Hot answers tagged

9

One simple answer is bugs in the code that implements those security features. For example, the recently-released CVE-2015-2552 allows loading unsigned (well, test-signed, which is almost the same thing) drivers on a system that has Secure Boot enabled. There have also been a number of bugs in UEFI implementations (and other low-level code) that allowed ...


6

what this allows an attacker to do? It allows an attacker to execute arbitrary code in System Management Mode (SMM), a highly privileged execution mode of x86 processors. This mode is transparent to the Operating System (OS) and it is more privileged than any other mode. If an attacker can execute code in SMM, it basically owns the platform/computer (more ...


4

The strength of an encryption solution is directly tied to the number of possible passwords. A brute force attack simply tries all possible passwords so it will succeed more quickly if the number of distinct passwords is smaller. Case insensitivity means the attacker only has to try lower case passwords since 'EXAMPLE', 'eXamplE' and 'ExAmPlE' would all be ...


3

There is always an operating system, albeit not necessarily a complex one. The BIOS is an OS in the strict sense of the term: it provides access to hardware through an hardware-independent API. The boot code for an OS (or some malware that pretends to be that boot code) uses the BIOS-provided API to read (and possibly write) bytes from the hard disk. ...


3

In layman's term, as requested, I think this vulnerabiliy can be simply boiled down to particular case of privilege escalation attack. It follows the same way, and pursue the same goal (and such attacks against SMM are not new: two other occurrences were presented at the Black Hat conference in 2008 and 2015). How it works: it works by injecting arbitrary ...


1

I can't remember the last time I worked on a system where a CMOS battery pull reset the password. Of course, password reset jumpers or manufacturer override codes are features, and you can expect UEFI to have all the features BIOS had and then some. Remember, though, that BIOS passwords aren't that powerful. They protect against someone with physical access ...


1

From what I can tell in this guide, and I preface this that I'm not an expert in TPMs, taking ownership of a TPM does not affect the Secure Boot options for an operating system. Taking ownership of a TPM means resetting the keys within the TPM with a new ownership password. In Microsoft Windows at least this means that the TPM is consulted for any ...


1

Think about the overall concept of "security" as protecting data from loss. There are several forms of loss. There is loss to a malicious third party, but there is also the loss of access to the data, meaning the owner can't get to it anymore. This would happen if the user gets the password wrong. Presuming the encryption is cryptographically strong, ...


1

You can persist by compromising the UEFI firmware, and doing so is extremely easy (for a state-sponsored attacker). On most consumer-grade machines there are no signature checks on the firmware images and you can thus install malicious firmware, and since Secure boot is enforced by that firmware, you can thus bypass Secure boot. Personally I only know of ...


1

Focusing on the simpler of the two, the BIOS boot, the answer is no. To quote this IBM reference IBM link Historical issues limit the size of a user-supplied bootloader program to slightly less than 512 bytes. Since this isn't enough space to implement all the possible device drivers that might be required to access different displays and storage ...


1

Already before UEFI, infected firmware could do what it wanted, including spying on you. What changed, is that UEFI now has a network stack, making writing payloads much easier. Also, if you have attackers with physical access, you have already lost.


1

There is an entire literature in the Blackhat and Defcon communities showing how to exploit the software that manages TPMs, retrieve secret keys from the TPM by interposing on the communication between the TPM and the CPU, and other attacks. The answer above by Kevinze and his followup comments are simply not accurate (he/she argues that such exploits are ...


1

Secure Boot is one security technology, it is not complete. There can be attacks before Secure Boot, Intel created Boot Guard for that. Read this Apress book for better understanding of the various Intel silicon and firmware technologies: http://firmwaresecurity.com/tag/isbn-978-1-4302-6572-6/ Also, Secure Boot varies in strength by OS, see: http://...



Only top voted, non community-wiki answers of a minimum length are eligible