9 votes

What's stopping someone from copying my HDD/SSD?

Physical access is usually a huge security issue, depending also on your threat model or, in other words, what the attacker is willing to do with your machine. Full disk encryption is a great security ...
reed's user avatar
  • 15.8k
5 votes

Is it possible to make a laptop useless to thieves?

First of all, my condolences for your loss! Hope you're alright. If I understood correctly, your general concern is how to totally prevent further stolen device usage (and/or sale) by a criminal. In ...
ximaera's user avatar
  • 3,466
4 votes

What's stopping someone from copying my HDD/SSD?

Time. Yes, someone could clone your entire hard drive, but this usually takes a long time. An attacker would have to open your computer's case, remove the drive, plug it into a dock, clone its ...
rosuav's user avatar
  • 239
3 votes
Accepted

Secure boot after an OTA update confusion

You are mixing secure boot with trusted boot. Secure boot can be achieved without trusted boot. Initially, secure boot verifies the digital signature of firmware and then passes the control to trusted ...
saurabh's user avatar
  • 797
3 votes

What's stopping someone from copying my HDD/SSD?

Physical Security An often overlooked part of Information Security. Lock the PC down by disabling external ports (USB, Serial, etc), and physically secure the PC so they cant take it or open it. ...
us_system_integrator's user avatar
3 votes

What's stopping someone from copying my HDD/SSD?

Yes, it is possible to clone drives using some external connector (SSD/HDD usb connectors/Tableau Hardware) and software (osf/winhex). Cloning can be done in both states. It takes 30 - 40 min depends ...
Test's user avatar
  • 31
3 votes

Is factory reset enough to remove malware from laptop?

If you have a TPM, you can enable secure boot and proceed the factory reset. This way should assert than the restored OS is healthy as it is signed by ASUS. Then you will be able to disable secure ...
Sibwara's user avatar
  • 1,338
3 votes
Accepted

Understanding Secure Boot

However, what ensures that CPU really starts booting the system from the correct ROM? Usually ROM are sorted onto motherboard. Since information once written to ROM can not be electronically altered, ...
Arpit Rohela's user avatar
3 votes
Accepted

What does Secure Boot protect against?

So I don't see what Secure Boot adds here on top of protecting firmware, bootloader settings and root account. Could you please give an example of an attack that is countered by Secure Boot? So, ...
CBHacking's user avatar
  • 47.5k
2 votes

Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode?

I think you are mixing up concepts. Encryption is to hide something and since you publish the source code anyway there is no reason to hide it. But you tagged "secure boot" and this is more what you ...
Steffen Ullrich's user avatar
2 votes

What kind of "actions" can a TPM2 policy authorize?

TL;DR: you can prevent booting directly. However, not the TPM stops the boot process, but the last trusted component in your chain of trust (e.g. your bootloader). A TPM is passive, i.e. it receives ...
MemAllox's user avatar
  • 581
2 votes
Accepted

How do we know that input to TPMs actually comes from the measured code?

You don't. A TPM only protects against “mild” physical attacks. For example, it does protect against plugging in an alternate hard disk and booting from that. If the disk is encrypted with a key in ...
Gilles 'SO- stop being evil''s user avatar
2 votes

Secure boot for devices which don't have hardware security element

Yes you can. You can use eFuse to store public key of the root certificate. This becomes root of trust. eFuses can be written only once and once eFuses are blown by writing bits into the eFuse array, ...
defalt's user avatar
  • 6,841
2 votes
Accepted

Integrity Check on power on VS. Secure boot

The advantage of Secure Boot vs your Integrity check is that Secure Boot allows updating. Secure boot verifies the bootloader's signature, so the bootloader can be updated without changing the the ...
Douglas Leeder's user avatar
2 votes

Can TPM2 disk encryption protect data after full server theft?

TPM2 should be seen as a security device (smarcard or key) that physically resides on the machine. If the full server is theft, the result is the same as if the attacker could steal both the disk and ...
Serge Ballesta's user avatar
2 votes

fTPM more secure than TPM when using Bitlocker?

There is now an attack called faulTPM which makes it possible to get the key of the fTPM. Based on the attack strategy you can even bruteforce the PIN with 1000 PINs per second an GPU white efficient. ...
Hannes's user avatar
  • 121
2 votes
Accepted

Can I store an openssl generated public key on a TPM (2.0) device?

This doesn't sound like something you'd do with regular TPM key objects. However, TPMs do have a small amount of general-purpose NVRAM, which you can access by allocating an "NV index" (e.g. ...
grawity's user avatar
  • 1,696
2 votes
Accepted

Can BIOS/UEFI malware pretend that secure boot is enabled?

Yes it's possible for malware to pretend that Secure Boot is enabled if the malware is able to modify the firmware settings to indicate that Secure Boot is active. This would usually happen by ...
127 001's user avatar
  • 56
2 votes

Do I need Secure Boot on an Embedded Device?

If a rate the risk I would say, the firmware can be manipulated when the device has already been broken into, so no additional security by adding secure boot. My question: What is the risk of not ...
foreverska's user avatar
  • 2,037
2 votes

Laptop Repair vs. Evil Maid

When you think about security you must always think about what kind of threat you are trying to protect against. What works against a script kiddie on the internet might not work against a more ...
Anders's user avatar
  • 65.6k
1 vote

Can BIOS/UEFI malware pretend that secure boot is enabled?

As the title says, can BIOS/UEFI malware pretend that secure boot is enabled? There has been research showing methods to bypass operational SecureBoot and install rootkits in loaded OSes on certain ...
foreverska's user avatar
  • 2,037
1 vote
Accepted

Full disk encryption: Legacy boot mode (MBR) vs. EFI boot mode

Both MBR and GPT disks (generally used for BIOS/CSM and UEFI, respectively) require one region that is not encrypted. The system-verification/key-unwrapping/decryption code has to live somewhere that ...
CBHacking's user avatar
  • 47.5k
1 vote

Would secure boot block GPU if it has modified vbios?

No. Secure boot checks that the boot process hasn't been tampered with, but it neither knows nor cares about any firmware except that in the motherboard (the UEFI / "BIOS"). There aren't ...
CBHacking's user avatar
  • 47.5k
1 vote

Seabios and secure boot. Coreboot payload

It's definitely the case that SeaBIOS doesn't support Secure Boot because Secure Boot is specifically defined in the UEFI specification and a BIOS-based implementation without UEFI won't support it. ...
bk2204's user avatar
  • 9,349
1 vote

How do you boot from the network using https?

You still need a bootloader which can download something from HTTPs. Your question doesn't imply that and that's a huge issue. Most EFI ROMs I've ever dealt with can only boot from local storage ...
Artem S. Tashkinov's user avatar
1 vote

Is it possible to allow only a certain secure USB boot media to boot an UEFI system?

It depends. Your firmware may allow you to enroll certain signing keys for secure boot, and you could sign your existing OS plus the bootable material on the flash drive, and nothing else. However, ...
bk2204's user avatar
  • 9,349
1 vote

TPM Endorsement Key usage in secure and trusted boot

TPM is generally used for two purposes: prove the system is in a trusted state and the secure storage of keys. For the first purpose, it is necessary to prove the software/firmware is talking to the ...
billc.cn's user avatar
  • 3,936
1 vote

Can TPM2 disk encryption protect data after full server theft?

Using a a full disk encryption that incorporated a TPM protected the boot process form changes. As we are talking about a server unattended boot can be expected to be a requirement, hence TPM has been ...
Robert's user avatar
  • 1,441
1 vote

Booting from removeable media, evil maid, and others?

You have it a bit backwards. The evil maid attack is when the evil maid brings in bootable removable media and boots your system on it and then accesses your filesystem bypassing all privilege checks. ...
user10489's user avatar
  • 1,975

Only top scored, non community-wiki answers of a minimum length are eligible