Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Boot is broken on 200 models from 5 big device makers

arstechnica.com

Post reply on HN
Print view View original

121–130 of 147 posts

Re: Secure Boot is broken on 200 models from 5 big device makers

#121

Post by akvadrako »

renonce wrote: post #117
snailmailman wrote: post #45

I’ve had so many issues with secure boot on my machines causing issues that if I ever saw a secure boot error message I would never think “oh I must have a rootkit” Instead I would assume, in order - my config broke it - OS update broke it - the bios doesn’t properly handle any case that isn’t “preinstalled OEM windows” I had a laptop that as far as I could tell, could only boot into windows’ default bootmgr.efi. I c…

I feel many security researchers like to overemphasize the importance of certain security practices (the most common one being "longer and random password with symbols and upper case letters") without considering its costs, trouble, and human's lazy nature. Forcing long passwords causes people to use repetitive or easy to remember words, enforcing Secure Boot doesn't work if it gets in the way of normal boots. Making…

Real security researchers know that requiring symbols and upper case letters actually reduces security. Those requirements are explicitly rejected by the latest NIST recommendations:

https://pages.nist.gov/800-63-3/sp800-63b.html

So I'm basically agreeing with you, that a lot of people "in security" are just cargo culting.

Re: Secure Boot is broken on 200 models from 5 big device makers

#122

Post by vbezhenar »

acdha wrote: post #22
drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

Also things around physical access: if you steal my laptop, FDE prevents you from getting my data immediately but if you install malware which takes over the boot process, you get that data as soon as I type in my password. If the process changes so the hardware only loads signed firmware, which only loads a signed boot loader, which only loads a signed kernel, etc. that avenue of attack is closed. It also makes it p…

> Also things around physical access: if you steal my laptop, FDE prevents you from getting my data immediately but if you install malware which takes over the boot process, you get that data as soon as I type in my password.

There's still simple vector of attack by installing hardware keylogger to the keyboard wires.

Re: Secure Boot is broken on 200 models from 5 big device makers

#123

Post by commercialnix »

plasticchris wrote: post #113
commercialnix wrote: post #61

Earlier quoted context omitted.

Not any less reasonable than expecting a mechanic to be competent and knowledgeable with brakes.

Exactly why I do my own brakes. And why I want to control my own keys.

> And why I want to control my own keys.

Such as the keys to one's own house.

Re: Secure Boot is broken on 200 models from 5 big device makers

#125

Post by amluto »

acdha wrote: post #22
drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

Also things around physical access: if you steal my laptop, FDE prevents you from getting my data immediately but if you install malware which takes over the boot process, you get that data as soon as I type in my password. If the process changes so the hardware only loads signed firmware, which only loads a signed boot loader, which only loads a signed kernel, etc. that avenue of attack is closed. It also makes it p…

Secure Boot with factory keys has never prevented this attack, by design. You can take a valid, signed OS image from your favorite vendor (Microsoft, Red Hat, whatever), write some userspace code for it that asks for a passphrase and looks exactly like the legitimate paraphrase prompt, and configure the boot order to boot to it. It will pass the Secure Boot checks because it is completely valid. Secure Boot, as configured by default, never had userspace verification as a design goal.

There are at least two solutions:

1. Deploy your own Secure Boot keys and protect them with a firmware password whatever mechanism your particular system has to lock down Secure Boot settings.

2. Use TPM-based security so that even knowing the passphrase doesn’t unlock FDE unless the PCRs are correct.

#1 is a bit of a pain. #2 is a huge pain because getting PCR rules right is somewhere between miserable and impossible, especially if you don’t want to accidentally lock yourself out when you update firmware or your OS image.

Of course, people break PCR-based security on a somewhat regular basis, so maybe you want #1 and #2.

Re: Secure Boot is broken on 200 models from 5 big device makers

#126

Post by amluto »

tripflag wrote: post #37
drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

The case you're outlining (an uefi rootkit) is pretty much the worst case; assuming you get infected by some malware which decides to install a malicious firmware (BIOS update), then pretty much nothing is getting in the way of that. What secureboot is designed to prevent is malicious changes to the OS bootloader (a conventional rootkit), which is usually shimx64.efi or grubx64.efi on linux/dualboot machines, or boot…

I think “UEFI rootkit” usually refers to a malicious .efi file installed in the ESP. An actual firmware rootkit, installed on the flash chip, can likely bypass Secure Boot entirely, and may well be able to bypass TPM protections as well.

Re: Secure Boot is broken on 200 models from 5 big device makers

#127

Post by sim7c00 »

drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

it protects against boot and early boot attacks. thia includes bootkits but also early drivers such as AV drivers and others which protect the system further. if you dont have it, any security can be compromised before its active. via different methods.

Re: Secure Boot is broken on 200 models from 5 big device makers

#128

Post by senectus1 »

EVa5I7bHFq9mnYK wrote: post #115

How do I check if my laptop is affected? Tried [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFIPK).bytes) -match "DO NOT TRUST|DO NOT SHIP" , gives me cryptic errors and gpt of no help.

in a powershell um.. shell: [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI PK).bytes) -match "DO NOT TRUST|DO NOT SHIP"

Re: Secure Boot is broken on 200 models from 5 big device makers

#129

Post by okanat »

PennRobotics wrote: post #106

> ... key players in security—among them Microsoft and the US National Security Agency ... This phrase does not sit well with me.

NSA doesn't want the government and critical businesses to get hacked, unless they are doing it themselves. That's why they support many security features in both proprietary and open source world.

However, in the US, they don't need to hack; they can just ask for data lawfully.

Re: Secure Boot is broken on 200 models from 5 big device makers

#130

Post by jeroenhd »

plasticchris wrote: post #113
commercialnix wrote: post #61

Earlier quoted context omitted.

Not any less reasonable than expecting a mechanic to be competent and knowledgeable with brakes.

Exactly why I do my own brakes. And why I want to control my own keys.

Luckily, you can ignore the factory keys and load your own. This issue affects the default configuration, from what I can tell loading in your own PK will override the built-in ones.
Post reply on HN