22 Aug
2009
22 Aug
'09
2:45 a.m.
I recently won an IBM 540MB laptop HD for the old Thinkpad 755 series and I found out it
is password locked.
IBM DHAA-2540
Security level MAX
All I want to do is erase and use the drive, to do that I run the ATA command security
erase prepare, and then security erase unit. To do the latter you need a master password
which I don't have (tried all spaces).
Anyone happen to know what the default password would be for that series? If the master
password was changed from default is it hosed permanently? Any other way around it so I
can use the drive?
22 Aug
22 Aug
4:47 a.m.
Teo Zenios wrote:
All I want to do is erase and use the drive, to do
that I run the ATA
command security erase prepare, and then security erase unit. To do
the latter you need a master password which I don't have (tried all
spaces).
Maybe try "IBM" or "IBM " repeated to fill the buffer?
--
Phil.
philpem at philpem.me.uk
http://www.philpem.me.uk/
5:09 a.m.
Teo Zenios wrote:
I recently won an IBM 540MB laptop HD for the old
Thinkpad 755 series
and I found out it is password locked.
IBM DHAA-2540 Security level MAX
All I want to do is erase and use the drive, to do that I run the ATA
command security erase prepare, and then security erase unit. To do
the latter you need a master password which I don't have (tried all
spaces).
Anyone happen to know what the default password would be for that
series? If the master password was changed from default is it hosed
permanently? Any other way around it so I can use the drive?
I don't think there is such a thing as a default password. You might be
able to get around that. I don't know.
Peace... Sridhar
5:37 a.m.
-----Oorspronkelijk bericht-----
Van: cctalk-bounces at classiccmp.org
[mailto:cctalk-bounces at classiccmp.org] Namens Teo Zenios
Verzonden: zaterdag 22 augustus 2009 8:46
Aan: General Discussion: On-Topic and Off-Topic Posts
Onderwerp: Old password protected laptop drive
I recently won an IBM 540MB laptop HD for the old Thinkpad
755 series and I found out it is password locked.
IBM DHAA-2540
Security level MAX
All I want to do is erase and use the drive, to do that I run
the ATA command security erase prepare, and then security
erase unit. To do the latter you need a master password which
I don't have (tried all spaces).
Anyone happen to know what the default password would be for
that series? If the master password was changed from default
is it hosed permanently? Any other way around it so I can use
the drive?
http://www.eserviceinfo.com/downloadsm/9366/IBM_ThinkPad%20755.html
Did you try to format the drive in another computer as secondary drive ?
Or try to do a destructive read/write test on all sectors with test
software.
Or may be you could mount it on a Unix/Linux system..
-Rik
9:37 a.m.
or just start trying passwords (password, sex, god, etc)
if the security is such that too many password failures may cause it to wipe the drive
itself...
otherwise, yes, you're SOL, but a replacement drive can be very cheap.
From: teoz at neo.rr.com
To: cctalk at classiccmp.org
Subject: Old password protected laptop drive
Date: Sat, 22 Aug 2009 02:45:56 -0400
I recently won an IBM 540MB laptop HD for the old Thinkpad 755 series and I found out it
is password locked.
IBM DHAA-2540
Security level MAX
All I want to do is erase and use the drive, to do that I run the ATA command security
erase prepare, and then security erase unit. To do the latter you need a master password
which I don't have (tried all spaces).
Anyone happen to know what the default password would be for that series? If the master
password was changed from default is it hosed permanently? Any other way around it so I
can use the drive?
_________________________________________________________________
Stay on top of things, check email from other accounts!
http://go.microsoft.com/?linkid=9671355
12:59 p.m.
Teo,
This "prize" was a joke?
Try Darik's Boot and Nuke (http://www.dban.org/), an ultra-secure disk
wiping utility. It boots a small Linux from a CD or floppy which then
load the utility. If it can detect and control the drive on the IDE
controller, it should be able to wipe the drive. This is working at at
the hardware register level so it just might work.
Unfortunately I suspect this drive has a hardware-based encryption that
sits between the IDE channel and the drive electronics and thus will
prevent anything from writing to any part of the drive without the
unlocking password.
Jim
Teo Zenios wrote:
I recently won an IBM 540MB laptop HD for the old
Thinkpad 755 series and I found out it is password locked.
IBM DHAA-2540
Security level MAX
All I want to do is erase and use the drive, to do that I run the ATA command security
erase prepare, and then security erase unit. To do the latter you need a master password
which I don't have (tried all spaces).
Anyone happen to know what the default password would be for that series? If the master
password was changed from default is it hosed permanently? Any other way around it so I
can use the drive?
1:30 p.m.
Teo Zenios wrote:
I recently won an IBM 540MB laptop HD for the old
Thinkpad 755
series and I found out it is password locked.
IBM DHAA-2540
Security level MAX
All I want to do is erase and use the drive, to do that I run the
ATA command security erase prepare, and then security erase unit. To
do the latter you need a master password which I don't have (tried
all spaces).
From section 8.1.1.4 of
http://www.hitachigst.com/tech/techlib.nsf/techdocs/A4080D7CE6E2A9DB87
256ACC0061C25C/$file/dhaa_spi.pdf
"If a user forgets the user password and Maximum security level is
set, data access is impossible. However the drive can be unlocked
using the Erase Unit command to unlock the drive and erase all user
data."
There's your answer. Personally, I'm not a big fan of the DeathStar
drives...
--Chuck
8:42 p.m.
----- Original Message -----
From: "Chuck Guzis" <cclist at sydex.com>
To: "General Discussion: On-Topic and Off-Topic Posts"
<cctalk at classiccmp.org>
Sent: Saturday, August 22, 2009 1:30 PM
Subject: Re: Old password protected laptop drive
Teo Zenios wrote:
Is there a utility that does this? I tried ATA disk password utility v1.1
and that didnt work (still needed a password).
I recently won an IBM 540MB laptop HD for the old
Thinkpad 755
series and I found out it is password locked.
IBM DHAA-2540
Security level MAX
All I want to do is erase and use the drive, to do that I run the
ATA command security erase prepare, and then security erase unit. To
do the latter you need a master password which I don't have (tried
all spaces).
From section 8.1.1.4 of
http://www.hitachigst.com/tech/techlib.nsf/techdocs/A4080D7CE6E2A9DB87
256ACC0061C25C/$file/dhaa_spi.pdf
"If a user forgets the user password and Maximum security level is
set, data access is impossible. However the drive can be unlocked
using the Erase Unit command to unlock the drive and erase all user
data."
There's your answer. Personally, I'm not a big fan of the DeathStar
drives...
--Chuck
9:10 p.m.
On 22 Aug 2009 at 20:42, Teo Zenios wrote:
Is there a utility that does this? I tried ATA disk
password utility
v1.1 and that didnt work (still needed a password). >
According to the Hitachi docs, the command codes are unique to this
product line, so you need to issue the commands to the controller
yourself. Does Linux have a backdoor for issuing ATA commands?
You could also probably do it with DOS and DEBUG.
--Chuck
9:19 p.m.
----- Original Message -----
From: "Chuck Guzis" <cclist at sydex.com>
To: "General Discussion: On-Topic and Off-Topic Posts"
<cctalk at classiccmp.org>
Sent: Saturday, August 22, 2009 9:10 PM
Subject: Re: Old password protected laptop drive
On 22 Aug 2009 at 20:42, Teo Zenios wrote:
Ok so what you are saying is the utility I have isn't using the correct
command codes. When I did the security erase prepare it said ok, when I
tried the erase unit cammand it then asked for a password because it gave
the drive the wrong parameters.
Can you give me an example on how to use debug to sent commands (will look
those up) to the drive?
Is there a utility that does this? I tried ATA
disk password utility
v1.1 and that didnt work (still needed a password). >
According to the Hitachi docs, the command codes are unique to this
product line, so you need to issue the commands to the controller
yourself. Does Linux have a backdoor for issuing ATA commands?
You could also probably do it with DOS and DEBUG.
--Chuck
9:28 p.m.
At 09:19 PM 8/22/2009, Teo Zenios wrote:
Ok so what you are saying is the utility I have
isn't using the
correct command codes. When I did the security erase prepare it said
ok, when I tried the erase unit cammand it then asked for a password
because it gave the drive the wrong parameters.
Can you give me an example on how to use debug to sent commands (will
look those up) to the drive?
You've already been asked but haven't answered this:
What are you trying to do?
The IDE security erase capability doesn't work unless there's a
password on the drive. You've got to lock it first prior to starting
the erase. Unfortunately, many PCs *block* the secure erase and user
password settings, apparently due to worries about malware dropping a
password onto a drive, making it unusable for the owner. I've found
very few laptop drives where secure erase works, for example.
If the drive is already locked and you don't know the password, you're
the proud owner of a brick.
If the drive isn't already locked and you want to try secure erase, try
locking it first with a user password.
If that doesn't work, give up on secure erase. There's lots of free
drive clearing software available you can use; MHDD, DBAN, etc.
-Rick
23 Aug
23 Aug
1:39 a.m.
Maybe I've misunderstood the question.
There are two passwords on this drive. If the user loses the user
password, the drive can be returned to use but losing all of the user
data using the "Erase Unit" command, preceded immediately by the
"Prepare Erase" command.
However, there is also a Master Password, which is normally all
spaces. If this password is changed, the drive data is inaccessible
if the Master Password is lost. The only way to get around this is
to use a utility that can access the firmware area of the drive:
Here's one such tool:
http://www.hdd-tools.com/news/
There are others.
--Chuck
11:24 a.m.
This thread jogged my memory on the subject, see the following link
on how hard this can be.
http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/
Doug
At 02:45 AM 8/22/2009, you wrote:
I recently won an IBM 540MB laptop HD for the old
Thinkpad 755
series and I found out it is password locked.
IBM DHAA-2540
Security level MAX
All I want to do is erase and use the drive, to do that I run the
ATA command security erase prepare, and then security erase unit. To
do the latter you need a master password which I don't have (tried all spaces).
Anyone happen to know what the default password would be for that
series? If the master password was changed from default is it hosed
permanently? Any other way around it so I can use the drive?
3:18 p.m.
This thread jogged my memory on the subject, see the
following link
on how hard this can be.
http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/
This is for the BIOS password, well different from the ATA (HD)
password.
As far as I know, the ATA password is unbreakable. It is stored on the
platters AND the controller. So if you change controllers it would not work.
4:16 p.m.
On 23 Aug 2009 at 16:18, Alexandre Souza wrote:
As far as I know, the ATA password is unbreakable.
It is stored on
the platters AND the controller. So if you change controllers it would not
work.
The programs that break ATA master password protection do it by
modifying the "firmware area" on disk.
--Chuck
5:38 p.m.
On Sun, 23 Aug 2009, Alexandre Souza wrote:
As far as I know, the ATA password is unbreakable.
It is stored on the
platters AND the controller. So if you change controllers it would not work.
It may not be PRACTICAL or FEASABLE to break it, but for enough money, it
could be done. One way would be to design and build a replacement
controller that doesn't CARE whether there is a password long enough to
overwrite the password on the drive with the hash of a known password.
6:26 p.m.
I note how the software all says they have to connect over the internet to
download the special "procedures" and laptop drives take at least 25 minutes.
something very strange going on.
if anyone does this, fire up wireshark before starting and capture
what the programs are sending/receiving. it'd be very interesting to know.
maybe totally bogus is what I'm thinking.
Date: Sun, 23 Aug 2009 14:38:57 -0700
From: cisin at xenosoft.com
To: cctalk at classiccmp.org
Subject: Re: Old password protected laptop drive
On Sun, 23 Aug 2009, Alexandre Souza wrote:
_________________________________________________________________
Stay on top of things, check email from other accounts!
http://go.microsoft.com/?linkid=9671355
As far as I know, the ATA password is
unbreakable. It is stored on the
platters AND the controller. So if you change controllers it would not work.
It may not be PRACTICAL or FEASABLE to break it, but for enough money, it
could be done. One way would be to design and build a replacement
controller that doesn't CARE whether there is a password long enough to
overwrite the password on the drive with the hash of a known password.
8:33 p.m.
On 23 Aug 2009 at 16:18, Alexandre Souza wrote:
As far as I know, the ATA password is unbreakable.
It is stored on
the
platters AND the controller. So if you change controllers it would not
work.
Have a look here:
http://www.acelaboratory.com/pc3000.htm
Apparently the way this is done is to go in via the factory
connector.
--Chuck
24 Aug
24 Aug
4:29 p.m.
At 07:33 PM 8/23/2009, Chuck Guzis wrote:
Have a look here:
http://www.acelaboratory.com/pc3000.htm
Apparently the way this is done is to go in via the factory
connector.
Looks cool. No price? I'm afraid to ask.
- John
4:49 p.m.
John Foust wrote:
At 07:33 PM 8/23/2009, Chuck Guzis wrote:
Indeed, I want one....
Have a look here:
http://www.acelaboratory.com/pc3000.htm
Apparently the way this is done is to go in via the factory
connector.
Looks cool.
No price? I'm afraid to ask.
If you need to ask you prolly can't afford it :) :) :)
Phill.
--
Phill Harvey-Smith, Programmer, Hardware hacker, and general eccentric !
"You can twist perceptions, but reality won't budge" -- Rush.
11:39 p.m.
price I found online was $2,887 euros... ouch!
Date: Mon, 24 Aug 2009 15:29:22 -0500
To: cctalk at classiccmp.org
From: jfoust at threedee.com
Subject: Re: Old password protected laptop drive
At 07:33 PM 8/23/2009, Chuck Guzis wrote:
_________________________________________________________________
Send and receive email from all of your webmail accounts.
http://go.microsoft.com/?linkid=9671356
Have a look here:
http://www.acelaboratory.com/pc3000.htm
Apparently the way this is done is to go in via the factory
connector.
Looks cool. No price? I'm afraid to ask.
- John
24 Aug
24 Aug
3:10 a.m.
On 23 Aug 2009 at 11:24, Douglas Taylor wrote:
This thread jogged my memory on the subject, see the
following link on
how hard this can be.
http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/
It's not a problem with the EEPROM in the Thinkpad BIOS--the drive
itself has locking and encryption (two-level: user and master).
Without the master password, the drive will not permit any operations
involving media access. IBM claims that if you lose the master
password, the drive is unusable; if you lose the user password, the
drive can be restored to use, but any user data lost.
I'm not aware that Teo was given anything but the Travelstar drive.
--Chuck
8:15 a.m.
BIOS password can very easily be erased on any system in about 30 seconds.
if it can boot floppy or cdrom or even hd it's simple and easy
if it can't, and you have a standard tower/pc, its a bit more work, but still about
30-60 seconds
notebooks that can't boot floppy/cdrom and replacing the hd with your own cant boot
that,
well yes you have to follow some crazy instructions listed on those sites.
HDD passwords alone seem *very* easy to hack check out "pc-3000" (yes its
$3000)
or any of those others posted here like ACE labs, etc. take about 30 minutes
HDD passwords alone seem to be totally insure with such software solutions.
Dan.
From: cclist at sydex.com
To: cctalk at classiccmp.org
Date: Mon, 24 Aug 2009 00:10:22 -0700
Subject: Re: Old password protected laptop drive
On 23 Aug 2009 at 11:24, Douglas Taylor wrote:
_________________________________________________________________
Attention all humans. We are your photos. Free us.
http://go.microsoft.com/?linkid=9666047
This thread jogged my memory on the subject, see
the following link on
how hard this can be.
http://sodoityourself.com/hacking-ibm-thinkpad-bios-password/
It's not a problem with the EEPROM in the Thinkpad BIOS--the drive
itself has locking and encryption (two-level: user and master).
Without the master password, the drive will not permit any operations
involving media access. IBM claims that if you lose the master
password, the drive is unusable; if you lose the user password, the
drive can be restored to use, but any user data lost.
I'm not aware that Teo was given anything but the Travelstar drive.
--Chuck
23 Aug
23 Aug
9:43 p.m.
if i remember, and this is a maybe, but i remember reading that hd passwords
are a feature built into the drive, pretty much a security mechanism on the
lowest level, and cant be erased or removed without the password, at least
on a toshiba disk. maybe this will help? http://www.ja.axxs.net/unlock/
On Sat, Aug 22, 2009 at 1:45 AM, Teo Zenios <teoz at neo.rr.com> wrote:
I recently won an IBM 540MB laptop HD for the old
Thinkpad 755 series and I
found out it is password locked.
IBM DHAA-2540
Security level MAX
All I want to do is erase and use the drive, to do that I run the ATA
command security erase prepare, and then security erase unit. To do the
latter you need a master password which I don't have (tried all spaces).
Anyone happen to know what the default password would be for that series?
If the master password was changed from default is it hosed permanently? Any
other way around it so I can use the drive?
5445
days inactive
5448
days old
24 comments
14 participants
participants (14)
-
afra＠aurigae.demon.co.uk -
alexandre-listas＠e-secure.com.br -
cclist＠sydex.com -
cisin＠xenosoft.com -
dgahling＠hotmail.com -
dj.taylor4＠verizon.net -
hp-fix＠xs4all.nl -
jfoust＠threedee.com -
jlobocki＠gmail.com -
philpem＠philpem.me.uk -
ploopster＠gmail.com -
rick＠rickmurphy.net -
scheefj＠netscape.net -
teoz＠neo.rr.com