Questions tagged [secure-boot]
The secure-boot tag has no usage guidance.
28
questions
0
votes
0answers
59 views
Does secure boot protect you from infected BIOS/firmware?
About secure boot, I've visited intel's website and they said:
The feature defines an entirely new interface between operating system and firmware/BIOS. When enabled and fully configured, Secure Boot ...
-1
votes
1answer
87 views
Booting from removeable media, evil maid, and others? [closed]
I am having a problem understanding some security techniques and was hoping someone could clarify some things. For instance, in terms of an evil maid attack, what are some solutions to preventing ...
0
votes
0answers
70 views
Can an OS implement Trusted Boot without TPM given Secure Boot?
Since Secure Boot authenticates software, the OS only needs to check hardware. The implementation I have in mind measures hardware and compares the result of the measurement to the value in an EFI ...
2
votes
0answers
84 views
How to prevent grub.cfg from breaking the chain of trust?
First some definitions and common understanding.
The premise of secure boot is that each binary get's verified before
it is loaded. This starts with the firmware in ROM verifying the EFI
application.
...
0
votes
1answer
149 views
Can I store an openssl generated public key on a TPM (2.0) device?
I've got an Infineon SLB9670 TPM module connected to a BeagleBone Board. I would like to carry out RSA signature verification on the board by using the TPM as a key store (storing the public key). W.r....
14
votes
6answers
6k views
What's stopping someone from copying my HDD/SSD?
Let's say I have to leave my computer unattended and turned off for a while with some strangers, is it possible for someone to clone my HDD and SSD data?
2
votes
2answers
173 views
Secure boot for devices which don't have hardware security element
I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/..
So for ...
0
votes
0answers
131 views
SecureBoot: PCR to use or not
Context
I'm working on the hardening of a Debian Bullseye box.
At the moment, every works perfectly: SecureBoot enabled, "Admin" password for BIOS set, every partitions except EFI one are ...
1
vote
0answers
94 views
Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)
In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
1
vote
0answers
60 views
Restricting what hard drive can be used with a given machine
I have a machine running CentOS 7 with a removable hard drive. I want to restrict what hard drive can be used with the machine i.e. the machine can only be used with one disk and nothing else.
I've ...
1
vote
2answers
762 views
Is factory reset enough to remove malware from laptop?
I have an ASUS laptop with Windows 10 that I want to factory reset. I used it for many years and did some torrenting with it in the past, so I wouldn't be surprised if something went wrong when it ...
1
vote
0answers
77 views
PKI Usage in Trusted Boot
I am trying to understand how PKI is used to boot an ARM board.
The following image relates to BL1:
The booting steps state:
Also from:
The certificate used in step 1 appears to be a content ...
1
vote
0answers
142 views
Does (UEFI) secure boot provide security advantages over TPM measured boot?
Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM.
As i read into each, it appears to me that the TPM measurements to each stage would provide ...
0
votes
1answer
107 views
What are the threats addressed by a Hardware Root-of-Trust?
SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
2
votes
1answer
278 views
Understanding Secure Boot
I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around.
At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
0
votes
1answer
430 views
What kind of "actions" can a TPM2 policy authorize?
I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
1
vote
2answers
150 views
How do we know that input to TPMs actually comes from the measured code?
Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it.
What stops an attacker from doing this:
Start a legitimate copy of the client ...
6
votes
2answers
828 views
Is it possible to make a laptop useless to thieves?
I was robbed...
That included my Linux notebook and my company's notebook. Both are encrypted.
Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has ...
2
votes
0answers
110 views
"Trusted memory" What does it mean?
It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
0
votes
0answers
159 views
Bypassing Secure Boot in System on Chip
To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
1
vote
1answer
406 views
Integrity Check on power on VS. Secure boot
Can we consider the Integrity Check on power-on and the secure boot equal from security point of view?
Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
0
votes
1answer
141 views
Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?
We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary.
We're in the process of ...
1
vote
1answer
961 views
Why authenticated boot not Secure boot?
Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
1
vote
0answers
74 views
High Availability Boot processes and only using code-signing certificates
High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as:
"HAB authentication is based on public key cryptography using the RSA algorithm in ...
2
votes
3answers
276 views
How much of the system is secure boot going to cover?
Background: We're developing for a Debian 9.8 system on an x86, but most of us here are more used to dealing with embedded devices.
according to wikipedia, secure boot can "secure the boot process ...
1
vote
2answers
433 views
Secure Boot - Verifying applications
I have been reading up on Secure Boot, in particular what it actually checks during the boot process.
According to Microsoft the Secure Boot process works as follows:
Firmware Boot Components: The ...
2
votes
1answer
206 views
Secure Boot - Usage of blacklist DB
I have been reading up on the details of Secure Boot, in particular the authorized and forbidden databases:
Before enabling UEFI Secure Boot (by setting the PK) the white and black lists DB & ...
1
vote
0answers
199 views
Secure way to sign virtualbox module for secure boot
I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...