Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I just checked the first version of BIOS update for the X60 available from Lenovo's site and... damnit, it has the option ROM! My X60 is not with me at the moment but I know I never updated the BIOS since I bought it so it should have the very first version that was released, and it's possible that Lenovo silently modified their previous versions to incorporate Computrace. No signs of it being activated (yet).

phdecomp + phnxdeco worked to unpack the BIOS into its modules; it shouldn't be difficult to reassemble it without the Computrace module and fix up the checksum, then reflash. But on the other hand, since the C&C server can be modified, maybe it might be more fun to activate it after pointing it to a server I own, and then I get a free backdoor that I can use...



I did exactly that many years ago, also with a X60T. The redirection works perfectly. It's documented it here: http://corelabs.coresecurity.com/index.php?module=Wiki&actio...

Also, in Blackhat 2014 Anibal (one of the original core researchers) will present a complete reversing of the computrace protocol.


told you so :-/ If you run bios-extract on a dump of your x60t, you'll see Computrace is in 2E_0.rom.

I have no idea on how to reassemble the pieces into a working bios. It's not just a checksum, that's for people doing SLIC ie replacing or adding stuff at the bottom. A missing table in the middle might cause problems. Isn't there an index too?

Anyway, the alternative hack you suggest would be quite a cool one :-) I didn't know it was possible to change the address of the c&c in the option rom (IIRC, it's like packed in an EFI header, then again - I just don't know which tools to use), but if it's, I'd be quite interested - even more if the computrace protocol has ben reverse engineered ;-)

Feel free to contact me by email!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: