Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Boot is broken on 200 models from 5 big device makers

arstechnica.com

Post reply on HN
Print view View original

11–20 of 147 posts

Re: Secure Boot is broken on 200 models from 5 big device makers

#11

Post by Terr_ »

It sounds like the biggest contributory problems here are:

1. Allowing unattended/automatic BIOS updates from a running OS at all

2. Being so paranoid about attacks by a spy with physical access to the computer that the keys cannot be replaced or revoked

I'm not a security researcher, but to just shoot the breeze a bit, imagine:

1. The OS can only enqueue data for a proposed BIOS update, actually applying it requires probable-human intervention. For example, reboot into the currently-trusted BIOS, and wait for the user to type some random text shown on the screen to confirm. That loop prevents auto-typing by a malicious USB stick pretending to be a keyboard, etc.

2. Allow physical access to change crypto keys etc, but instead focus on making it easy to audit and detect when it has happened. For example, if you are worried Russian agents will intercept a laptop being repaired and deep-rootkit it, press a motherboard button and record a values from a little LED display, values that are guaranteed to change if someone alters the key set and/or puts on a new signed BIOS. If you're worried, they'll simply replace the chipwork itself, then you'd need a way to issue a challenge and see a signed verifiable response.

Re: Secure Boot is broken on 200 models from 5 big device makers

#12

Post by drhagen »

Terr_ wrote: post #7
drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

I'm having strange nostalgic flashbacks the '90s where I kept wondering why nobody offered a hard drive with a physical read-only toggle button. (Mounted to the front of the 5.25 inch bay in a tower chassis, as was the style of the time.) Obviously you need some read+write storage elsewhere on the same computer, but you could reliably freeze large chunks of stuff in a way that would be impervious to viruses or hacker…

I remember USB drives in the '00s that had a read-only toggle. They were useful for rescuing machines that had a virus.

Edit: A quick search reveals that, of course, you can still buy them today. I have not felt a need for one in ages.

Re: Secure Boot is broken on 200 models from 5 big device makers

#14

Post by bitwize »

drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

Secure Boot is the first component in a verified boot chain from initial power-on to application level code. Signed, verified firmware boots signed, verified kernel with strict authenticity and integrity guarantees. The goal is, presumably, to attest to the authenticity and integrity of everything the system runs, but when it comes to kernel modules and device drivers, userland OS components, and applications, those are the kernel's responsibility. But Secure Boot is an essential link in this chain.

Re: Secure Boot is broken on 200 models from 5 big device makers

#15

Post by londons_explore »

jandrese wrote: post #13

I know never to trust software written by hardware folks, but seriously, how do you ship a key where the CN is literally "DO NOT TRUST -- AMI Test PK" as the root security. That is outright malicious incompetence.

Because nobody ever looked at the text of the certificate. It was probably a binary file checked into the source control system and, since it seemed to work, nobody ever looked at it.

Probably came as part of the dev kit from AMI.

Re: Secure Boot is broken on 200 models from 5 big device makers

#16

Post by stonogo »

hex4def6 wrote: post #10
jmclnx wrote: post #4

>In 2012, an industry-wide coalition of hardware and software makers adopted Secure Boot to protect against a long-looming security threat This joke never gets stale, wait it is not a joke ? I still believe the only reason for this to exist is to eventually turn general computing devices into a locked down Cell Phone Spying Device.

This has been my theory since Windows 11 required TPM. It's not to protect the consumer, it's to protect the IP-holder. The PC is the lone outlier in the locked-down, walled-garden world of consoles, cell phones, tablets, smart TVs, EVs, etc. I think there's a concerted effort to change that.

Indeed, I share this outlook, as do others: https://boingboing.net/2012/01/10/lockdown.html

Re: Secure Boot is broken on 200 models from 5 big device makers

#17

Post by bitwize »

jokoon wrote: post #8

Isn't that a vulnerability that still requires physical access to hardware? Or is that just a protection against rootkits? I still fail to understand what secure boot is protecting against: if a machine is compromised remotely, does secure boot prevents installing a rootkit that's invisible from virus scanners?

Secure Boot protects against booting a kernel image that's been tampered with. If the running kernel is vulnerable to root-level exploits, it can't help you, but it can prevent a malicious attacker from switching a trusted kernel for a malicious, modified copy.

Re: Secure Boot is broken on 200 models from 5 big device makers

#18

Post by jandrese »

hex4def6 wrote: post #10
jmclnx wrote: post #4

>In 2012, an industry-wide coalition of hardware and software makers adopted Secure Boot to protect against a long-looming security threat This joke never gets stale, wait it is not a joke ? I still believe the only reason for this to exist is to eventually turn general computing devices into a locked down Cell Phone Spying Device.

This has been my theory since Windows 11 required TPM. It's not to protect the consumer, it's to protect the IP-holder. The PC is the lone outlier in the locked-down, walled-garden world of consoles, cell phones, tablets, smart TVs, EVs, etc. I think there's a concerted effort to change that.

Absolutely. Look at all of the changes to the media stack Microsoft made for Vista and none of them are to directly benefit the person who bought the OS license. If you have ever wondered how a 486 could play MP3s and still run X but your modern laptop gets hot and spins the fan when you are playing those same MP3s it is because the media companies demanded it.

Re: Secure Boot is broken on 200 models from 5 big device makers

#19

Post by asveikau »

bitwize wrote: post #17
jokoon wrote: post #8

Isn't that a vulnerability that still requires physical access to hardware? Or is that just a protection against rootkits? I still fail to understand what secure boot is protecting against: if a machine is compromised remotely, does secure boot prevents installing a rootkit that's invisible from virus scanners?

Secure Boot protects against booting a kernel image that's been tampered with. If the running kernel is vulnerable to root-level exploits, it can't help you, but it can prevent a malicious attacker from switching a trusted kernel for a malicious, modified copy.

> it can prevent ... switching a trusted kernel for a malicious, modified copy.

Or a free OS.

Re: Secure Boot is broken on 200 models from 5 big device makers

#20

Post by Hizonner »

Terr_ wrote: post #11

It sounds like the biggest contributory problems here are: 1. Allowing unattended/automatic BIOS updates from a running OS at all 2. Being so paranoid about attacks by a spy with physical access to the computer that the keys cannot be replaced or revoked I'm not a security researcher, but to just shoot the breeze a bit, imagine: 1. The OS can only enqueue data for a proposed BIOS update, actually applying it requires…

Platform keys can be replaced given physical access to the computer. In fact they can generally be replaced by regular UEFI updates.

The problem here is in trusting, nay expecting, your average motherboard maker to either know anything about key management or give a shit about key management.

Post reply on HN