Questions tagged [secure-boot]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
14
votes
6answers
6k views

What's stopping someone from copying my HDD/SSD?

Let's say I have to leave my computer unattended and turned off for a while with some strangers, is it possible for someone to clone my HDD and SSD data?
1
vote
2answers
97 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
1
vote
0answers
66 views

SecureBoot: PCR to use or not

Context I'm working on the hardening of a Debian Bullseye box. At the moment, every works perfectly: SecureBoot enabled, "Admin" password for BIOS set, every partitions except EFI one are ...
1
vote
0answers
48 views

Security implications of automatic signing of kernel modules on Debian/Ubuntu (like VirtualBox does)

In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (...
1
vote
0answers
32 views

Restricting what hard drive can be used with a given machine

I have a machine running CentOS 7 with a removable hard drive. I want to restrict what hard drive can be used with the machine i.e. the machine can only be used with one disk and nothing else. I've ...
0
votes
0answers
32 views

Does the TPM check the addition/removal of boot-entries

I have an issue that has been puzzling me tegarding the TPM checks on my machine, and I cannot find much documentation about the checks a TPM exactly performs. The issue is the following; I have a ...
2
votes
2answers
577 views

Is factory reset enough to remove malware from laptop?

I have an ASUS laptop with Windows 10 that I want to factory reset. I used it for many years and did some torrenting with it in the past, so I wouldn't be surprised if something went wrong when it ...
1
vote
0answers
47 views

PKI Usage in Trusted Boot

I am trying to understand how PKI is used to boot an ARM board. The following image relates to BL1: The booting steps state: Also from: The certificate used in step 1 appears to be a content ...
1
vote
0answers
101 views

Does (UEFI) secure boot provide security advantages over TPM measured boot?

Given how UEFI secure boot appears later than TPM, i had assumption that it provides advantages over TPM. As i read into each, it appears to me that the TPM measurements to each stage would provide ...
0
votes
1answer
81 views

What are the threats addressed by a Hardware Root-of-Trust?

SoC's have begun integrating a hardware Root-of-Trust to mitigate attacks on Secure Boot. Examples include Google's OpenTitan & Intel PFR. What are the threats addressed by discrete "Secure ...
2
votes
1answer
175 views

Understanding Secure Boot

I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around. At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
0
votes
1answer
281 views

What kind of “actions” can a TPM2 policy authorize?

I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service ...
1
vote
2answers
84 views

How do we know that input to TPMs actually comes from the measured code?

Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it. What stops an attacker from doing this: Start a legitimate copy of the client ...
6
votes
2answers
605 views

Is it possible to make a laptop useless to thieves?

I was robbed... That included my Linux notebook and my company's notebook. Both are encrypted. Mine is encrypted with LVM over LUKS, using a passphrase to unlock the hard drive once the kernel has ...
2
votes
0answers
68 views

“Trusted memory” What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?
0
votes
0answers
114 views

Bypassing Secure Boot in System on Chip

To bypass a secure boot for System on Chip (SoC), some attacks target the phase of copying the bootloader from where it is stored to the main memory. Instead, a malicious code will be copied to the ...
1
vote
1answer
255 views

Integrity Check on power on VS. Secure boot

Can we consider the Integrity Check on power-on and the secure boot equal from security point of view? Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
0
votes
1answer
103 views

Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?

We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary. We're in the process of ...
1
vote
1answer
717 views

Why authenticated boot not Secure boot?

Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
1
vote
0answers
36 views

High Availability Boot processes and only using code-signing certificates

High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as: "HAB authentication is based on public key cryptography using the RSA algorithm in ...
2
votes
3answers
233 views

How much of the system is secure boot going to cover?

Background: We're developing for a Debian 9.8 system on an x86, but most of us here are more used to dealing with embedded devices. according to wikipedia, secure boot can "secure the boot process ...
1
vote
2answers
361 views

Secure Boot - Verifying applications

I have been reading up on Secure Boot, in particular what it actually checks during the boot process. According to Microsoft the Secure Boot process works as follows: Firmware Boot Components: The ...
2
votes
1answer
147 views

Secure Boot - Usage of blacklist DB

I have been reading up on the details of Secure Boot, in particular the authorized and forbidden databases: Before enabling UEFI Secure Boot (by setting the PK) the white and black lists DB & ...
1
vote
0answers
143 views

Secure way to sign virtualbox module for secure boot

I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...