Feeds

Forgot your ThinkPad password? Get new hardware

Lenovo merciless on memory loss

3 Big data security analytics techniques

Users of Lenovo ThinkPad laptops may be in for a nasty surprise if they forget their main (supervisor) hard drive password.

The Chinese hardware manufacturer refuses to reset hard drive (BIOS) security passwords for laptops even if they are covered by warranty. Lenovo, which bought IBM's ThinkPad laptop business in 2005, cites security concerns for this established but little-publicised policy.

While official Lenovo channels offer only the expensive fix of replacing a machine's motherboard, costing perhaps $400 plus or around the price of some new machines (like the X100e here), a variety of password recovery tools will do the job for around $80. Sure enough Google search "reset Thinkpad password" turns up various tools, which we haven't tested and therefore can't endorse, that claim to do the job.

The more credible offers provide step by step guides as well as links to software downloads, while the more suspect offers include ads on Craigslist.

Reg reader Shaun P, who put us on to the issue, explains: "When a Lenovo customer forgets their password the firm tells customers to replace the motherboard at their expense. That's because the password lock-out problem is something that isn't covered under Lenovo ThinkPad warranties."

Sure enough, page 19 on Lenovo's ThinkPad warranty explains that while the "power-on" password can be reset by service agents the same doesn't apply to supervisor passwords.

If you forgot your supervisor password, Lenovo authorized servicer cannot reset your password. You must take your computer to a Lenovo authorized servicer or a marketing representative to have the system board replaced. Proof of purchase is required, and a fee will be charged for parts and service.

Lenovo explained the rationale for this policy in a brief statement.

Lenovo does not reset passwords for customers regardless of warranty status. To do so, represents a potential security exposure.

Lenovo entitles warranties based on the system model and serial number combination and not based on a particular registered customer - in which case Lenovo would have no way to authenticate a customer seeking help with a story of a lost or forgotten password. If Lenovo were to reset administrator or HDD passwords by either policy or available procedure, then we would be creating an exposure and undermining the value of the passwords to deter theft and prevent unintended access to data.

Users are always forgetting passwords, which is why corporate help-desks are busy and the reason why corporate encryption systems come with password recovery tools. A quick search through user forums reveals numerous complaints, and a fair bit of confusion, on web forums over password recovery on ThinkPads.

A few examples can be found on Techspot (here), Tom's hardware (here) and Fixya (item two here). Users on an Indian forum had similar problems.

More woe can be found on a ThinkPad site here. And here, and again here (on a security forum) and finally, in our list at least, here.

Green computing has become a more important issue over recent years. Lenovo said that motherboards taken out of machines that get replaced as a result of its approved fix for password forgetfulness get recycled.

Any parts returned would be processed and environmentally recycled. For more information on our business disposal and recycling services, please visit: http://www.lenovo.com/services_warranty/US/en/asset_recovery.html For more information on our consumer recycling programs, please visit: http://www.lenovo.com/social_responsibility/us/en/product_recycling_program.html

Our tipster remains less than impressed with Lenovo's policy. "Ultimately I would like Lenovo/IBM to take some responsibility here and just provide a sensible solution," Shaun P told El Reg.

"I don't expect the solution to be free, although a web-based password reset service done properly would be great, but I don't expect it to cost more than the machine is worth."

Shaun also took issue with Lenovo's implied assumption that the customer must always be in the wrong over lost passwords. "Lenovo's unwritten policy if you 'forget' your password is, buy a new laptop," Shaun, who has experience the problem at first hand, explained. "Mr Criminal on the other hand can break the security in under 30 minutes. Kind of ironic that Lenovo can offer no real support to legitimate customers, but the bloke at the car boot sale can."

Have Reg readers experienced anything similar password reset problems with other manufacturers? We'd like to know. ®

SANS - Survey on application security programs

More from The Register

next story
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Leaked pics show EMBIGGENED iPhone 6 screen
Fat-fingered fanbois rejoice over Chinternet snaps
Oh no, Joe: WinPhone users already griping over 8.1 mega-update
Hang on. Which bit of Developer Preview don't you understand?
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Report: Apple seeking to raise iPhone 6 price by a HUNDRED BUCKS
'Well, that 5c experiment didn't go so well – let's try the other direction'
Rounded corners? Pah! Amazon's '3D phone has eye-tracking tech'
Now THAT'S what we call a proper new feature
Feast your PUNY eyes on highest resolution phone display EVER
Too much pixel dust for your strained eyeballs to handle
Hearthstone: Heroes of Warcraft – A jolly little war for lunchtime
Free-to-play WoW turn-based game when you have 20 minutes to kill
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.