Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

binarly.io

Post reply on HN
Print view View original

131–140 of 142 posts

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#131

Post by JCattheATM »

fsflover wrote: post #130
JCattheATM wrote: post #127

Earlier quoted context omitted.

I guess I misunderstood your request. This[1] and this[2] should be what you are looking for. [1] https://doc.coreboot.org/security/vboot/index.html [2] https://github.com/tianocore/edk2

I found no installable code for Secure Boot itself in your links.

That wasn't what you asked for, and I've given you more than enough links for you to find your way to installing it if you wanted to play with it.

If you want something that will hold your hand a little more, then one of the downstream projects might be a better fit.

I'm satisfied I've backed up my points though.

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#132

Post by [deleted] »

fsflover wrote: post #130
JCattheATM wrote: post #127

Earlier quoted context omitted.

I guess I misunderstood your request. This[1] and this[2] should be what you are looking for. [1] https://doc.coreboot.org/security/vboot/index.html [2] https://github.com/tianocore/edk2

I found no installable code for Secure Boot itself in your links.

[deleted]

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#133

Post by fsflover »

JCattheATM wrote: post #131
fsflover wrote: post #130

Earlier quoted context omitted.

I found no installable code for Secure Boot itself in your links.

That wasn't what you asked for, and I've given you more than enough links for you to find your way to installing it if you wanted to play with it. If you want something that will hold your hand a little more, then one of the downstream projects might be a better fit. I'm satisfied I've backed up my points though.

>> I found no installable code for Secure Boot itself in your links.

> That wasn't what you asked for

Here's a quote from my earlier comment:

>> Can I compile coreboot with Secure Boot from source and reflash my UEFI/BIOS with it?

I don't see how I could formulate it better. You seem to evade the actual answer. I'll continue to think this is impossible.

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#134

Post by JCattheATM »

fsflover wrote: post #133
JCattheATM wrote: post #131

Earlier quoted context omitted.

That wasn't what you asked for, and I've given you more than enough links for you to find your way to installing it if you wanted to play with it. If you want something that will hold your hand a little more, then one of the downstream projects might be a better fit. I'm satisfied I've backed up my points though.

>> I found no installable code for Secure Boot itself in your links. > That wasn't what you asked for Here's a quote from my earlier comment: >> Can I compile coreboot with Secure Boot from source and reflash my UEFI/BIOS with it? I don't see how I could formulate it better. You seem to evade the actual answer. I'll continue to think this is impossible.

I'm not avoiding the answer, and I've answered your question more than adequately. It seems you want hand holding each step along the way. Are you perhaps unaware that the coreboot implementation is called verified boot rather than secure boot?

I've shown it's possible to flash hardware and have an entirely open source and auditable secure boot implementation which is better than your current solution in a number of ways. That was all I had a burden to prove, and I've met it.

If you want further help or convincing, I'd suggest interacting with an AI to get answers to your questions.

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#135

Post by JCattheATM »

adrian_b wrote: post #129
JCattheATM wrote: post #124

Earlier quoted context omitted.

> The setup that I have described has identical behavior, except that I use a removable USB memory That's a huge difference though! With my setup, if someone steals the device, they get a fully useable laptop with no password, locked down and restricted - they can join wifi networks, use the browser, download etc, but can't access the 'real' OS, and the laptop won't boot from anything other than the encrypted HDD it…

The open source feature of Secureboot is true only if you have replaced the laptop firmware with Coreboot, which is compatible only with few, mostly old, laptops. Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted, at least for the auxiliary CPUs of Intel and AMD (ME/PSP) and for the CPU of the TPM, i.e. for the parts that are the most important for security. If s…

> The open source feature of Secureboot is true only if you have replaced the laptop firmware with Coreboot, which is compatible only with few, mostly old, laptops.

Plenty of newer stuff that is explicitly open like the system 7 and framework stuff also.

> Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted,

As does any solution relying on a BIOS.

> If someone steals the device, I cannot see any difference between our 2 setups.

In my setup, if the laptop is stolen, the thief is able to use a limited OS that give them all the functionality they would need while running a locator service in the background, allowing the hardware to be recovered, while preventing access to encrypted data.

It doesn't sound like your setup allows for that.

> However in the case that relies on the internal firmware and TPM to protect the keys, there are more sophisticated hardware attacks against the motherboard,

No matter what, using a BIOS makes you a lot more vulnerable than using any form of secure boot. It's a significantly more vulnerable standard.

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#136

Post by fsflover »

pabs3 wrote: post #111

I wish the hardware industry went more in the direction of the State Considered Harmful paper: https://blog.invisiblethings.org/papers/2015/state_harmful.p... https://www.qubes-os.org/news/2017/07/08/toward-a-reasonably...

https://forum.qubes-os.org/t/why-does-qubes-os-not-get-more-...

https://forum.qubes-os.org/t/deployments-of-qubes-by-entitie...

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#137

Post by fsflover »

JCattheATM wrote: post #135
adrian_b wrote: post #129

Earlier quoted context omitted.

The open source feature of Secureboot is true only if you have replaced the laptop firmware with Coreboot, which is compatible only with few, mostly old, laptops. Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted, at least for the auxiliary CPUs of Intel and AMD (ME/PSP) and for the CPU of the TPM, i.e. for the parts that are the most important for security. If s…

> The open source feature of Secureboot is true only if you have replaced the laptop firmware with Coreboot, which is compatible only with few, mostly old, laptops. Plenty of newer stuff that is explicitly open like the system 7 and framework stuff also. > Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted, As does any solution relying on a BIOS. > If someone stea…

>> Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted,

> As does any solution relying on a BIOS

Not true: https://news.ycombinator.com/item?id=44241911

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#138

Post by JCattheATM »

fsflover wrote: post #137
JCattheATM wrote: post #135

Earlier quoted context omitted.

> The open source feature of Secureboot is true only if you have replaced the laptop firmware with Coreboot, which is compatible only with few, mostly old, laptops. Plenty of newer stuff that is explicitly open like the system 7 and framework stuff also. > Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted, As does any solution relying on a BIOS. > If someone stea…

>> Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted, > As does any solution relying on a BIOS Not true: https://news.ycombinator.com/item?id=44241911

lol, and you're back to indirectly referencing coreboot.

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#139

Post by fsflover »

JCattheATM wrote: post #138
fsflover wrote: post #137

Earlier quoted context omitted.

>> Even in that case, a laptop with Coreboot will still use closed-source components that cannot be trusted, > As does any solution relying on a BIOS Not true: https://news.ycombinator.com/item?id=44241911

lol, and you're back to indirectly referencing coreboot.

Yes, except the root of trust in my link is FLOSS.

Re: Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass

#140

Post by JCattheATM »

fsflover wrote: post #139
JCattheATM wrote: post #138

Earlier quoted context omitted.

lol, and you're back to indirectly referencing coreboot.

Yes, except the root of trust in my link is FLOSS.

So it is too with a FOSS secure boot implementation like verified boot.

Round and round we go....

Your setup is less secure. Period.

Post reply on HN