hamish coleman wrote:As the result of CVE-2019-6171, it looks like newer Lenovo firmware update files are adding a digital signature. If you upgrade to a version using this, you will not be able to patch your EC.
Basically, any BIOS update package where the changelog mentions CVE-2019-6171 will have this lockdown.Code: Select all
laptop last good first locked version t430 t430 BIOS 2.81 (G1ETC1WW) EC 1.13 (G1HT35WW) t430 BIOS 2.82 (G1ETC2WW) EC 1.14 (G1HT36WW)
Lenovo is tracking their response to this CVE at: https://support.lenovo.com/gb/en/solutions/len-27764
Take a look at our
ThinkPads.com HOME PAGE
For those who might want to contribute to the blog, start here: Editors Alley Topic
Then contact Bill with a Private Message
ThinkPads.com HOME PAGE
For those who might want to contribute to the blog, start here: Editors Alley Topic
Then contact Bill with a Private Message
Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
-
- Senior ThinkPadder
- Posts: 2235
- Joined: Thu Jul 30, 2015 11:29 pm
- Location: Boston, Massachusetts
Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
https://github.com/hamishcoleman/thinkpad-ec
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
Wow someone had a lot of time on their hands addressing this on a 6-7 year old generation of laptops.
...Knowledge is a deadly friend when no one sets the rules...(King Crimson)
Cheers,
George (your grouchy retired FlexView farmer)
One FlexView to rule them all: A31p
Abused daily: T520, X200s
PMs requesting personal tech support will be ignored.
Cheers,
George (your grouchy retired FlexView farmer)
One FlexView to rule them all: A31p
Abused daily: T520, X200s
PMs requesting personal tech support will be ignored.
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
Wow, it actually looks like they are not addressing any real vulnerability. They actually specifically wanted to remove the ability to update the EC firmware. That's the entire point of these updates.
Thinkpad 25 (20K7), T490 (20N3), Yoga 14 (20FY), T430s (IPS FHD + Classic Keyboard), X220 4291-4BG
X61 7673-V2V, T60 2007-QPG, T42 2373-F7G, X32 (IPS Screen), A31p w/ Ultrabay Numpad
X61 7673-V2V, T60 2007-QPG, T42 2373-F7G, X32 (IPS Screen), A31p w/ Ultrabay Numpad
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
Are you surprised ?
Removing *real* vulnerabilities was never too high on Lenovo's list of priorities. Not that other manufacturers were more diligent.
This is just...IDK...ridiculous? Childish?
I'm having difficulty describing their move and that doesn't happen very often.
...Knowledge is a deadly friend when no one sets the rules...(King Crimson)
Cheers,
George (your grouchy retired FlexView farmer)
One FlexView to rule them all: A31p
Abused daily: T520, X200s
PMs requesting personal tech support will be ignored.
Cheers,
George (your grouchy retired FlexView farmer)
One FlexView to rule them all: A31p
Abused daily: T520, X200s
PMs requesting personal tech support will be ignored.
-
- Admin Emeritus
- Posts: 23826
- Joined: Mon Sep 18, 2006 5:17 am
- Location: Loch Garman, Éire
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
They may not have intended to stop the Classic Keyboard swap, but rather the original-battery-check removal.
Either way, Lenono proves once more that they are a bunch of arseonists!
Either way, Lenono proves once more that they are a bunch of arseonists!
Lovely day for a Guinness! (The Real Black Stuff)
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
In any case, it's not a big deal, since no one needs to be updating BIOS on such old systems anyways. However, it's an important warning for people against accidental upgrades.
What happens if you accidentally upgraded, though? I believe there are methods to force downgrade Thinkpad BIOS even from versions that are designed to prevent it.
What happens if you accidentally upgraded, though? I believe there are methods to force downgrade Thinkpad BIOS even from versions that are designed to prevent it.
Thinkpad 25 (20K7), T490 (20N3), Yoga 14 (20FY), T430s (IPS FHD + Classic Keyboard), X220 4291-4BG
X61 7673-V2V, T60 2007-QPG, T42 2373-F7G, X32 (IPS Screen), A31p w/ Ultrabay Numpad
X61 7673-V2V, T60 2007-QPG, T42 2373-F7G, X32 (IPS Screen), A31p w/ Ultrabay Numpad
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
so what models are concerned about this ?
W530, 3840QM, 32GB, K2000M
P1, XEON 2176, 32GB ECC, P2000, IPS
X230, 3320M, 16GB, HD4000, IPS
T601F X9000, 8GB, X3100, UXGA FlexView 1600x1200
T61 14" 4:3, T9500, 8GB, NVS140M
T60 14" 4:3, T7600, 3GB, GMA950
P71, 7700HQ, 16GB, P600, IPS
T470 6300U
R61i, T430s
RIP: T43p, X201
P1, XEON 2176, 32GB ECC, P2000, IPS
X230, 3320M, 16GB, HD4000, IPS
T601F X9000, 8GB, X3100, UXGA FlexView 1600x1200
T61 14" 4:3, T9500, 8GB, NVS140M
T60 14" 4:3, T7600, 3GB, GMA950
P71, 7700HQ, 16GB, P600, IPS
T470 6300U
R61i, T430s
RIP: T43p, X201
-
- Admin Emeritus
- Posts: 23826
- Joined: Mon Sep 18, 2006 5:17 am
- Location: Loch Garman, Éire
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
Guess you did not read the Lenovo link in the first post...
Lovely day for a Guinness! (The Real Black Stuff)
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
i did, but I didnt understand one yota, the info on the link says something about allowing newer thinkpads to use the old 7 key row, but the comments here talk about a new bios blocking this action, hence my confusion.RealBlackStuff wrote: ↑Fri Sep 13, 2019 7:29 amGuess you did not read the Lenovo link in the first post...
W530, 3840QM, 32GB, K2000M
P1, XEON 2176, 32GB ECC, P2000, IPS
X230, 3320M, 16GB, HD4000, IPS
T601F X9000, 8GB, X3100, UXGA FlexView 1600x1200
T61 14" 4:3, T9500, 8GB, NVS140M
T60 14" 4:3, T7600, 3GB, GMA950
P71, 7700HQ, 16GB, P600, IPS
T470 6300U
R61i, T430s
RIP: T43p, X201
P1, XEON 2176, 32GB ECC, P2000, IPS
X230, 3320M, 16GB, HD4000, IPS
T601F X9000, 8GB, X3100, UXGA FlexView 1600x1200
T61 14" 4:3, T9500, 8GB, NVS140M
T60 14" 4:3, T7600, 3GB, GMA950
P71, 7700HQ, 16GB, P600, IPS
T470 6300U
R61i, T430s
RIP: T43p, X201
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
I have been using lenovo vantage for system updates on my T430, and - yes a bit naive - installed t430 BIOS 2.82 (G1ETC2WW) EC 1.14 (G1HT36WW), the first locked bios in hamishcoleman's article. Intending to install the 7 row keyboard one day, I find that Lenovo don't want me too. How is that going to hurt them? So, finding under 'security' in my bios that 'prevent rollback' or something like that is disabled, I downloaded an earlier bios from Lenovo.com and it flashed without a hitch. Seemed too simple - wonder how long before Lenovo blocks rollbacks in their earnest quest to save us from ourselves?
T430 ips, T440p.
-
- Admin Emeritus
- Posts: 23826
- Joined: Mon Sep 18, 2006 5:17 am
- Location: Loch Garman, Éire
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
As long as you don't (unnecessarily) update your BIOS (and don't get misled/waylaid by unwanted Micro$haft/Vantage/System updates), you will be spared from that Lenono evil.
Lovely day for a Guinness! (The Real Black Stuff)
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
Hello,
I know that this post is a bit old now but I've just faced a problem with updating my t430s... its about step 6 in Hamish guide
If it will always download the original file from Lenovo does it mean... it will be this locked newest bios ?
If yes so how can I change this 6th step to make it work with 2.75 img file that I've downloaded manually ? (it's the latest unlocked bios for t430s) I will be grateful for help because I am kinda noob with linux :/
I know that this post is a bit old now but I've just faced a problem with updating my t430s... its about step 6 in Hamish guide
If it will always download the original file from Lenovo does it mean... it will be this locked newest bios ?
If yes so how can I change this 6th step to make it work with 2.75 img file that I've downloaded manually ? (it's the latest unlocked bios for t430s) I will be grateful for help because I am kinda noob with linux :/
Using the name chosen in the previous step, make the fully patched image for this laptop (this will download the original file from Lenovo and patch it):
make patched.x230.img
-
- Posts: 35
- Joined: Tue Sep 17, 2019 2:57 pm
- Location: La Verkin, Utah
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
The reason this works is that, to my understanding, the current BIOS is what blocks the flash, not what you are updating to. Thus, if you are not on the newest version that blocks flashing, then flashing the newest modified version can’t be blocked because it is handled by the non-blocking BIOS. Sorry if that was a bad explanation, but basically you can go ahead and flash this update, however you will have to roll back in order to perform the modified flash again e.g. reverting to a modern keyboard.
W541 - i7-4940mx, 8gb RAM, Quadro k2100m
T530 - i7-3632qm, 8gb RAM, NVS 5400M; motherboard upgrade from t520.
T430 - i5-3320m, 4gb
T430s - i7-3520m, 8gb
Helix 1st Gen - i5-3337u 4gb
Other experience with X230t and t540p
I am 15 years old
T530 - i7-3632qm, 8gb RAM, NVS 5400M; motherboard upgrade from t520.
T430 - i5-3320m, 4gb
T430s - i7-3520m, 8gb
Helix 1st Gen - i5-3337u 4gb
Other experience with X230t and t540p
I am 15 years old
Re: Warning: Digital Signature in NEW Lenovo Embedded Controllers prevents Classic Keyboard, Battery WL Firmware mods
Hm I'm not sure... I'have t430s with 2.75 bios (and EC 1.14) when I run this "make" command I think it will try to download the newest bios (2.82 with EC 1.15 that is locked) so I think I should modify this make file and force it to use img file with 2.75 bios that I downloaded before instead of trying to download the newest verrsion...
But I don't know how :/
BTW
I'm using FHD kit and it works perfectly. My T430s has got wonderful 1900x1050 IPS screen
But I don't know how :/
BTW
I'm using FHD kit and it works perfectly. My T430s has got wonderful 1900x1050 IPS screen
-
- Similar Topics
- Replies
- Views
- Last post
-
-
Classic ThinkPads installed in IBM System/390 and zSeries mainframes
by ThinkDan » Mon Nov 27, 2023 4:39 pm » in ThinkPad Legacy Hardware - 13 Replies
- 4474 Views
-
Last post by ThinkDan
Fri Feb 02, 2024 4:18 am
-
-
-
T580 Compared to Classic Thinkpads and Macbook Pro
by MisterB » Fri Mar 15, 2024 12:51 pm » in ThinkPad T430-T490 / T530-T590 Series - 0 Replies
- 247 Views
-
Last post by MisterB
Fri Mar 15, 2024 12:51 pm
-
-
-
*WARNING: LARGE PIC* Battery FRU 02DL023 (61++)
by kdoshi8 » Wed Nov 08, 2023 11:36 pm » in ThinkPad T430-T490 / T530-T590 Series - 2 Replies
- 26780 Views
-
Last post by kdoshi8
Fri Nov 10, 2023 8:21 am
-
-
-
PM Device Version For Critical Thunderbolt Firmware Patch
by TPFanatic » Wed Oct 25, 2023 8:49 am » in Thinkpad - General HARDWARE/SOFTWARE questions - 0 Replies
- 3114 Views
-
Last post by TPFanatic
Wed Oct 25, 2023 8:49 am
-
Who is online
Users browsing this forum: No registered users and 25 guests