Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

A BIOS admin password is meant to stop actors on a computer from doing anything. It stops someone from controlling the boot order, disabling secure boot, or changing the configurations.

There are many ways to break through BIOS. Master passwords for things like bios-pw.org, modifying the BIOS flash to put the device into manufacturing mode, and more.

The authors of this post were reproducing public research from pre-boot DMA attacks on an HP machine and were curious if this would work on a Dell machine. To do this, they needed to know how the passwords were encrypted on the BIOS. After reverse engineering storage framework, they found it was a simple XOR cipher.

They were reading the flash after setting a new password. Most of it was just null byte padding while the rest of it was the encrypted password. 0x00 ^ key = key. So, the null bytes of the 20 byte key are in the data! Even if it wasn't fully there, it's still reasonable to brute force a few of the bytes. Even worse, because it stores the password history it's likely that one of the passwords was 12 bytes or less.

The encryption key is just a. repeating XOR 20 byte key. Even if you couldn't leak this key, the key generation is flawed. The seed is fixed per device, and there are only 256 possible keys per device. The XOR key is a fixed per-device seed, a GUID variable defined in readable flash, and the first byte of the password. It appears that this key is generated at boot, so it's not stored. So, it's reasonable to brute force this too.

The vulnerability is cool but the article is WAY too long. It just goes through the same content, but in greater in greater detail throughout the article. This could have been much shorter, and I wish it was. The vulnerability makes compromise of the computer trivial, and it's pretty cool to see cryptography related issues like this one!