Thinkpads Forum

I wonder how one might tell if a virus/worm/whatever nuked firmware. I mean, I assume it's my T42 motherboard that just took a dive, because I've tried two different hard drives and the machine hoses up intermittently before-during-after the BIOS/OS load – before-during-after a CD boot Memory test. (Bad memory and motherboard are about synonymous on this older machine. Cheaper to just buy a whole used machine vs. replace memory – no?)

The machine might not boot at all. It might hang. The machine might reboot out of nowhere. The machine might just click-click-click-click – which I always assumed was a bad hard drive, but this happened right-off with a completely different installed hard drive, and the sound seems to be coming from … not the HD, relative to a bewildered glance at the bottom of my completely assembled hitherto working laptop.

The only thing consistent is the complete utter lack of repeatability in failure – generally always immediately (fan, but no BIOS screen) or within 2min to 5min in the middle of whatever you're doing.

At first I did the universal fix – I stuck the laptop (or a desktop HD) in the freezer for 45min, took it out and booted and hurriedly moved all my data to a USB – which worked fine (as it always does) – but the machine is still hosed.

Everything seems fine, then I move the laptop screen, which torques the frame – crash. It's got “bad motherboard” written all over it.

That said, I'm wondering if such things happen, in this Snowden-NSA-Cyberwarefare era? Do hackers “brick” laptops/desktops vs. nuke the HD? I've just never thought of that before. I always thought the worst case scenario was a reformatted HD (or being a long-term gimp muppet.)

Are there stats on this? Can it even happen? How could you even know if you were hacked and your firmware blendered?


(Note: this post is an addendum to this post - http://forum.thinkpads.com/viewtopic.php?f=18&t=111804 – but I didn't want to confuse the thread.)

The answer to your question (which is unrelated to the rest of your post), is "yes, but very rarely".

The reason is that a hacker's means to do damage is viruses/trojans/malware, all of which is software. Interfaces between software and BIOS/firmware tend to be: (a) proprietary to the system, (b) poorly documented (and that's intentional).

This means that to make a successful hack that accesses BIOS/FW through software and damages it somehow is pretty hard, and it is likely that it will only work on very specific systems, unless you really write a complicated piece of software that involves detection of the system in question and applying different hacks depending on the system.

So - it's possible, but difficult, and therefore uncommon.

But it has been done in the past. One famous example:
http://en.wikipedia.org/wiki/CIH_%28com ... _specifics

Your T42 is just suffering (like thousands before you) from a bad Southbridge chip.
It's abig Intel chip under the wifi-card, that is connected via ca. 650 solder balls to the motherboard.
Flexing the laptop will cause 1 or more of these balls to disconnect, eventually causing crashing and the likes.
The laptop has been lifted once too many by just a corner, instead of with two hands.
No hackers were involved here (just your fantasy).

Thank you for the detailed info guys. Spot on!


(Re: bad motherboard..Yeah – I flip laptops around here and there with four-fingers more often than with two hands.)