Questions tagged [secure-boot]
The secure-boot tag has no usage guidance.
54
questions
0
votes
0
answers
49
views
Secure boot disabled for Potential BIOS compromise on Tails OS machine
I have an ASUS computer that I use strictly for booting Tails OS from a USB. A few weeks ago I went into the BIOS and noticed that secure boot was disabled.
This computer has secure boot enabled by ...
1
vote
0
answers
53
views
Why the TPM PCRs does not consider a UEFI settings change? If someone resets CMOS, it's undetected
In my laptop I've set up a bios password when I power on the laptop, and once I enter it the laptop starts my linux distro and decrypts the disk without asking any other password. To do this I've set ...
- 115
0
votes
1
answer
77
views
How do nonce hashes prevent replay attacks on Apple Silicon?
Apple Silicon-based Macs have a LocalPolicy file that controls the secure boot process. To prevent replay attacks of the LocalPolicy, hashes of nonces are used. From here:
The lpnh is used for anti-...
- 247
0
votes
2
answers
82
views
Secure Boot: Can Firmware verify every component?
As far as I've seen, the Secure Boot process is described like so: A firmware stored in read-only memory and therefore considered secure starts. It verifies the next software component (e.g. a ...
2
votes
1
answer
158
views
In a secure boot bootloader chain, does a bootloader image contain the RootCA certificate of the next bootloader?
This is coming from Qualcomm's Secure Boot explanation.
https://www.qualcomm.com/content/dam/qcomm-martech/dm-assets/documents/secure-boot-image-authentication_11.30.16.pdf
Within it, it explains that ...
- 121
0
votes
0
answers
35
views
Is shim secure if new MOK entried can be added without a password?
I'm trying to understand how shim is considered secure.
Shim is a signed bootloader that allows to load any image (at a fixed path in the EFI System Partition) as long as its hash is added to a MOK (...
1
vote
1
answer
452
views
What does Secure Boot protect against?
As far as I understand, Secure Boot protects system from running code not signed by a specific vendor(s) during early boot stages.
In order to attempt an attack on the bootloader in the first place, ...
- 113
0
votes
0
answers
108
views
Why is Secure Boot in an ECU required when there is Secure Flashing capabilities?
it seems state of the art that the autmotive electronical Control units (ECUs) contain security features as Secure Flashing and Secure Boot. For secure flashing, each new software to be programmed is ...
- 1
0
votes
1
answer
100
views
Successful UEFI secure boot exploitation
Are there any real examples (malware, rootkits, etc.) of exploiting the UEFI secure boot mechanism vulnerabilities such as CVE-2022-21894?
- 2,552
1
vote
1
answer
233
views
Do I need Secure Boot on an Embedded Device?
I need to rate the risk of not having secure boot for a specific embedded device.
It is clear to me that secure boot is an essential part of the root of trust of a system.
In the scenario however, I ...
- 11
1
vote
2
answers
508
views
Can BIOS/UEFI malware pretend that secure boot is enabled?
As the title says, can BIOS/UEFI malware pretend that secure boot is enabled? And if so, is there any point to enabling secure boot on a device that came with it disabled (or that you previously ...
1
vote
2
answers
1k
views
Full disk encryption: Legacy boot mode (MBR) vs. EFI boot mode
FDE tools like VeraCrypt will encrypt the whole system drive when the machine uses legacy boot mode (MBR). But they will only encrypt the system partition if the machine uses EFI boot mode (the EFI ...
- 1,653
4
votes
1
answer
280
views
Would secure boot block GPU if it has modified vbios?
I think that AMD GPUs can be flashed with any modded VBIOS because the GPU doesn't check for firmware signature.
Shouldn't the secure boot be able to check signature of the AMD GPUs modded VBIOS and ...
- 41
3
votes
0
answers
365
views
Secure boot + full disk encryption, should I sign the kernel?
I'm redoing my laptop installation from scratch, and this time I want a full secure boot chain.
Here's what I did so far :
Enroll my own keys in the UEFI firmware
Sign my grub bootloader
Full disk ...
- 130
-1
votes
1
answer
413
views
How can kon-boot run code in UEFI?
I've now googled a lot, but the only information I can find is 'kon-boot hides its code in BIOS memory and changes kernel-code on the fly'...
As far as I understand, UEFI initializes devices and tries ...
- 61
0
votes
1
answer
217
views
Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?
For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and ...
- 31
0
votes
2
answers
603
views
Seabios and secure boot. Coreboot payload
I'm choosing between Seabios and Tianocore as a coreboot payload.
Secure boot is a UEFI feature. I haven't found any mention of it in seabios documentation. It must be not supported.
Can anyone ...
- 11
1
vote
0
answers
146
views
How hard is it to modify UEFI nvram if the device is off and the UEFI is locked?
This assumes that:
Machine is powered off
No UEFI backdoors
No Reflashing the firmware
No clearing the NVRAM (The point is to modify/read a small amount of NVRAM, instead of resetting it)
Device ...
0
votes
1
answer
538
views
fTPM more secure than TPM when using Bitlocker?
Is fTPM more secure than a real TPM module when using Bitlocker?
As far as I know, you should enable pre-boot authentication if you use a TPM module that is plugged separately onto the motherboard to ...
- 101
2
votes
1
answer
151
views
How do you boot from the network using https?
How do you boot a Linux live image from a CDN using Https as boot protocol?
The reason for netbooting using a CDN would be to start fresh with a non persistent operating system image. Booting fresh ...
- 265
1
vote
1
answer
117
views
Is it possible to allow only a certain secure USB boot media to boot an UEFI system?
I want to restrict all USB boot media from my system, except for a certain USB boot drive that I declare secure via a certain key.
Is this possible using UEFI/Secure Boot/TPM? Maybe via TPM? TPM gets ...
- 1,413
1
vote
2
answers
692
views
TPM Endorsement Key usage in secure and trusted boot
Taking into account a Root of Trust in a device using a TPM.
My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
- 267
1
vote
0
answers
154
views
Does secure boot prevent evil maid attacks when using LUKS?
When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger?
Disk is formatted using defaults which ...
- 219
3
votes
1
answer
635
views
Secure boot after an OTA update confusion
My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
- 267
0
votes
4
answers
1k
views
Can TPM2 disk encryption protect data after full server theft?
I read about TPM2 with PCR locking full-disk encryption from different sources. For example [1]. What I can't understand is how much does this protect from full server theft.
If we assume that TPM2 ...
- 624
1
vote
0
answers
161
views
Is grub implementation of secure boot inherently flawed?
Definitions
Grub is the second stage bootloader often found in Linux distributions.
shim is the first bootloader ran by the ROM firmware. It is signed by Microsoft.
ROM firmware is the code embedded ...
1
vote
0
answers
105
views
Is it possible for malware to overwrite UEFI code when installing an operating system?
If the ISO file for an operating system is malicious, is it possible for it to overwrite UEFI code when booted (If secure boot is disabled)?
0
votes
0
answers
496
views
Does secure boot protect you from infected BIOS/firmware?
About secure boot, I've visited intel's website and they said:
The feature defines an entirely new interface between operating system and firmware/BIOS. When enabled and fully configured, Secure Boot ...
- 1
-1
votes
1
answer
207
views
Booting from removeable media, evil maid, and others? [closed]
I am having a problem understanding some security techniques and was hoping someone could clarify some things. For instance, in terms of an evil maid attack, what are some solutions to preventing ...
- 589
0
votes
0
answers
600
views
Can an OS implement Trusted Boot without TPM given Secure Boot?
Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
- 158
3
votes
0
answers
255
views
How to prevent grub.cfg from breaking the chain of trust?
First some definitions and common understanding.
The premise of secure boot is that each binary get's verified before
it is loaded. This starts with the firmware in ROM verifying the EFI
application.
...
0
votes
1
answer
644
views
Can I store an openssl generated public key on a TPM (2.0) device?
I've got an Infineon SLB9670 TPM module connected to a BeagleBone Board. I would like to carry out RSA signature verification on the board by using the TPM as a key store (storing the public key). W.r....
- 3
14
votes
6
answers
8k
views
What's stopping someone from copying my HDD/SSD?
Let's say I have to leave my computer unattended and turned off for a while with some strangers, is it possible for someone to clone my HDD and SSD data?
- 265
2
votes
2
answers
629
views
Secure boot for devices which don't have hardware security element
I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/..
So for ...
- 173
2
votes
0
answers
243
views
Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)
In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
- 15.7k
1
vote
0
answers
76
views
Restricting what hard drive can be used with a given machine
I have a machine running CentOS 7 with a removable hard drive. I want to restrict what hard drive can be used with the machine i.e. the machine can only be used with one disk and nothing else.
I've ...
- 111
1
vote
2
answers
1k
views
Is factory reset enough to remove malware from laptop?
I have an ASUS laptop with Windows 10 that I want to factory reset. I used it for many years and did some torrenting with it in the past, so I wouldn't be surprised if something went wrong when it ...
- 121
1
vote
0
answers
166
views
PKI Usage in Trusted Boot
I am trying to understand how PKI is used to boot an ARM board.
The following image relates to BL1:
The booting steps state:
Also from:
The certificate used in step 1 appears to be a content ...
- 1,095
1
vote
0
answers
190
views
Does (UEFI) secure boot provide security advantages over TPM measured boot?
Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM.
As i read into each, it appears to me that the TPM measurements to each stage would provide ...
- 11
1
vote
1
answer
202
views
What are the threats addressed by a Hardware Root-of-Trust?
SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
2
votes
1
answer
629
views
Understanding Secure Boot
I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around.
At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
- 187
0
votes
1
answer
1k
views
What kind of "actions" can a TPM2 policy authorize?
I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
- 21
1
vote
2
answers
225
views
How do we know that input to TPMs actually comes from the measured code?
Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it.
What stops an attacker from doing this:
Start a legitimate copy of the client ...
- 192
7
votes
2
answers
1k
views
Is it possible to make a laptop useless to thieves?
I was robbed...
That included my Linux notebook and my company's notebook. Both are encrypted.
Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has ...
- 183
1
vote
0
answers
155
views
"Trusted memory" What does it mean?
It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
- 259
0
votes
0
answers
234
views
Bypassing Secure Boot in System on Chip
To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
- 259
1
vote
1
answer
862
views
Integrity Check on power on VS. Secure boot
Can we consider the Integrity Check on power-on and the secure boot equal from security point of view?
Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
- 259
0
votes
2
answers
271
views
Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?
We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary.
We're in the process of ...
- 1
1
vote
1
answer
2k
views
Why authenticated boot not Secure boot?
Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
- 259
1
vote
0
answers
100
views
High Availability Boot processes and only using code-signing certificates
High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as:
"HAB authentication is based on public key cryptography using the RSA algorithm in ...
- 123