Questions tagged [secure-boot]
The secure-boot tag has no usage guidance.
34
questions
0
votes
0
answers
49
views
Is it possible to assess the integrity of an SSD's firmware using SMART results or drive details?
I recently bought a used SanDisk SSD and I am curious to know if there is any way to assess the integrity of its firmware using information such as SMART or drive details.
In addition to SMART ...
- 1
1
vote
2
answers
121
views
TPM Endorsement Key usage in secure and trusted boot
Taking into account a Root of Trust in a device using a TPM.
My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
- 257
0
votes
0
answers
32
views
Does secure boot prevent evil maid attacks when using LUKS?
When one installs Debian 11 with secure-boot enabled, is computer protected against evil maid attacks trying to capture encryption keys using software keylogger?
Disk is formatted using defaults which ...
- 169
3
votes
1
answer
359
views
Secure boot after an OTA update confusion
My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
- 257
0
votes
4
answers
229
views
Can TPM2 disk encryption protect data after full server theft?
I read about TPM2 with PCR locking full-disk encryption from different sources. For example [1]. What I can't understand is how much does this protect from full server theft.
If we assume that TPM2 ...
- 545
1
vote
0
answers
71
views
Is grub implementation of secure boot inherently flawed?
Definitions
Grub is the second stage bootloader often found in Linux distributions.
shim is the first bootloader ran by the ROM firmware. It is signed by Microsoft.
ROM firmware is the code embedded ...
1
vote
0
answers
38
views
Is it possible for malware to overwrite UEFI code when installing an operating system?
If the ISO file for an operating system is malicious, is it possible for it to overwrite UEFI code when booted (If secure boot is disabled)?
0
votes
0
answers
101
views
Does secure boot protect you from infected BIOS/firmware?
About secure boot, I've visited intel's website and they said:
The feature defines an entirely new interface between operating system and firmware/BIOS. When enabled and fully configured, Secure Boot ...
- 1
-1
votes
1
answer
104
views
Booting from removeable media, evil maid, and others? [closed]
I am having a problem understanding some security techniques and was hoping someone could clarify some things. For instance, in terms of an evil maid attack, what are some solutions to preventing ...
- 559
0
votes
0
answers
99
views
Can an OS implement Trusted Boot without TPM given Secure Boot?
Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
- 139
2
votes
0
answers
116
views
How to prevent grub.cfg from breaking the chain of trust?
First some definitions and common understanding.
The premise of secure boot is that each binary get's verified before
it is loaded. This starts with the firmware in ROM verifying the EFI
application.
...
0
votes
1
answer
239
views
Can I store an openssl generated public key on a TPM (2.0) device?
I've got an Infineon SLB9670 TPM module connected to a BeagleBone Board. I would like to carry out RSA signature verification on the board by using the TPM as a key store (storing the public key). W.r....
- 3
14
votes
6
answers
7k
views
What's stopping someone from copying my HDD/SSD?
Let's say I have to leave my computer unattended and turned off for a while with some strangers, is it possible for someone to clone my HDD and SSD data?
- 265
2
votes
2
answers
250
views
Secure boot for devices which don't have hardware security element
I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/..
So for ...
- 163
1
vote
0
answers
131
views
Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)
In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
- 15.3k
1
vote
0
answers
70
views
Restricting what hard drive can be used with a given machine
I have a machine running CentOS 7 with a removable hard drive. I want to restrict what hard drive can be used with the machine i.e. the machine can only be used with one disk and nothing else.
I've ...
- 111
1
vote
2
answers
866
views
Is factory reset enough to remove malware from laptop?
I have an ASUS laptop with Windows 10 that I want to factory reset. I used it for many years and did some torrenting with it in the past, so I wouldn't be surprised if something went wrong when it ...
- 121
1
vote
0
answers
97
views
PKI Usage in Trusted Boot
I am trying to understand how PKI is used to boot an ARM board.
The following image relates to BL1:
The booting steps state:
Also from:
The certificate used in step 1 appears to be a content ...
- 1,095
1
vote
0
answers
155
views
Does (UEFI) secure boot provide security advantages over TPM measured boot?
Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM.
As i read into each, it appears to me that the TPM measurements to each stage would provide ...
- 11
0
votes
1
answer
116
views
What are the threats addressed by a Hardware Root-of-Trust?
SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
2
votes
1
answer
356
views
Understanding Secure Boot
I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around.
At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
- 177
0
votes
1
answer
569
views
What kind of "actions" can a TPM2 policy authorize?
I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
- 21
1
vote
2
answers
166
views
How do we know that input to TPMs actually comes from the measured code?
Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it.
What stops an attacker from doing this:
Start a legitimate copy of the client ...
- 182
7
votes
2
answers
949
views
Is it possible to make a laptop useless to thieves?
I was robbed...
That included my Linux notebook and my company's notebook. Both are encrypted.
Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has ...
- 183
1
vote
0
answers
124
views
"Trusted memory" What does it mean?
It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
- 259
0
votes
0
answers
179
views
Bypassing Secure Boot in System on Chip
To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
- 259
1
vote
1
answer
503
views
Integrity Check on power on VS. Secure boot
Can we consider the Integrity Check on power-on and the secure boot equal from security point of view?
Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
- 259
0
votes
2
answers
175
views
Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?
We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary.
We're in the process of ...
- 1
1
vote
1
answer
1k
views
Why authenticated boot not Secure boot?
Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
- 259
1
vote
0
answers
86
views
High Availability Boot processes and only using code-signing certificates
High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as:
"HAB authentication is based on public key cryptography using the RSA algorithm in ...
- 123
2
votes
3
answers
318
views
How much of the system is secure boot going to cover?
Background: We're developing for a Debian 9.8 system on an x86, but most of us here are more used to dealing with embedded devices.
according to wikipedia, secure boot can "secure the boot process ...
- 21
1
vote
2
answers
471
views
Secure Boot - Verifying applications
I have been reading up on Secure Boot, in particular what it actually checks during the boot process.
According to Microsoft the Secure Boot process works as follows:
Firmware Boot Components: The ...
- 135
2
votes
1
answer
248
views
Secure Boot - Usage of blacklist DB
I have been reading up on the details of Secure Boot, in particular the authorized and forbidden databases:
Before enabling UEFI Secure Boot (by setting the PK) the white and black lists DB & ...
- 135
1
vote
0
answers
227
views
Secure way to sign virtualbox module for secure boot
I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
- 15.3k