Is it possible to make a laptop useless to thieves?

Question

I was robbed...

That included my Linux notebook and my company's notebook. Both are encrypted. Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has been started by the UEFI. But Secure Boot was disabled on the machine.

The company uses Bitlocker in Transparent Operation Mode. They claim the computer would not boot if the hardware configuration is changed, and it was an HP notebook, which has special extra security.

However, for the thief who's not much interested in data, all this is not very concerning. On my setup, a simple USB stick containing an OS would allow them to reinstall an OS on the drive and sell the notebook. If I had activated the Secure Boot and set a password on the BIOS, it could have been more complicated. But not impossible. Whatever the security layer, all that is needed is to unplug the CMOS battery for long enough to reset the BIOS settings, and all that extra layer is gone.

One could think that the company's computer is a bit more secure, but recent issues with a patch by Microsoft showed that actually a reset of the BIOS is still possible to get access to the computer (not necessarily the data).

My new laptop has Secure Boot and a TPM (ASUS UX433 if that matters, but my question is more generic). Is it possible to configure the UEFI and TPM so that a tampering of the configuration really locks the computer to those that doesn't have the necessary (recovery) secret?

(Let's consider for the question that really complicated manipulations such as unsoldering and replacing a complete component is outside of the scope. The issue here is rather that it is actually simple to reset the CMOS. On my desktop computer, it is even worse: moving a jumper at boot is enough, and it is well documented in the manual!)

Answer 1

First of all, my condolences for your loss! Hope you're alright.

If I understood correctly, your general concern is how to totally prevent further stolen device usage (and/or sale) by a criminal.

In this case, this question won't ever have any answer that would age well, because whenever your machine becomes unreachable physically, the only way to ensure no further damage is to nuke it from orbit.

And, in any case, even with the Apple's "Find My Mac" service (or with the "Find My Device" feature of Windows 10), you definitely wouldn't be able to prevent disassembling your laptop and selling the components as spare parts.

Note that the laptops deemed hard to resell in one piece, like Macbooks, are known to be easy to sell disassembled for pricey spare parts; therefore, there's no specific advantage to Macbooks here. (Apple constantly makes its devices harder and harder to fix and repair, so, like I said, this answer won't age well.)

Apart from that, depending on the particular laptop model and the hardware configuration, there may be different ways (with different level of reliability) to brick the device or its components. In general, those matters have something in common with re-flashing some of the built-in devices. If you're really concerned, you may even try to pick a laptop which is easy to kill with software; generally, googling might help you here.

There would hardly appear any initiative by the laptop vendors for making their devices easier to brick, because:

• Making a device sustainable against physical access and damage is enormously costly and is effectively a never-ending arms race, as the DRM initiative quite clearly shows us;

• It doesn't look like that's the incentive of the laptop vendors who won't really earn a lot in this battle (actually, probably quite vice versa).

The simplest way to brick a device in case of a thieft and an arbitrary laptop is probably to attach a yellow Post-it to your laptop with something on the lines of password: 123 on it, and to run a bricking script when the incorrect password is entered. This won't be reliable, and nothing would be, but this would probably work in most of the cases.

Answer 2

Sorry to hear about that. Hope your backups were up to date.

There are several things to ponder here before going this route.

First one is the discussion about if you really want to brick it as opposed to making the laptop seem to work for the thief (while it does not allow access to anything sensitive) but in a way that phones home and may let you end up recovering the hardware (hint: some laptops have an internal slot for a SIM card).

Second is the amount of complicated manipulations you are comfortable doing to recover your own system when the it falsely concluded that it has been robbed. Perhaps an employee reports the company laptop as stolen, so you trigger the quantum kill-switch for that device, which melts all its internal components. Next day he finds the "stolen" laptop on his car. Even with no user at fault, there will be some random misdetection. Plus you will want to test your bricking at least once.

Since you probably don't want to spend the cost of several laptops for it, you should be aware. It's the old tradeoff between making things hard for the attacker and bearing it off yourself. And the risk between an attacker accessing unauthorized data vs you losing access yo your own data. If you are the NSA, the option for bricking would be clear but often there is a wish to make that hardware -that you were bricking on purpose- work again.

‎

You still want to go on the bricking path? Good. It's possible that some manufacturer has some solution where there is a configuration in the TPM chip able to brick the hardware. Here I am providing a much simpler solution, however, that should be available to everyone.

Our goal is to brick the system if the Boot protection was disabled. Thus, I simply propose to check, early at the boot process (as a GRUB module?), whether the BIOS was tampered with and, in such case, wipe the LUKS header and "update" the firmware with a code that will effectively brick it, requiring those "complicated manipulations" to fixup.

It may be possible to reset the BIOS and enter its configuration quick enough, but more often than not, such early boot code would run.

How to detect if the CMOS was reset? A really simple way, available for any implementation, would be a current time check. As the date time will be reset to some early epoch, if it was earlier than some known date when you installed it (e.g. before 2020), you detect that time went backwards, assume it is a tampering attempt and brick the computer.

A more advanced check -and specific to your UEFI firmware, probably- would be to read some parameters from its memory and compare them with the known ones that should be configured. Bonus if you actually store a key there in some unused portion. Note that the verification code doesn't even need to know the "key" (which will be lost on reset), only a hash of it (note that unlike most cases, here we need it to be computed quickly).