Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password?

A few ideas come to mind:

  • The old battery trick (remove battery, wait an hour, plug battery back in)
  • Swap the BIOS chip. On some boards you can do this without desoldering.
  • Crack the BIOS password. Is this even possible?

Are any of these viable in modern machines? Are there any other ways to break into the BIOS?

(slighly off topic, but still an interesting question: are datasheets usually available for BIOS chips?)

share|improve this question
    
see this page all related to bios reset and bios superuser.com/search?q=bios+password well from superuser.se i found two usefull tools 11a.nu/security/pc-bios-security-password-recovery –  BlueBerry - vignesh4303 Sep 3 '12 at 10:24
1  
Some motherboards have a jumper you have to short to clear the BIOS. –  Iszi Sep 4 '12 at 13:44
    
@Iszi The BIOS reset jumper doesn't always reset the password. Sometimes it's on an external NVRAM IC. –  Polynomial Sep 4 '12 at 13:55
    
It looks like (for the most part) modern motherboards use standard(ish) SPI flash chips to store the BIOS data. For instance, An ASUS LGA1155 P8PXX series motherboard could have this chip. Which means they no longer need RAM or even NVRAM chips. At any rate you can find a pretty comprehensive list of chips here if you know the manufacturer and the model number of the motherboard in question. –  David Freitag Aug 21 '13 at 16:59
    
Right, except you linked to DIP ICs, and the ones on the board are SOIC. A DIP could easily be removed and re-soldered, but doing the same on a fine-pitch SOIC would be significantly difficult without damaging the pads. Even moreso when you consider that many motherboards have under-pad vias, which can easily be damaged by resoldering efforts. –  Polynomial Aug 26 '13 at 22:36
add comment

3 Answers

up vote 9 down vote accepted

It depends on how the BIOS chip stores the password.

If the BIOS chip stores the password in battery-backed RAM then removing the battery will clear the RAM which will restore the BIOS defaults. For most chips the BIOS default is to not require a password.

If the BIOS chip stores the password in an external Non-Volatile Memory chip (usually EEPROM) the it is usually possible to remove the NVM chip and read the password directly from the chip. Another option is to clear the NVM chip to restore the BIOS defaults.

If the BIOS chip stores the password in on-chip ROM then the password is the same for all chips and it is usually possible to Google the password. Likewise, many BIOS chips have a backup password in ROM which can be found using Google.

There may be BIOS chip which store the password in on-chip non-volatile memory (most likely One Time Programmable ROM). If such chips exist (I'm not aware of any) then the best bet would be to try and brute force the BIOS password using something like this. Of course, if someone went to the trouble (and expense) of using on-chip NVM to store passwords they might also limit the number of password attempts in a given period of time.

Things get more complicated if the BIOS password is protected by a TPM (Trusted Platform Module). For that see Tamper-proof BIOS password & settings storage with Trusted Platform Module?.

share|improve this answer
1  
+1 for that Arduino project. I actually considered that as an option, but it seems someone beat me to it! :) –  Polynomial Sep 3 '12 at 12:17
add comment

Most BIOS chips I've encountered can have the password reset by a simple jumper setting or some similar approach if you have direct physical access to the computer. In general however, this will result in a wipe of the data in the BIOS, or at least any security related information (such as TPM (Trusted Platform Module) keys). In general, if you are trying to protect something via a BIOS password, you will additionally need a system with a TPM and encryption where the decryption key is stored or protected by the TPM.

share|improve this answer
add comment

Sometimes backdoor passwords are not worked on the system. I have MSI-7529 Motherboard i have tried all ami passwords but it cant worked. After that i found one tool TROUBLESHOOTERS BIOS CRACKER while searching on internet, it worked on my system, so you can also try it. You can Search it on google TROUBLESHOOTERS BIOS CRACKER or I give the link below. You can download it.

  1. Just Run it then
  2. Select Bytes Operation with to 256 Bytes
  3. Select Action To Perform: Clear BIOS 4.Click on Crack it. 5.You are done. 6.You can download it from http://crackunlimited.blogspot.in/2013/08/troubleshooters-bios-cracker-this_10.html
share|improve this answer
    
-1 for not explicitly mentioning your affiliation, and lying about the backstory for how you "came by" the tool. –  Polynomial Aug 26 '13 at 22:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.