What does the security chip in the IBM Thinkpad actually do?
Looking at a IBM Thinkpad X40 specifications- I see something listed as a security chip. Anyone got a clue what it does? Does it apply encryption or secured communication of the data or what? Thank you.
Popular Topics in General IT Security
Actually, it looks like some kind of pre-TPM hardware authentication platform- http://www.thinkwiki.org/wiki/Embedded_Security_Subsystem Opens a new window
» The purpose of the Embedded Security Subsystem is to keep the user’s sensitive data out of range from software based attacks (like viruses, Internet attacks etc.). One way the chip offers to achieve this is by providing storage for keys along with the necessary functions to handle them within itself, so that a for example a private key never has to leave the chip (can’t be seen by any piece of software). Besides this, there are more complex topics covered by the functionality of the chip. If you want to find out more about it you can find good documents on the IBM Research TCPA resources page Opens a new window .»
6 Replies
I would imagine it is some kind of smart card reader, this thing is too old for TPM Opens a new window
Actually, it looks like some kind of pre-TPM hardware authentication platform- http://www.thinkwiki.org/wiki/Embedded_Security_Subsystem Opens a new window
» The purpose of the Embedded Security Subsystem is to keep the user’s sensitive data out of range from software based attacks (like viruses, Internet attacks etc.). One way the chip offers to achieve this is by providing storage for keys along with the necessary functions to handle them within itself, so that a for example a private key never has to leave the chip (can’t be seen by any piece of software). Besides this, there are more complex topics covered by the functionality of the chip. If you want to find out more about it you can find good documents on the IBM Research TCPA resources page Opens a new window .»
apiercy 
VirtueTech is an IT service provider.
It increases revenue for Lenovo.
Seriously though, it was encryption related if I recall correctly. The main feature was that it encrypted bios passwords making them much more secure and thus making the hard drive data harder to access without the chip.
Yeah its bundled with software inside. I remember fixing a computer and disabling IBM services from starting up and it stopped booting because it didn’t receive credentials from its own password manager. I had to boot to a live disk to get it back up and get the password for the specific IBM application
It could be a TPM chip or something similar used for storing encryption keys.
greg schulz
Rdavid wrote:
Looking at a IBM Thinkpad X40 specifications- I see something listed as a security chip. Anyone got a clue what it does? Does it apply encryption or secured communication of the data or what? Thank you.
Link for the specifications > http://www.cnet.com/laptops/lenovo-thinkpad-x40-2372/4507-3121_7-31412740.html Opens a new window
@Rdavid if you are referring to the same security chip that I have in my T61/X61/X1s that attaches to the finger print reader, then its for supporting the bio metric scanner. For example instead of typing in my password, I swipe my finger over the reader and it maps that to my password. As others have mentioned there is also the TPM that is used for supporting other apps such as bit locker among others.
This topic has been locked by an administrator and is no longer open for commenting.
To continue this discussion, please ask a new question.
Read these next.
Non-Profit Virtual Machine Windows Server Questions (Licensing & Best practice)
Please bear with me as I explain the context of my questions:I have a non-profit customer that is currently running a physical server that is due to be replaced that was purchased exclusively to run their accounting software package Abila MIP Fund Account.
Are you still working from home (May 29th, 2023)?
I'm still WFH indefinitely / for good (and I like it that way). Please keep rants in the comments to a minimum, thanks. =)
Spark! Pro Series — 30 May 2023
Today in History: 30 May 1431 – Joan of Arc is burned at the stake by an English-dominated tribunal in Rouen, France 1635 – The Peace of Prague signed between the Habsburg Emperor Ferdinand II and the Electora.
Snap! — CDs, AI, WhatsApp, Dragons, and Computex
Your daily dose of tech news, in brief. Welcome to the Snap! Flashback: May 30, 1896: First recorded automobile accident (Read more HERE.) Bonus Flashback: May 30, 1987: CD-V (Compact Disc Video) format introduced by Phillips (Read more H.
IT Spending: Where is it going?
Global IT spending has been increasing since 2015, with some large jumps in recent years. It's a generally positive trend, but for people who are actually working in the IT Space, where is it going? Are companies hiring more people, or just pouring more.
3 Ways to Unlock BIOS (UEFI) Password on Lenovo ThinkPad Laptop
If you set a supervisor password on your BIOS setup, you will be prompted to enter this password before accessing BIOS setup settings. However, if you forgot BIOS password in Lenovo laptop, how to enter BIOS setup settings? How to reset or clear the forgotten password?
When you get problem with your laptop, you had better contact with the manufacture support and ask for their recommended methods to unlock your BIOS setup settings. But as I see in the official site of Lenovo laptop, they can’t help to reset your BIOS password if you forgot the old password, they will recommend you to have the system board replaced.
If the Lenovo Service Support can’t help you to unlock your BIOS password, you can try with the methods below. Can try on Lenovo ThinkPad, IdeaPad, Yoga, and other series of Lenovo laptops.
Use the backdoor password
There is a backdoor password built-in to the BIOS by the manufacture. It is hidden, so we can’t see it normally, but we can try to find it out on the master password site.
1. Power on laptop, press F1 key to boot up BIOS entry screen.
2. On the password text box try with three passwords, if all these three passwords are incorrect, you will be blocked with the screen «System Disabled» . And you will get a code to get the backdoor password. Write this code down.
3. Go to another computer with internet connected, open this site: https://bios-pw.org/.
4. Enter the code you get on the System Disable screen and click on Get password .
5. You will get a list of passwords. Go to your laptop, restart it and press F1 key to boot to the BIOS entry screen again, and then try with the list of passwords one by one. But you only be able to enter three incorrect passwords before your system is locked. Good luck with you!
If you can’t find your backdoor password, try with the methods below.
Remove CMOS battery
1. Power off your Lenovo laptop, disconnect with the power source, unplug all of the cables from laptop.
2. Remove the battery from laptop, and then remove the bottom of the laptop’s case.
3. Find the CMOS battery, and remove the CMOS battery from laptop gently. This will reset BIOS settings to default settings, thereby clear BIOS password.
4. Wait for an hour, place the CMOS battery back in its slot again, and reassemble laptop.
5. Turn on the laptop, press F1 key repeatedly, you will get into Lenovo/ThinkPad BIOS settings without entering password.
Short circuit SDA and SCL in security chip
1. Power off laptop, disconnect with the power source, disassemble laptop. (Pay attention to the screw model and location, you can take a photo with it. Or if the machine assemble is completed, but you find that there are still a few small screws left, you will have a headache.)
2. When disassemble the laptop, find the chip. It is on the back of the motherboard. Grasp the plastic frame and turn the motherboard over, you will see it. As the picture below, the chip is in the red circle.
3. To short circuit the chip, you need to power on and boot the laptop. So, after you find the SCL and SDA, connect the hard drive, battery, keyboard, display screen, and the other basic components with laptop.
4. Connect with the power adapter and turn on laptop. As soon as the keyboard light is on, short circuit the SCL and SDA.
5. If it goes well, you will get into BIOS smoothly without asking password. If not, you will need to try several times.
6. When get into BIOS settings, reset BIOS password. If it is unnecessary, you can disable the Supervisor Password on BIOS, in case, you forget BIOS password on your laptop again.
7. At last, remember to press F10 to exit and save the change.
8. After your BIOS password is unlocked successfully, power off laptop, reassemble your laptop.
Lenovo and BIOS Settings
Lenovo has provided numerous series of devices, which apparently do not have an aligned standard of handling BIOS / UEFI settings or BIOS / UEFI upgrades. As part of this headache and to ease the burden of jumping between the different device types I started to dive in to harmonize our scripts. As previously written Lenovo has a few odd design decisions – you can for example not reduce security via script. To disable TPM or SecureBoot you would be required to alter this via a keyboard. However, setting the initial password (increasing the security) also requires that you do this by manually typing it into the settings. In addition to the above challenges I reached the following conclusion;
1. It is most likely only relevant to enable any setting.
2. Handling passwords stinks (setting them etc)
3. Settings between different models in a series can vary by name and vary by name of the possible values to set
4. WMI-classes used differs between series (ThinkStation, ThinkPad and ThinkCentre)
For example, ThinkPad has the GetBIOSSelections class, which can present the different possibilities for a specific setting. However, ThinkCentre does not have this class, but instead present options via a [bracket] indicator in the output of the currentsetting.
How would one deal with all this mess?
Two functions are provided – one for figuring our howto enable a specific setting. The other one for setting each setting. Its ugly – as the more models, bios-versions and whatnot I get a hold of the uglier variations of this I find. The initial attempt was to keep it as generic as possible.The best way to explain what I have todo sometimes;
TPM? You can call it one of these: 'TCG*Security*Feature*','Security*Chip*','TCG*Security*Device*'
It can be set to active, but not if the option Enable or Enabled is there. And Security Chip may be one option, however if it is read-only – use TCG Security Feature— Nicke Källén (@znackattack) June 20, 2018
Lenovo ThinkPad X230
To update the firmware on the device, get the latest bootable CD and follow the steps in Flashing BIOS from Linux#Bootable optical disk emulation.
Display
If you experience that your brightness setting is not restored on resume from suspend, then create config:
HD Graphics 4000 supports external 4K display and audio via display port to HDMI adapter, but requires to add 4K mode manually [1]
Input devices
Sound control buttons
The red LED mute indicators light up automatically, if the corresponding channel is muted in alsamixer. The easiest way to make buttons work is to install PulseAudio and its plugin for your desktop environment.
-
— works out of the box — install pulseaudio , xfce4-pulseaudio-plugin , add plugin to panel and reboot. Additionally xfce4-pulseaudio-plugin uses pavucontrol as mixer and xfce4-notifyd for sound level popups
- Handle ACPI events with acpid the hard way. Some functions like thinkpad-mutemic are implemented in thinkpad-scriptsAUR .
X230T (tablet version)
Wacom tablet input
Works out of the box with xf86-input-wacom . See Wacom tablet.
Multitouch screen for the X230t
Some X230t models have a multitouch screen in addition to the Wacom tablet. Works out of the box with xf86-input-libinput .
Touchpad
Under certain circumstances, the touchpad may behave very jumpily. Ubuntu Bugtracker offers a solution for this issue. Install Touchpad Synaptics and create the following file:
OpenCL
Thinkpad X230 based on Intel Ivy Bridge (3rd generation) platform which meets OpenCL 1.2 specification. Unfortunately GPU support in Linux is broken, so beignet AUR and intel-opencl AUR will not work. Use CPU-only intel-opencl-runtime AUR instead.
OpenCL computation performance differ between CPU and GPU, depending on task. In many cases GPU is preferable. For Core(TM) i5-3210M CPU, which incorporates HD Graphics 4000 GPU:
- GPU hashcat -m2500 -b -D 2 —force reports 3095 H/s (checked in Windows)
- CPU hashcat -m2500 -b -D 1 reports only 2660 H/s, which is the same as no-OpenCL aircrack-ng -S
In this example OpenCL does not give any advantage, and it is better to look for other options such as building native binaries for your system.
Power Saving
Users of TLP need to pay attention to a hardware bug according to which it is recommended to only use either the upper or lower charging threshold. The following configuration is recommended by the developer of TLP.[2]
Laptop incorporates InsydeH2O® UEFI BIOS with classic text interface. It supports UEFI with Secure Boot, UEFI-CSM and Legacy BIOS modes.
Boot configuration
UEFI boot options can be safely (no bricking) set with efibootmgr or UEFI Shell v2 (checked with BIOS 2.77 (G2ETB7WW) EC 1.15). Though you can delete any boot variable, so be careful!
X230 in UEFI-non-CSM mode installed with EFISTUB on SSD disk boots into display manager in less than 25 seconds. Small ESP (100 MiB fat32) also supported.
USB UEFI update
All official updates, including Windows utility, Bootable CD and documentation can be found here. You can use geteltorito AUR to create bootable USB images from the Bootable CD:
Insert USB stick, reboot and press F12 , choose your USB. Follow the instructions.
Trusted Platform Module
Laptop has dedicated TPM 1.2 chip onboard[3] [dead link 2023-04-24 ⓘ] [4]. It does not looks like it can be upgraded to TPM 2.0. Chip itself disabled by default sometimes, also owner clearing will not appear without Supervisor password set:
- Enter Thinkpad UEFI Setup by pressing F1
- Set Security > Password > Supervisor password
- Set Security > Security Chip > Security Chip [Active]
- Save settings by pressing F10 and reboot
- Turn laptop off, turn on and UEFI option Security > Security Chip > Clear Security Chip eventually will appear.
Process described in «ThinkPad X230 and X230i User Guide», Chapter 4. Security > Setting the security chip.