Hard drive anti-theft protection
Boot firmware of a terminal sets a lock password on a hard disk drive of the terminal to lock the hard disk drive from access. The password is obfuscated in boot variables or stored separately on a server independently of the terminal. During subsequent boots of the terminal, the firmware de-obfuscates the password from the boot variables or obtains the password from the server and provides the password to the hard disk drive, which causes the hard disk drive to unlock for operation with the terminal following the subsequent boots.
1. A terminal, comprising:
a processor;
a non-transitory computer-readable storage medium comprising firmware instructions and boot variables; and
a hard disk drive;
the firmware instructions when executed by the processor cause the processor to perform operations, comprising:
detecting a first boot variable being set with a password;
performing a first boot of the terminal based on the first boot variable being set with the password;
following the first boot:
obtaining the password from the first boot variable;
setting the password on the hard disk drive to lock the hard disk drive;
during second boots of the terminal:
obtaining the password from the first boot variable, one or more second boot variables, or a server;
sending the password to the hard disk drive to unlock the hard disk drive; and
booting the terminal to use the hard disk drive.
2. The terminal of claim 1 , wherein the operations associated with the detecting further includes, receiving server details for connection to the server in a certain second boot variable.
3. The terminal of claim 2 wherein the operations associated with the setting the password following the first boot further include:
deleting the password from the first boot variable.
4. The terminal of claim 3 , wherein the operations associated with the obtaining the password following each of the second boots further include:
obtaining the server details from the certain boot variable;
connecting the server over a network using the server details; and
obtaining the password from the server.
5. The terminal of claim 1 , wherein the operations associated with the obtaining the password following the first boot further includes moving the password from the first boot variable to a certain boot variable associated with the one or more second boot variables to obfuscate the password.
6. The terminal of claim 5 , wherein the operations associated with obtaining the password following each of the second boots further include obtaining the password from the certain boot variable.
7. The terminal of claim 1 , wherein the operations associated with the obtaining of the password following the first boot further includes segmenting the password into two or more of the second boot variables to obfuscate the password.
8. The terminal of claim 7 , wherein the operations associated with obtaining the password following each of the second boots further include re-assembling the password from the two or more second boot variables.
9. The terminal of claim 1 , wherein the firmware instructions are unified extensible firmware interface (UEFI) instructions.
10. The terminal of claim 1 , wherein the instructions associated with the detecting further includes detecting the first boot variable being set with the password by an operating system utility of the terminal.
11. A method, comprising:
detecting a first boot variable being set to a value on a terminal;
performing a first boot on the terminal based on the detecting;
following the first boot of the terminal:
reading the value from the first boot variable as a password to lock and to unlock a hard disk drive of the terminal; and
setting the password on the hard disk drive to lock the hard disk drive;
during each second boot of the terminal:
obtaining the password from the first boot variable, one or more second boot variables, or a server;
sending the password to the hard disk drive causing the hard disk drive to unlock; and
booting the terminal to the hard disk drive for use with the terminal.
12. The method of claim 11 , wherein the detecting further includes detecting second values set in a certain boot variable.
13. The method of claim 12 , wherein the reading following the first boot further includes reading the second values from the certain boot variable as server details for connecting to a server to obtain the password.
14. The method of claim 13 , wherein the setting the password following the first boot further includes deleting the value associated with the password from the first boot variable.
15. The method of claim 14 , wherein the obtaining the password during each second boot further includes:
obtaining the server details from the certain boot variable;
connecting to the server using the server details; and
obtaining the password from the server during the connecting.
16. The method of claim 11 , wherein the reading following the first boot further includes moving the value for the password from the first boot variable to the one or more second boot variables.
17. The method of claim 16 , wherein the obtaining the password during each second boot further includes reading the password from a certain second boot variable.
18. The method of claim 16 , wherein the obtaining during each second boot further includes reading different portions of the password from multiple second boot variables and assembling the different portions into the password.
19. A method, comprising:
identifying a password set in a firmware variable of a terminal;
performing a first boot on the terminal based on the password;
following the first boot:
reading the password from the firmware variable;
setting the password on a hard disk drive of the terminal to lock the hard disk drive requiring the password for unlocking the hard disk drive;
obfuscating the password; and
storing the obfuscated password in one or more second firmware variables;
during each second boot of the terminal:
reading the obfuscated password from the one or more second firmware variables;
de-obfuscating the obfuscated password back into the password;
sending the password to the hard disk drive causing the hard disk drive to unlock; and
booting the terminal to the hard disk drive for use by the terminal following each second boot of the terminal.
20. The method of claim 19 , wherein setting following the first boot further includes issuing an ATA command to the hard disk drive to set the password for locking and unlocking the hard disk drive on the hard disk drive.