Wonder if secure boot can protect my computer from usb drives with infected firmware after Debian os is booted ?
2
-
As one might guess from the name, secure boot is about securing the boot process. Once the computer has booted, security is up to the OS. And in the case of an infected firmware, the OS doesn't really have any way to verify the firmware of the USB, so it can't protect you there.– nobodyNov 24, 2021 at 19:36
-
A firmware from an USB Stick is never executed on your computer, instead it is running on the CPU inside the USB stick. Therefore the answer is neither yes nor no.– RobertNov 24, 2021 at 19:52
Add a comment
|
1 Answer
TL,DR: No. USB drive firmware runs on the USB drive, not on the computer.
Long answer: It can do nothing because SecureBoot only secures the boot (hence the name) and once the OS is running, it does nothing anymore.
If by "infected firmware" you mean BadUSB, the OS can protect itself from it and SecureBoot does nothing at all. BadUSB means a USB device exposes multiple device profiles (Mass storage, network card, HID device) in order to execute actions (not code) on the OS.
What actions? The most basic are sending keystrokes to execute programs, and creating a new network device with a DNS with a higher priority than the correct one.
The OS can have a whitelist of allowed devices, and don't enable devices that aren't on the list. If you are not expecting to use a USB mouse, you can block USB mice from being allowed.
If the infected firmware is there to corrupt files, hide files from the OS, or something like that, the OS cannot do anything, and SecureBoot cannot do anything. The OS does not have any execution powers inside the processing chip on the USB device, and SecureBoot task ends when the control is passed to the OS.
If you are confusing "firmware" and "driver", SecureBoot can't do anything at all (see above), and the OS is the one that can have mechanisms to protect itself from the installation of rogue firmware.
answered Nov 24, 2021 at 20:32
