I'm trying to understand if the old school ways of bypassing a BIOS password (flip the BIOS jumper or remove the CMOS battery) still affect (some or all) modern UEFI?
If not, what protections do modern UEFI implement that prevent it?
1
-
Depends on whether the password is stored in battery-backed RAM or flash, which itself depends on whether the machine is consumer-grade garbage or decent business-grade stuff.– André BorieCommented Jul 14, 2016 at 12:49
Add a comment
|
1 Answer
I can't remember the last time I worked on a system where a CMOS battery pull reset the password. Of course, password reset jumpers or manufacturer override codes are features, and you can expect UEFI to have all the features BIOS had and then some.
Remember, though, that BIOS passwords aren't that powerful. They protect against someone with physical access to the keyboard and screen, but will fail against anyone with physical access to the machine itself. If you want to keep your data safe, you need full disk encryption controlled by a TPM and measured boot.
-
Thanks for the reply. Could you perhaps elaborate a bit on what you mean by "measure boot"?– JuicyCommented Jul 14, 2016 at 19:31
-
1Measured boot is when the TPM hashes together all the firmware and settings used when booting into its Platform Configuration Registers. It can then be instructed to seal the drive key, and only unseal it when those same values are in the PCRs. Essentially, the drive encryption key cannot be retrieved unless the same firmware and settings are loaded, so clearing the password or tampering with the boot process would make the key inaccessible. Commented Jul 14, 2016 at 20:43
-
1
-
In theory, that is correct. Practically, TMP was hacked several times.– OvermindCommented Jul 15, 2016 at 5:18
-
@Overmind The TPM compromises have nothing to do with this threat model (SRTM).– forestCommented Dec 14, 2018 at 9:09