security.html (limited to 'docs/hardware/x60_security.html') diff --git a/docs/hardware/x60_security.html b/docs/hardware/x60_security.html new file mode 100644 index 00000000..ba82bca9 --- /dev/null +++ b/docs/hardware/x60_security.html @@ -0,0 +1,344 @@ + + + + + + + + + Libreboot documentation: Security on the ThinkPad X60 + + + + +
+

Security on the ThinkPad X60

+

Hardware modifications to enhance security on the ThinkPad X60. This tutorial is incomplete at the time of writing.

+

Back to previous index

+
+ +
+

Table of Contents

+ +
+ +
+ +

Hardware requirements

+ + +

Software requirements

+ + +
+ +
+ +

+ Rationale +

+

+ Most people think of security on the software side: the hardware is important aswell. +

+

+ This tutorial deals with reducing the number of devices that have direct memory access that + could communicate with inputs/outputs that could be used to remotely + command the system (or leak data). All of this is purely theoretical for the time being. +

+ +

Disassembly

+ +

+ Firstly remove the bluetooth (if your X60 has this):
+ The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):
+
+ Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):
+
+

+ +

+ If your model was WWAN, remove the simcard (check anyway):
+ Uncover those 2 screws at the bottom:
+
+ SIM card (not present in the picture) is in the marked location:
+
+ Replacement: USB dongle. +

+ +

+ Now get into the motherboard. +

+ +

+ Remove those screws:
+ +

+

+ Push the keyboard forward (carefully):
+ +

+

+ Lift the keyboard up and disconnect it from the board:
+ +

+

+ Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
+ +

+

+ You should now have this:
+ +

+ +

+ The following is a summary of what you will remove (already done to this system):
+
+ Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want + (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and + also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). This is optional +

+ +

+ Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:
+
+ Rationale:
+ Another reason to remove the microphone: If your computer gets[1] compromised, it can + record what you say, and use it to receive data from nearby devices if + they're compromised too. Also, we do not know what the built-in microcode (in the CPU) is doing; it could theoretically + be programmed to accept remote commands from some speaker somewhere (remote security hole). In other words, + the system could already be compromised from the factory. +

+ +

+ Remove the modem:
+
+ (useless, obsolete device) +

+ +

+ Remove the speaker:
+
+ Reason: combined with the microphone issue, this could be used to leak data.
+ If your computer gets[1] compromised, it can be used to + transmit data to nearby compromised devices. It's unknown if it can be + turned into a microphone[2].
+ Replacement: headphones/speakers (line-out) or external DAC (USB). +

+ +

+ Remove the wlan (also remove wwan if you have it):
+
+ Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
+ Wifi: The ath5k/ath9k cards might not have firmware at all. They might safe but could have + access to the computer's RAM trough DMA. If people have an intel + card(most X60s come with Intel wifi by default, until you change it),then that card runs + a non-free firwamre and has access to the computer's RAM trough DMA! So + the risk-level is very high.
+ Wwan (3g modem): They run proprietary software! It's like AMT but over the GSM network which is + probably even worse.
+ Replacement: external USB wifi dongle. (or USB wwan/3g dongle; note, this has all the same privacy issues as mobile phones. wwan not recommended). +

+ +

+ Not covered yet: +

+ +

+ Go to http://media.ccc.de/browse/congress/2013/30C3_-_5529_-_en_-_saal_2_-_201312271830_-_hardening_hardware_and_choosing_a_goodbios_-_peter_stuge.html + or directly to the video: http://mirror.netcologne.de/CCC/congress/2013/webm/30c3-5529-en-Hardening_hardware_and_choosing_a_goodBIOS_webm.webm. +

+

+ A lot of this tutorial is based on that video. Look towards the second half of the video to see how to do the above. +

+ +

+ Also not covered yet: +

+ + +
+ +
+

+ Extra notes +

+

+ EC: Cannot be removed but can be mitigated: it contains non-free + non-loadable code, but it has no access to the computer's RAM. + It has access to the on-switch of the wifi, bluetooth, modem and some + other power management features. The issue is that it has access to the + keyboard, however if the software security howto (not yet written) is followed correctly, + it won't be able to leak data to a local attacker. It has no network + access but it may still be able to leak data remotely, but that + requires someone to be nearby to recover the data with the help of an + SDR and some directional antennas[3]. +

+

+ Intel 82573 Ethernet controller + on the X60 seems safe, according to Denis. +

+ +
+

+ Risk level +

+
    +
  • Modem (3g/wwan): highest
    • +
  • Intel wifi: Near highest
    • +
  • Atheros PCI wifi: unknown, but lower than intel wifi.
    • +
  • Microphone: only problematic if the computer gets compromised.
    • +
  • Speakers: only problematic if the computer gets compromised.
    • +
  • EC: can be mitigated if following the guide on software security.
    • +
+
+
+ +
+

+ Further reading material (software security) +

+ +
+ +
+

+ References +

+
+

[1] physical access

+

+ Explain that black hats, TAO, and so on might use a 0day to get in, + and explain that in this case it mitigates what the attacker can do. + Also the TAO do some evaluation before launching an attack: they take + the probability of beeing caught into account, along with the kind of + target. A 0day costs a lot of money, I heard that it was from 100000$ + to 400000$, some other websites had prices 10 times lower but that + but it was probably a typo. So if people increase their security it + makes it more risky and more costly to attack people. +

+
+
+

[2] microphone

+

+ It's possible to turn headphones into a microphone, you could try + yourself, however they don't record loud at all. Also intel cards have + the capability to change a connector's function, for instance the + microphone jack can now become a headphone plug, that's called + retasking. There is some support for it in GNU/Linux but it's not very + well known. +

+
+
+

[3] Video (CCC)

+

+ 30c3-5356-en-Firmware_Fat_Camp_webm.webm from the 30th CCC. While + their demo is experimental(their hardware also got damaged during the + transport), the spies probably already have that since a long time. + http://berlin.ftp.media.ccc.de/congress/2013/webm/30c3-5356-en-Firmware_Fat_Camp_webm.webm +

+
+
+ +
+ +

+ Copyright © 2014, 2015 Leah Rowe <info@minifree.org>
+ Permission is granted to copy, distribute and/or modify this document + under the terms of the GNU Free Documentation License, Version 1.3 + or any later version published by the Free Software Foundation; + with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. + A copy of the license can be found at ../gfdl-1.3.txt +

+ +

+ Updated versions of the license (when available) can be found at + https://www.gnu.org/licenses/licenses.html +

+ +

+ UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE + EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS + AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF + ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS, + IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION, + WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR + PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS, + ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT + KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT + ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU. +

+

+ TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE + TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, + NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT, + INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES, + COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR + USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN + ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR + DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR + IN PART, THIS LIMITATION MAY NOT APPLY TO YOU. +

+

+ The disclaimer of warranties and limitation of liability provided + above shall be interpreted in a manner that, to the extent + possible, most closely approximates an absolute disclaimer and + waiver of all liability. +

+ +
+ + + -- cgit v1.2.3-70-g09d2