Timeline for What does Secure Boot protect against?
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 31, 2023 at 18:02 | vote | accept | nevermind | ||
| Jul 31, 2023 at 3:20 | comment | added | CBHacking | @nevermind in that case attackers presumably don't need to install a new bootloader at all, right? If you're using a bootloader that doesn't verify the OS, or an OS that doesn't verify the software, then all that Secure Boot gets you is protection against boot-time attacks. But that's not nothing! Mostly, it would still allow a greater degree of security for disk encryption. You could also create your own chain of trust (signed bootloader and kernel + init, at least) and enable Secure Boot trusting only your own signing key (plus lock down the firmware setup) as a bootkit protection. | |
| Jul 30, 2023 at 20:21 | comment | added | nevermind | why is your vendor signing bootloaders that do what the attacker wants? - Well, Linux vendors signs the software that does what the user wants (within their login privilege level, of course), and once those privileges are obtained, it is hard to tell whether a certain action is intended (user's) or malicious (attacker's). Getting your own wallet keys, sending data to North Korea, and even installing completely different OS are valid user actions from this perspective. | |
| Jul 30, 2023 at 20:18 | comment | added | nevermind | Thank you. So, as far as I get from your answer, Secure Boot requires additional protection on the OS level, otherwise the chain of trust is broken. What about OS's that give their owners more freedom, like Linux? | |
| Jul 30, 2023 at 11:01 | history | answered | CBHacking | CC BY-SA 4.0 |