9 votes

What's stopping someone from copying my HDD/SSD?

Physical access is usually a huge security issue, depending also on your threat model or, in other words, what the attacker is willing to do with your machine. Full disk encryption is a great security ...
  • 15.4k
5 votes

Is it possible to make a laptop useless to thieves?

First of all, my condolences for your loss! Hope you're alright. If I understood correctly, your general concern is how to totally prevent further stolen device usage (and/or sale) by a criminal. In ...
  • 3,395
4 votes

What's stopping someone from copying my HDD/SSD?

Time. Yes, someone could clone your entire hard drive, but this usually takes a long time. An attacker would have to open your computer's case, remove the drive, plug it into a dock, clone its ...
  • 239
3 votes
Accepted

Secure boot after an OTA update confusion

You are mixing secure boot with trusted boot. Secure boot can be achieved without trusted boot. Initially, secure boot verifies the digital signature of firmware and then passes the control to trusted ...
  • 723
3 votes

What's stopping someone from copying my HDD/SSD?

Physical Security An often overlooked part of Information Security. Lock the PC down by disabling external ports (USB, Serial, etc), and physically secure the PC so they cant take it or open it. ...
3 votes

What's stopping someone from copying my HDD/SSD?

Yes, it is possible to clone drives using some external connector (SSD/HDD usb connectors/Tableau Hardware) and software (osf/winhex). Cloning can be done in both states. It takes 30 - 40 min depends ...
  • 31
3 votes

Is factory reset enough to remove malware from laptop?

If you have a TPM, you can enable secure boot and proceed the factory reset. This way should assert than the restored OS is healthy as it is signed by ASUS. Then you will be able to disable secure ...
  • 1,316
3 votes
Accepted

Understanding Secure Boot

However, what ensures that CPU really starts booting the system from the correct ROM? Usually ROM are sorted onto motherboard. Since information once written to ROM can not be electronically altered, ...
2 votes
Accepted

Integrity Check on power on VS. Secure boot

The advantage of Secure Boot vs your Integrity check is that Secure Boot allows updating. Secure boot verifies the bootloader's signature, so the bootloader can be updated without changing the the ...
2 votes
Accepted

How do we know that input to TPMs actually comes from the measured code?

You don't. A TPM only protects against “mild” physical attacks. For example, it does protect against plugging in an alternate hard disk and booting from that. If the disk is encrypted with a key in ...
2 votes

Secure boot for devices which don't have hardware security element

Yes you can. You can use eFuse to store public key of the root certificate. This becomes root of trust. eFuses can be written only once and once eFuses are blown by writing bits into the eFuse array, ...
  • 6,266
2 votes

Can TPM2 disk encryption protect data after full server theft?

TPM2 should be seen as a security device (smarcard or key) that physically resides on the machine. If the full server is theft, the result is the same as if the attacker could steal both the disk and ...
1 vote

How do you boot from the network using https?

You still need a bootloader which can download something from HTTPs. Your question doesn't imply that and that's a huge issue. Most EFI ROMs I've ever dealt with can only boot from local storage ...
1 vote

Is it possible to allow only a certain secure USB boot media to boot an UEFI system?

It depends. Your firmware may allow you to enroll certain signing keys for secure boot, and you could sign your existing OS plus the bootable material on the flash drive, and nothing else. However, ...
  • 7,873
1 vote

TPM Endorsement Key usage in secure and trusted boot

TPM is generally used for two purposes: prove the system is in a trusted state and the secure storage of keys. For the first purpose, it is necessary to prove the software/firmware is talking to the ...
  • 3,852
1 vote

Can TPM2 disk encryption protect data after full server theft?

Using a a full disk encryption that incorporated a TPM protected the boot process form changes. As we are talking about a server unattended boot can be expected to be a requirement, hence TPM has been ...
  • 1,383
1 vote

Booting from removeable media, evil maid, and others?

You have it a bit backwards. The evil maid attack is when the evil maid brings in bootable removable media and boots your system on it and then accesses your filesystem bypassing all privilege checks. ...
  • 1,237
1 vote

What kind of "actions" can a TPM2 policy authorize?

TL;DR: you can prevent booting directly. However, not the TPM stops the boot process, but the last trusted component in your chain of trust (e.g. your bootloader). A TPM is passive, i.e. it receives ...
  • 491
1 vote

Is it possible to make a laptop useless to thieves?

Sorry to hear about that. Hope your backups were up to date. There are several things to ponder here before going this route. First one is the discussion about if you really want to brick it as ...
  • 17.6k
1 vote
Accepted

Why authenticated boot not Secure boot?

What are the reasons that would encourage deploying authenticated boot in the system rather than secure boot? Because the device owner owns the device, and often owners are developers. See also: ...
1 vote
Accepted

Secure Boot - Verifying applications

UEFI firmware launches the Windows bootloader when it has been correctly verified (it's been signed by one of the entities your firmware trusts). Once on the Win bootstrap, there is a module that ...
  • 365
1 vote
Accepted

Secure Boot - Usage of blacklist DB

I believe that it is designed this way to circumvent technological limitations. Remember that the BIOS is written in a low-level programming language (Assembly or C), which are not object-oriented ...
  • 1,726

Only top scored, non community-wiki answers of a minimum length are eligible