0

To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the main memory. In that case, the bootloader which is the fisrt element of the chain of trust is not even booted. In such attacks, the whole secure boot mechanism is bypassed (see the paper [1] where the bootloader is stored in an external flash memory and the attack targets the action of coping the original first stage bootloder BL1 into the main memory).

Question:

Is successfully booting the bootloder (safely copied to the main memory) guarantees a successful secure boot process?

1: "Controlling PC on ARM using Fault Injection"

Improve this question
3
  • 1
    I probably misunderstood something. Why do you think only first part of secure boot chain matters? – domen Feb 4 '20 at 11:53
  • @domen Actually I want to know if it is the most important part or not because if the first part of the secure boot is conducted, this tells that the secure boot process has started at least and that it was not bypassed from the beginning. – Lavender Feb 4 '20 at 21:44
  • 1
    Chain is a strong as its weakest link. holds here too. If attackers goal is to load untrusted binaries, then bypassing any part of chain would do. It might be more valuable to bypass early, as it might give ability to code executed with higher privileges. It depends on design and what threats were considered. – domen Feb 5 '20 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.