Cybersecurity specialists at CyberCX have demonstrated a easy technique for persistently accessing older BIOS-locked laptops by shorting pins on the EEPROM chip with a screwdriver, enabling full entry to the BIOS settings and bypassing the password. Tom’s {Hardware} stories: Earlier than we go additional, it’s price stating that CyberCX’s BIOS password bypass demonstration was accomplished on a number of Lenovo laptops that it had retired from service. The weblog reveals that the simply reproducible bypass is viable on the Lenovo ThinkPad L440 (launched This autumn 2013) and the Lenovo ThinkPad X230 (launched Q3 2012). Different laptop computer and desktop fashions and types which have a separate EEPROM chip the place passwords are saved could also be equally susceptible. […] From studying numerous documentation and analysis articles, CyberCX knew that it wanted to observe the next course of on its BIOS-locked Lenovo laptops: Find the proper EEPROM chip; Find the SCL and SDA pins; and Quick the SCL and SDA pins on the proper time.
Checking seemingly trying chips on the mainboard and searching up sequence numbers ultimately result in with the ability to goal the proper EEPROM. Within the case of the ThinkPad L440, the chip is marked L08-1 X (this will likely not all the time be the case). An embedded video within the CyberCX weblog publish reveals simply how simple this ‘hack’ is to do. Shorting the L08-1 X chip pins requires one thing so simple as a screwdriver tip being held between two of the chip legs. Then, when you enter the BIOS, it is best to discover that every one configuration choices are open to be modified. There’s mentioned to be some timing wanted, however the timing is not so tight, so there’s some latitude. You possibly can watch the video for a little bit of ‘method.’
CyberCX contains some fairly in-depth evaluation of how its BIOS hack works and explains that you could’t simply brief the EEPROM chips immediately as you flip the machine on (therefore the necessity for timing). Some readers could also be questioning about their very own laptops or BIOS-locked machines they’ve seen on eBay and so forth. CyberCX says that some fashionable machines with the BIOS and EEPROM packages in a single Floor Mount System (SMD) can be tougher to hack on this manner, requiring an “off-chip assault.” The cyber safety agency additionally says that some motherboard and system makers do certainly already use an built-in SMD. These notably anxious about their information, quite than their system, ought to implement “full disk encryption [to] stop an attacker from acquiring information from the laptop computer’s drive,” says the safety outfit.
