Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Boot is broken on 200 models from 5 big device makers

arstechnica.com

Post reply on HN
Print view View original

21–30 of 147 posts

Re: Secure Boot is broken on 200 models from 5 big device makers

#21

Post by kevin_thibedeau »

londons_explore wrote: post #15
jandrese wrote: post #13

I know never to trust software written by hardware folks, but seriously, how do you ship a key where the CN is literally "DO NOT TRUST -- AMI Test PK" as the root security. That is outright malicious incompetence.

Because nobody ever looked at the text of the certificate. It was probably a binary file checked into the source control system and, since it seemed to work, nobody ever looked at it. Probably came as part of the dev kit from AMI.

The only winning move is not to play. AMI should never have distributed test certs to begin with. Give your customers instructions on how to generate self-signed certificates (assuming they are accepted) or setup a dev CA that will sign test certificates. Then the damage from a key leak is limited to one vendor.

Re: Secure Boot is broken on 200 models from 5 big device makers

#22

Post by acdha »

drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

Also things around physical access: if you steal my laptop, FDE prevents you from getting my data immediately but if you install malware which takes over the boot process, you get that data as soon as I type in my password.

If the process changes so the hardware only loads signed firmware, which only loads a signed boot loader, which only loads a signed kernel, etc. that avenue of attack is closed. It also makes it possible to trust a used computer.

The problem is that other than Apple nobody has really been committed to doing it well - it’s begrudging lowest-bidder compliance and clearly not something many vendors are taking pride in.

Re: Secure Boot is broken on 200 models from 5 big device makers

#23

Post by out-of-ideas »

hex4def6 wrote: post #10
jmclnx wrote: post #4

>In 2012, an industry-wide coalition of hardware and software makers adopted Secure Boot to protect against a long-looming security threat This joke never gets stale, wait it is not a joke ? I still believe the only reason for this to exist is to eventually turn general computing devices into a locked down Cell Phone Spying Device.

This has been my theory since Windows 11 required TPM. It's not to protect the consumer, it's to protect the IP-holder. The PC is the lone outlier in the locked-down, walled-garden world of consoles, cell phones, tablets, smart TVs, EVs, etc. I think there's a concerted effort to change that.

fear and planned obsolescence; "all these old things are bad... never mind it's only a day old. throw it away already, and buy the new one. no discounts!"

Re: Secure Boot is broken on 200 models from 5 big device makers

#24

Post by Terr_ »

drhagen wrote: post #12
Terr_ wrote: post #7

Earlier quoted context omitted.

I'm having strange nostalgic flashbacks the '90s where I kept wondering why nobody offered a hard drive with a physical read-only toggle button. (Mounted to the front of the 5.25 inch bay in a tower chassis, as was the style of the time.) Obviously you need some read+write storage elsewhere on the same computer, but you could reliably freeze large chunks of stuff in a way that would be impervious to viruses or hacker…

I remember USB drives in the '00s that had a read-only toggle. They were useful for rescuing machines that had a virus. Edit: A quick search reveals that, of course, you can still buy them today. I have not felt a need for one in ages.

Hmmm, I would absolutely buy one of those if it also had a hardened case and a firm connection point for my real-world keychain. The use-case is a "my house burned down what next" backup, password-manager stuff and other details I might need before/without accessing any cloud-backup services.

I may need to read some of its files on a not-very trusted device, and I don't want to risk that device also tampering/trojan'ing other files, like backup copies of the software needed to decrypt the data files.

A simpler scenario might be a USB stick that I use for carrying files to be printed at the local library.

Re: Secure Boot is broken on 200 models from 5 big device makers

#26

Post by tedunangst »

jmclnx wrote: post #4

>In 2012, an industry-wide coalition of hardware and software makers adopted Secure Boot to protect against a long-looming security threat This joke never gets stale, wait it is not a joke ? I still believe the only reason for this to exist is to eventually turn general computing devices into a locked down Cell Phone Spying Device.

It's only a F12, tab, enter, down, tab, enter away to disable if you really don't like it that much.

Re: Secure Boot is broken on 200 models from 5 big device makers

#27

Post by [deleted] »

jmclnx wrote: post #4

>In 2012, an industry-wide coalition of hardware and software makers adopted Secure Boot to protect against a long-looming security threat This joke never gets stale, wait it is not a joke ? I still believe the only reason for this to exist is to eventually turn general computing devices into a locked down Cell Phone Spying Device.

[deleted]

Re: Secure Boot is broken on 200 models from 5 big device makers

#29

Post by tedunangst »

drhagen wrote: post #6

> To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks. Am I correct that Secure Boot purely exists to prevent this attack vector: malware gets root on the OS, hardware allows updating f…

How do you determine when to push the button?
Post reply on HN