Questions tagged [secure-boot]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

Is it possible to assess the integrity of an SSD's firmware using SMART results or drive details?

I recently bought a used SanDisk SSD and I am curious to know if there is any way to assess the integrity of its firmware using information such as SMART or drive details. In addition to SMART ...
user avatar
  • 1
1 vote
2 answers
121 views

TPM Endorsement Key usage in secure and trusted boot

Taking into account a Root of Trust in a device using a TPM. My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
user avatar
0 votes
0 answers
32 views

Does secure boot prevent evil maid attacks when using LUKS?

When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger? Disk is formatted using defaults which ...
user avatar
3 votes
1 answer
359 views

Secure boot after an OTA update confusion

My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
user avatar
0 votes
4 answers
229 views

Can TPM2 disk encryption protect data after full server theft?

I read about TPM2 with PCR locking full-disk encryption from different sources. For example [1]. What I can't understand is how much does this protect from full server theft. If we assume that TPM2 ...
user avatar
1 vote
0 answers
71 views

Is grub implementation of secure boot inherently flawed?

Definitions Grub is the second stage bootloader often found in Linux distributions. shim is the first bootloader ran by the ROM firmware. It is signed by Microsoft. ROM firmware is the code embedded ...
user avatar
1 vote
0 answers
38 views

Is it possible for malware to overwrite UEFI code when installing an operating system?

If the ISO file for an operating system is malicious, is it possible for it to overwrite UEFI code when booted (If secure boot is disabled)?
user avatar
0 votes
0 answers
101 views

Does secure boot protect you from infected BIOS/firmware?

About secure boot, I've visited intel's website and they said: The feature defines an entirely new interface between operating system and firmware/BIOS. When enabled and fully configured, Secure Boot ...
user avatar
  • 1
-1 votes
1 answer
104 views

Booting from removeable media, evil maid, and others? [closed]

I am having a problem understanding some security techniques and was hoping someone could clarify some things. For instance, in terms of an evil maid attack, what are some solutions to preventing ...
user avatar
0 votes
0 answers
99 views

Can an OS implement Trusted Boot without TPM given Secure Boot?

Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
user avatar
  • 139
2 votes
0 answers
116 views

How to prevent grub.cfg from breaking the chain of trust?

First some definitions and common understanding. The premise of secure boot is that each binary get's verified before it is loaded. This starts with the firmware in ROM verifying the EFI application. ...
user avatar
0 votes
1 answer
239 views

Can I store an openssl generated public key on a TPM (2.0) device?

I've got an Infineon SLB9670 TPM module connected to a BeagleBone Board. I would like to carry out RSA signature verification on the board by using the TPM as a key store (storing the public key). W.r....
user avatar
  • 3
14 votes
6 answers
7k views

What's stopping someone from copying my HDD/SSD?

Let's say I have to leave my computer unattended and turned off for a while with some strangers, is it possible for someone to clone my HDD and SSD data?
user avatar
  • 265
2 votes
2 answers
250 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
user avatar
1 vote
0 answers
131 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
user avatar
  • 15.3k
1 vote
0 answers
70 views

Restricting what hard drive can be used with a given machine

I have a machine running CentOS 7 with a removable hard drive. I want to restrict what hard drive can be used with the machine i.e. the machine can only be used with one disk and nothing else. I've ...
user avatar
  • 111
1 vote
2 answers
866 views

Is factory reset enough to remove malware from laptop?

I have an ASUS laptop with Windows 10 that I want to factory reset. I used it for many years and did some torrenting with it in the past, so I wouldn't be surprised if something went wrong when it ...
user avatar
  • 121
1 vote
0 answers
97 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
user avatar
  • 1,095
1 vote
0 answers
155 views

Does (UEFI) secure boot provide security advantages over TPM measured boot?

Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM. As i read into each, it appears to me that the TPM measurements to each stage would provide ...
user avatar
0 votes
1 answer
116 views

What are the threats addressed by a Hardware Root-of-Trust?

SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
user avatar
2 votes
1 answer
356 views

Understanding Secure Boot

I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around. At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
user avatar
0 votes
1 answer
569 views

What kind of "actions" can a TPM2 policy authorize?

I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
user avatar
1 vote
2 answers
166 views

How do we know that input to TPMs actually comes from the measured code?

Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it. What stops an attacker from doing this: Start a legitimate copy of the client ...
user avatar
  • 182
7 votes
2 answers
949 views

Is it possible to make a laptop useless to thieves?

I was robbed... That included my Linux notebook and my company's notebook. Both are encrypted. Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has ...
user avatar
  • 183
1 vote
0 answers
124 views

"Trusted memory" What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
user avatar
  • 259
0 votes
0 answers
179 views

Bypassing Secure Boot in System on Chip

To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
user avatar
  • 259
1 vote
1 answer
503 views

Integrity Check on power on VS. Secure boot

Can we consider the Integrity Check on power-on and the secure boot equal from security point of view? Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
user avatar
  • 259
0 votes
2 answers
175 views

Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?

We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary. We're in the process of ...
user avatar
  • 1
1 vote
1 answer
1k views

Why authenticated boot not Secure boot?

Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
user avatar
  • 259
1 vote
0 answers
86 views

High Availability Boot processes and only using code-signing certificates

High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as: "HAB authentication is based on public key cryptography using the RSA algorithm in ...
user avatar
  • 123
2 votes
3 answers
318 views

How much of the system is secure boot going to cover?

Background: We're developing for a Debian 9.8 system on an x86, but most of us here are more used to dealing with embedded devices. according to wikipedia, secure boot can "secure the boot process ...
user avatar
1 vote
2 answers
471 views

Secure Boot - Verifying applications

I have been reading up on Secure Boot, in particular what it actually checks during the boot process. According to Microsoft the Secure Boot process works as follows: Firmware Boot Components: The ...
user avatar
  • 135
2 votes
1 answer
248 views

Secure Boot - Usage of blacklist DB

I have been reading up on the details of Secure Boot, in particular the authorized and forbidden databases: Before enabling UEFI Secure Boot (by setting the PK) the white and black lists DB & ...
user avatar
  • 135
1 vote
0 answers
227 views

Secure way to sign virtualbox module for secure boot

I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
user avatar
  • 15.3k