Questions tagged [secure-boot]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

Secure boot disabled for Potential BIOS compromise on Tails OS machine

I have an ASUS computer that I use strictly for booting Tails OS from a USB. A few weeks ago I went into the BIOS and noticed that secure boot was disabled. This computer has secure boot enabled by ...
blacksangria's user avatar
1 vote
0 answers
53 views

Why the TPM PCRs does not consider a UEFI settings change? If someone resets CMOS, it's undetected

In my laptop I've set up a bios password when I power on the laptop, and once I enter it the laptop starts my linux distro and decrypts the disk without asking any other password. To do this I've set ...
Allexj's user avatar
  • 115
0 votes
1 answer
77 views

How do nonce hashes prevent replay attacks on Apple Silicon?

Apple Silicon-based Macs have a LocalPolicy file that controls the secure boot process. To prevent replay attacks of the LocalPolicy, hashes of nonces are used. From here: The lpnh is used for anti-...
Melab's user avatar
  • 247
0 votes
2 answers
82 views

Secure Boot: Can Firmware verify every component?

As far as I've seen, the Secure Boot process is described like so: A firmware stored in read-only memory and therefore considered secure starts. It verifies the next software component (e.g. a ...
arkountos's user avatar
2 votes
1 answer
158 views

In a secure boot bootloader chain, does a bootloader image contain the RootCA certificate of the next bootloader?

This is coming from Qualcomm's Secure Boot explanation. https://www.qualcomm.com/content/dam/qcomm-martech/dm-assets/documents/secure-boot-image-authentication_11.30.16.pdf Within it, it explains that ...
itsmarziparzi's user avatar
0 votes
0 answers
35 views

Is shim secure if new MOK entried can be added without a password?

I'm trying to understand how shim is considered secure. Shim is a signed bootloader that allows to load any image (at a fixed path in the EFI System Partition) as long as its hash is added to a MOK (...
Juan I Carrano's user avatar
1 vote
1 answer
452 views

What does Secure Boot protect against?

As far as I understand, Secure Boot protects system from running code not signed by a specific vendor(s) during early boot stages. In order to attempt an attack on the bootloader in the first place, ...
nevermind's user avatar
  • 113
0 votes
0 answers
108 views

Why is Secure Boot in an ECU required when there is Secure Flashing capabilities?

it seems state of the art that the autmotive electronical Control units (ECUs) contain security features as Secure Flashing and Secure Boot. For secure flashing, each new software to be programmed is ...
UserUser's user avatar
0 votes
1 answer
100 views

Successful UEFI secure boot exploitation

Are there any real examples (malware, rootkits, etc.) of exploiting the UEFI secure boot mechanism vulnerabilities such as CVE-2022-21894?
Artem S. Tashkinov's user avatar
1 vote
1 answer
233 views

Do I need Secure Boot on an Embedded Device?

I need to rate the risk of not having secure boot for a specific embedded device. It is clear to me that secure boot is an essential part of the root of trust of a system. In the scenario however, I ...
Rodolfo B's user avatar
1 vote
2 answers
508 views

Can BIOS/UEFI malware pretend that secure boot is enabled?

As the title says, can BIOS/UEFI malware pretend that secure boot is enabled? And if so, is there any point to enabling secure boot on a device that came with it disabled (or that you previously ...
NutcaseBackwater16's user avatar
1 vote
2 answers
1k views

Full disk encryption: Legacy boot mode (MBR) vs. EFI boot mode

FDE tools like VeraCrypt will encrypt the whole system drive when the machine uses legacy boot mode (MBR). But they will only encrypt the system partition if the machine uses EFI boot mode (the EFI ...
stackprotector's user avatar
4 votes
1 answer
280 views

Would secure boot block GPU if it has modified vbios?

I think that AMD GPUs can be flashed with any modded VBIOS because the GPU doesn't check for firmware signature. Shouldn't the secure boot be able to check signature of the AMD GPUs modded VBIOS and ...
user286874's user avatar
3 votes
0 answers
365 views

Secure boot + full disk encryption, should I sign the kernel?

I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain. Here's what I did so far : Enroll my own keys in the UEFI firmware Sign my grub bootloader Full disk ...
ShellCode's user avatar
  • 130
-1 votes
1 answer
413 views

How can kon-boot run code in UEFI?

I've now googled a lot, but the only information I can find is 'kon-boot hides its code in BIOS memory and changes kernel-code on the fly'... As far as I understand, UEFI initializes devices and tries ...
BlackFlag's user avatar
0 votes
1 answer
217 views

Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?

For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
User4857's user avatar
0 votes
2 answers
603 views

Seabios and secure boot. Coreboot payload

I'm choosing between Seabios and Tianocore as a coreboot payload. Secure boot is a UEFI feature. I haven't found any mention of it in seabios documentation. It must be not supported. Can anyone ...
lolz's user avatar
  • 11
1 vote
0 answers
146 views

How hard is it to modify UEFI nvram if the device is off and the UEFI is locked?

This assumes that: Machine is powered off No UEFI backdoors No Reflashing the firmware No clearing the NVRAM (The point is to modify/read a small amount of NVRAM, instead of resetting it) Device ...
A-random-nerd's user avatar
0 votes
1 answer
538 views

fTPM more secure than TPM when using Bitlocker?

Is fTPM more secure than a real TPM module when using Bitlocker? As far as I know, you should enable pre-boot authentication if you use a TPM module that is plugged separately onto the motherboard to ...
Opa114's user avatar
  • 101
2 votes
1 answer
151 views

How do you boot from the network using https?

How do you boot a Linux live image from a CDN using Https as boot protocol? The reason for netbooting using a CDN would be to start fresh with a non persistent operating system image. Booting fresh ...
Christian's user avatar
  • 265
1 vote
1 answer
117 views

Is it possible to allow only a certain secure USB boot media to boot an UEFI system?

I want to restrict all USB boot media from my system, except for a certain USB boot drive that I declare secure via a certain key. Is this possible using UEFI/Secure Boot/TPM? Maybe via TPM? TPM gets ...
JohnnyFromBF's user avatar
  • 1,413
1 vote
2 answers
692 views

TPM Endorsement Key usage in secure and trusted boot

Taking into account a Root of Trust in a device using a TPM. My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
Engineer999's user avatar
1 vote
0 answers
154 views

Does secure boot prevent evil maid attacks when using LUKS?

When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger? Disk is formatted using defaults which ...
sunknudsen's user avatar
3 votes
1 answer
635 views

Secure boot after an OTA update confusion

My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
Engineer999's user avatar
0 votes
4 answers
1k views

Can TPM2 disk encryption protect data after full server theft?

I read about TPM2 with PCR locking full-disk encryption from different sources. For example [1]. What I can't understand is how much does this protect from full server theft. If we assume that TPM2 ...
akostadinov's user avatar
1 vote
0 answers
161 views

Is grub implementation of secure boot inherently flawed?

Definitions Grub is the second stage bootloader often found in Linux distributions. shim is the first bootloader ran by the ROM firmware. It is signed by Microsoft. ROM firmware is the code embedded ...
TheMeaningfulEngineer's user avatar
1 vote
0 answers
105 views

Is it possible for malware to overwrite UEFI code when installing an operating system?

If the ISO file for an operating system is malicious, is it possible for it to overwrite UEFI code when booted (If secure boot is disabled)?
4389759843759's user avatar
0 votes
0 answers
496 views

Does secure boot protect you from infected BIOS/firmware?

About secure boot, I've visited intel's website and they said: The feature defines an entirely new interface between operating system and firmware/BIOS. When enabled and fully configured, Secure Boot ...
Light's user avatar
  • 1
-1 votes
1 answer
207 views

Booting from removeable media, evil maid, and others? [closed]

I am having a problem understanding some security techniques and was hoping someone could clarify some things. For instance, in terms of an evil maid attack, what are some solutions to preventing ...
Rideboards's user avatar
0 votes
0 answers
600 views

Can an OS implement Trusted Boot without TPM given Secure Boot?

Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
beroal's user avatar
  • 158
3 votes
0 answers
255 views

How to prevent grub.cfg from breaking the chain of trust?

First some definitions and common understanding. The premise of secure boot is that each binary get's verified before it is loaded. This starts with the firmware in ROM verifying the EFI application. ...
TheMeaningfulEngineer's user avatar
0 votes
1 answer
644 views

Can I store an openssl generated public key on a TPM (2.0) device?

I've got an Infineon SLB9670 TPM module connected to a BeagleBone Board. I would like to carry out RSA signature verification on the board by using the TPM as a key store (storing the public key). W.r....
Harsh's user avatar
  • 3
14 votes
6 answers
8k views

What's stopping someone from copying my HDD/SSD?

Let's say I have to leave my computer unattended and turned off for a while with some strangers, is it possible for someone to clone my HDD and SSD data?
Gem's user avatar
  • 265
2 votes
2 answers
629 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
Akhilesh Gupta's user avatar
2 votes
0 answers
243 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
reed's user avatar
  • 15.7k
1 vote
0 answers
76 views

Restricting what hard drive can be used with a given machine

I have a machine running CentOS 7 with a removable hard drive. I want to restrict what hard drive can be used with the machine i.e. the machine can only be used with one disk and nothing else. I've ...
PCL's user avatar
  • 111
1 vote
2 answers
1k views

Is factory reset enough to remove malware from laptop?

I have an ASUS laptop with Windows 10 that I want to factory reset. I used it for many years and did some torrenting with it in the past, so I wouldn't be surprised if something went wrong when it ...
memememe's user avatar
  • 121
1 vote
0 answers
166 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
Jake's user avatar
  • 1,095
1 vote
0 answers
190 views

Does (UEFI) secure boot provide security advantages over TPM measured boot?

Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM. As i read into each, it appears to me that the TPM measurements to each stage would provide ...
Feiyeung's user avatar
1 vote
1 answer
202 views

What are the threats addressed by a Hardware Root-of-Trust?

SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
Indranil Banerjee's user avatar
2 votes
1 answer
629 views

Understanding Secure Boot

I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around. At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
SpiderRico's user avatar
0 votes
1 answer
1k views

What kind of "actions" can a TPM2 policy authorize?

I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
user1733212's user avatar
1 vote
2 answers
225 views

How do we know that input to TPMs actually comes from the measured code?

Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it. What stops an attacker from doing this: Start a legitimate copy of the client ...
jacobbaer's user avatar
  • 192
7 votes
2 answers
1k views

Is it possible to make a laptop useless to thieves?

I was robbed... That included my Linux notebook and my company's notebook. Both are encrypted. Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has ...
Cilyan's user avatar
  • 183
1 vote
0 answers
155 views

"Trusted memory" What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
Lavender's user avatar
  • 259
0 votes
0 answers
234 views

Bypassing Secure Boot in System on Chip

To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
Lavender's user avatar
  • 259
1 vote
1 answer
862 views

Integrity Check on power on VS. Secure boot

Can we consider the Integrity Check on power-on and the secure boot equal from security point of view? Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
Lavender's user avatar
  • 259
0 votes
2 answers
271 views

Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?

We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary. We're in the process of ...
xavor's user avatar
  • 1
1 vote
1 answer
2k views

Why authenticated boot not Secure boot?

Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
Lavender's user avatar
  • 259
1 vote
0 answers
100 views

High Availability Boot processes and only using code-signing certificates

High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as: "HAB authentication is based on public key cryptography using the RSA algorithm in ...
sdbol's user avatar
  • 123