Tag Info

Hot answers tagged

6

Matthew Garrett has some nice blog posts on UEFI Secure Boot. Concerning your question he writes: Anyone can pay $99 and get their binaries signed. So why won't malware authors just do that? For starters, you'll need to provide some form of plausible ID for Verisign to authenticate you and hand over access. So, sure, you provide some sort of fake ID. ...


5

This depends what you mean by “the overall concept of secure boot”. Pretty much all secure boot systems have several components, starting with one in ROM and ending with an operating system or even programs within that operating system. A typical boot chain is ROM → OEM bootloader → OS bootloader → OS kernel → OS startup programs. A typical secure boot ...


4

Real security enhancements are created if you are buying for a commercial or governmental enterprise but at a cost related to supportability. For the majority of home users who want nothing more than a Microsoft desktop and never modify their purchased system it will also provided added security. For the home user that wants to dual boot (a very small ...


3

Secure Boot for PCs is inflexible and leaves you with few options if your system is somehow broken. It is also not designed to scale in an environment with multiple stakeholders - say your company wants to use Secure Boot to ensure not only a proper windows installation but also a set of certain policy-enforcing tools. Not possible out of the box. Trusted ...


3

The attack you describe sounds more like a "diamond heist" attack of sorts (a bit elaborate for the everyday criminal). Before I address UEFI, I wanted to answer if that is feasable. No, not really. If we are talking about a server running a VM, the end user may not notice a performance issue (given enough physical resources) but more than likely the ...


3

You are mixing up two technologies here it seems. First, there is UEFI and its Secure Boot feature. Secure Boot can be used to assure that your boot loader and your OS kernel are not tampered with. In order to do so, your boot loader and kernel need to be signed digitally and your UEFI configuration must contain the certificates/signatures needed to verify ...


2

UEFI secure boot ensures that the UEFI firmware loads and executes only signed UEFI applications (including bootloaders) and drivers. So an attempt to modify them by introducing a malware would be detected and rejected. A vulnerability or malware (including rootkits) could possibly be also signed in the loaded code or the components loaded next. Can a ...


2

This is using Trusted Platform Module to defeat the Evil Maid Attack. In short this is to insure that your bootloader hasn't been tampered with, which could undermine an encrypted file system.



Only top voted, non community-wiki answers of a minimum length are eligible