Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Boot is broken on 200 models from 5 big device makers

arstechnica.com

Post reply on HN
Print view View original

131–140 of 147 posts

Re: Secure Boot is broken on 200 models from 5 big device makers

#131

Post by OccamsMirror »

renonce wrote: post #117
snailmailman wrote: post #45

I’ve had so many issues with secure boot on my machines causing issues that if I ever saw a secure boot error message I would never think “oh I must have a rootkit” Instead I would assume, in order - my config broke it - OS update broke it - the bios doesn’t properly handle any case that isn’t “preinstalled OEM windows” I had a laptop that as far as I could tell, could only boot into windows’ default bootmgr.efi. I c…

I feel many security researchers like to overemphasize the importance of certain security practices (the most common one being "longer and random password with symbols and upper case letters") without considering its costs, trouble, and human's lazy nature. Forcing long passwords causes people to use repetitive or easy to remember words, enforcing Secure Boot doesn't work if it gets in the way of normal boots. Making…

The idea is to stop you getting rootkits that can never be removed. You want to feel safe knowing you can just wipe your computer and start again.

Re: Secure Boot is broken on 200 models from 5 big device makers

#132

Post by jeroenhd »

StillBored wrote: post #62

This big mistake though was back when all this was being enabled on PC's, the linux vendors out of fear that the rest of the industry would lock them out, standardized on shim and the MS certificates in the firmware. Thus requiring MS to sign the first stage of every linux install/boot rather than both doing that, as well as defaulting to an environment where the distros would boot in UEFI 'setup mode' enroll their o…

Arch has a pretty useful key enrollment tool that I'm sure exists on other distros too. Only command line, though. There's also tooling for enrolling a custom key database if your firmware doesn't accept the standard API by creating a bootable key management update tool with your preferred keys.

There's a guide for both approaches here: https://wiki.archlinux.org/title/Unified_Extensible_Firmware.... You'll need to make sure whatever distro you use has the right hooks to sign the boot images after each upgrade (i.e. an apt callback rather than a pacman callback) if you're not using Arch, of course.

Using the sbenroll tool, the process is three commands (generate keys, enroll keys, sign current bootloaders) plus whatever extra BIOS interfacing logic your computer needs on top of normal secure boot stuff like unlocking the BIOS through a password.

Re: Secure Boot is broken on 200 models from 5 big device makers

#133

Post by Anunayj »

snailmailman wrote: post #45

I’ve had so many issues with secure boot on my machines causing issues that if I ever saw a secure boot error message I would never think “oh I must have a rootkit” Instead I would assume, in order - my config broke it - OS update broke it - the bios doesn’t properly handle any case that isn’t “preinstalled OEM windows” I had a laptop that as far as I could tell, could only boot into windows’ default bootmgr.efi. I c…

Was this laptop in question from Hewlett Packard (HP)? Because I swear I've seen this exact behaviour on a HP laptop.

Re: Secure Boot is broken on 200 models from 5 big device makers

#134

Post by j16sdiz »

out-of-ideas wrote: post #87
acdha wrote: post #51

Earlier quoted context omitted.

> do folks in the business really simply steal a laptop and try to pull all data? or do they steal the laptop and wipe it and flip it... if they wanted your data wouldnt they steal you, the human, too ? Governments definitely worry about it, and I’d be shocked if e.g. banks didn’t also put it into requirements. Access can be temporary, too: imagine if you get 15 minute alone in someone’s office or they have a kiosk i…

i only chose those questions as to pick on the concept of "stealing a laptop" - its more the hypothecial use case where majority of users, given the "my laptop got stolen" will never see their system again. folks in the business of stealing a laptop will resell it if they can - a laptop in a random car in SF.. sounds real profitiable to try to decrypt some aes 2tb data for a cat pic); secure boot has not guarnteed a…

> a company with any kind of compliance should never let an untrusted person be alone ..

Trust could be misplaced.

Re: Secure Boot is broken on 200 models from 5 big device makers

#135

Post by robocat »

nightowl_games wrote: post #30

Seems apparent we need a Professional Engineering Certification process and our own disciplinary board similar to other engineering disciplines. High time.

To make that work in the US:

1: would need to onshore all work in the bootchain (software and hardware).

2: would put liability on inidividual engineers and take liabilty away from the corporate organisiation.

3: accountability requires that engineers have authority.

4: in a team environment accountability is going to be blamed on the weakest members

5: it would completely fuck any inidividual open source development.

If you want to come up with better ideas for accountability, then read up on the witchhunts that occur after deadly failures in other engineering disciplines, and check that your idea fixes the problems you see.

The world is far more interconnected now than when my grandad was a certified engineer.

Re: Secure Boot is broken on 200 models from 5 big device makers

#136

Post by robocat »

Hizonner wrote: post #34
nightowl_games wrote: post #30

Seems apparent we need a Professional Engineering Certification process and our own disciplinary board similar to other engineering disciplines. High time.

You could probably get away with just forbidding software license agreements that disclaim liability for any and every kind of negligent stupidity.

So forbid the GPL and BSD licenses?

Re: Secure Boot is broken on 200 models from 5 big device makers

#137

Post by raxxorraxor »

renonce wrote: post #117
snailmailman wrote: post #45

I’ve had so many issues with secure boot on my machines causing issues that if I ever saw a secure boot error message I would never think “oh I must have a rootkit” Instead I would assume, in order - my config broke it - OS update broke it - the bios doesn’t properly handle any case that isn’t “preinstalled OEM windows” I had a laptop that as far as I could tell, could only boot into windows’ default bootmgr.efi. I c…

I feel many security researchers like to overemphasize the importance of certain security practices (the most common one being "longer and random password with symbols and upper case letters") without considering its costs, trouble, and human's lazy nature. Forcing long passwords causes people to use repetitive or easy to remember words, enforcing Secure Boot doesn't work if it gets in the way of normal boots. Making…

For me it cannot be justified. A corporate environment might be different though.

Still, as a consumer I reject it for personal use because I believe boot malware is rare since other forms of attack have been vastly more effective and I also don't have an evil maid.

I just hope we don't get to a ridiculous situation where my shitty bank gets panic if I root my phone and wants to extend that behavior to PCs. "Trusted computing" is a failure in my opinion and "security" on mobile devices is an example where it significantly impacts the usefulness of the devices themselves. Of course this might be more driven by ambitions to lock down phones than real security, but still.

Secure boot might be useful for devices you administer remotely. But any secure boot validation doesn't mean anything to me, the system could be infected without secure boot noticing anything. It probably only gets in the way of OS installations.

Re: Secure Boot is broken on 200 models from 5 big device makers

#138

Post by patrakov »

amluto wrote: post #125
acdha wrote: post #22

Earlier quoted context omitted.

Also things around physical access: if you steal my laptop, FDE prevents you from getting my data immediately but if you install malware which takes over the boot process, you get that data as soon as I type in my password. If the process changes so the hardware only loads signed firmware, which only loads a signed boot loader, which only loads a signed kernel, etc. that avenue of attack is closed. It also makes it p…

Secure Boot with factory keys has never prevented this attack, by design. You can take a valid, signed OS image from your favorite vendor (Microsoft, Red Hat, whatever), write some userspace code for it that asks for a passphrase and looks exactly like the legitimate paraphrase prompt, and configure the boot order to boot to it. It will pass the Secure Boot checks because it is completely valid . Secure Boot, as conf…

#2 is also something that a security expert needs to audit, so that booting an extracted stock recovery ISO (which has the kernel signed by the same keys as the real system) does NOT unlock the FDE.

https://discussion.fedoraproject.org/t/issue-with-automatic-...

Re: Secure Boot is broken on 200 models from 5 big device makers

#139

Post by renegat0x0 »

UEFI comes with SB, Microsoft introduces TPM, Google introduces WEI. They will will say it is for your benefit, and in part it is correct, but security can be achieved through many measures, and corporations will choose such solutions that will grant them more ability to control your device.

This leads to accumulation of "power", and monopolization of it in systems leads to vulnerability. One point of failure is enough to compromise entire ecosystem.

Just reminds me that apple checked every application you run, for "safety reasons" (rather checks app certificates, but that is nearly the same).

Re: Secure Boot is broken on 200 models from 5 big device makers

#140

Post by amluto »

patrakov wrote: post #138
amluto wrote: post #125

Earlier quoted context omitted.

Secure Boot with factory keys has never prevented this attack, by design. You can take a valid, signed OS image from your favorite vendor (Microsoft, Red Hat, whatever), write some userspace code for it that asks for a passphrase and looks exactly like the legitimate paraphrase prompt, and configure the boot order to boot to it. It will pass the Secure Boot checks because it is completely valid . Secure Boot, as conf…

#2 is also something that a security expert needs to audit, so that booting an extracted stock recovery ISO (which has the kernel signed by the same keys as the real system) does NOT unlock the FDE. https://discussion.fedoraproject.org/t/issue-with-automatic-...

Right. But this gives a really nasty dilemma:

First, you need a recovery image to be rejected by the TPM rules.

Second, you need an updated image that you prepare yourself, or that the distro prepares, etc, that will respect your security goals (e.g. does not allow you to boot it and copy files off) to be accepted.

Maybe a mainstream distro could distribute a UKI that will unlock a disk and run that disk’s userspace with no safe mode, recovery mode, etc without a password, but I’ve never seen such a thing.

Post reply on HN