Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safeboot: Booting Linux Safely

safeboot.dev

Post reply on HN
Print view View original

31–40 of 61 posts

Re: Safeboot: Booting Linux Safely

#31

Post by jaclaz »

Avamander wrote: post #26
jaclaz wrote: post #24

Earlier quoted context omitted.

Hmmm. This implies that you have set your boot order to CD-ROM first, so anyone can - say - boot their own system on your machine from CD and either access your data or make a dd-copy of your disk and look at it later. You need also to password protect your BIOS so that first device in boot order is hard disk and settings cannot be changed (without BIOS password). Depending on the BIOS this change in booting order co…

> You need also to password protect your BIOS so that first device in boot order is hard disk and settings cannot be changed (without BIOS password). You also have to make sure your BIOS can't be reset by removing the battery, doesn't have some administrative bypass or even a reset jumper. I've even seen a BIOS that reset to default boot settings when you remove all disks - and then gleefully boots from any attached…

Yes, and additionally we will also need a machanically safe case, as - even if the boot order is set to hard disk, it is not modifiable (without password) and the BIOS resists removing power and battery, noone would prevent you to detach the hard disk and either replace it with your own or more simply steal the hard disk and have a look at its data without hurries.

Security is tough.

Re: Safeboot: Booting Linux Safely

#32

Post by jstanley »

dathinab wrote: post #14

Slightly unrelated: I currently have a custom platform key, packet everything I need for booting into a single image (signed with the custom platform key) and everything else is in a fully encrypted partition (lvm2 on dmcrypt). "Decryption key" is inserted via keyboard on boot, which is not to everyone's liking but is what I want. It's not really hard to setup (on arch Linux) and works like a charm. ;-) Through the d…

What's your defence against an attacker with a few hours of physical access meddling with whatever comes before you typing the decryption key, such that you're actually typing your key into a program controlled by them, which then decrypts your filesystem image, inserts its own malicious code into some irrelevant kernel module, then boots the system as normal?

Re: Safeboot: Booting Linux Safely

#33

Post by rmrfstar »

tenebrisalietum wrote: post #22

So what about this: - Copy GRUB, bootlines for your system, your kernel and initrd to a WORM media like a bootable CD-ROM. - Boot using CD-ROM. - When boot completes, remove the CD-ROM. Now you can't attack my boot kernel or boot process because I've just physically separated it from the system and taken it with me. Even if it was there, the media is read only so you can't modify it. If I need to upgrade, I need to b…

This actually sounds like good actionable advice for a semi-technical person like a journalist.

Still leaves you vulnerable to bios compromise (e.g. get some malware running in SMM before your kernel), but that can be addressed by soldering the bios WP pin low and dropping some epoxy over the laptop case screws.

Edit: There are some SPI chips that have a write protect fuse that you can blow, leaving your bios in a known-good state. [1] pdf page 7.

[1] https://cloud.3mdeb.com/index.php/s/PBfAzZZQYcj3xbs

Re: Safeboot: Booting Linux Safely

#35

Post by xondono »

jaclaz wrote: post #24
tenebrisalietum wrote: post #22

So what about this: - Copy GRUB, bootlines for your system, your kernel and initrd to a WORM media like a bootable CD-ROM. - Boot using CD-ROM. - When boot completes, remove the CD-ROM. Now you can't attack my boot kernel or boot process because I've just physically separated it from the system and taken it with me. Even if it was there, the media is read only so you can't modify it. If I need to upgrade, I need to b…

Hmmm. This implies that you have set your boot order to CD-ROM first, so anyone can - say - boot their own system on your machine from CD and either access your data or make a dd-copy of your disk and look at it later. You need also to password protect your BIOS so that first device in boot order is hard disk and settings cannot be changed (without BIOS password). Depending on the BIOS this change in booting order co…

I’m guessing this setup makes sense with encrypted disk, that way, since decryption keys are on the CD, you can’t access the files without it.

Re: Safeboot: Booting Linux Safely

#36

Post by als0 »

greendave wrote: post #4

> fTPM tampering is out of scope since the ME is the root of all trust in the system I'm wondering about this assumption. Hasn't the ME previously been shown to be fairly straightforward to exploit?

As long as there is choice (e.g. between fTPM and dTPM) then it's up to the eye of the beholder to pick appropriately. An fTPM is better than nothing, but discrete TPMs have certifications.

Re: Safeboot: Booting Linux Safely

#37

Post by als0 »

temptemptemp111 wrote: post #2

If every Linux user would boycott AMD to release their source, then we could have libreboot: https://libreboot.org/amd-libre.html ME vs PSP isn't much of a choice. Of course POWER might be an option eventually, but isn't for most of us currently.

POWER has Ultravisor.

Re: Safeboot: Booting Linux Safely

#38

Post by als0 »

yjftsjthsd-h wrote: post #25
exrook wrote: post #11

Earlier quoted context omitted.

Well there is POWER[0], not that it's a very affordable choice, the cheapest motherboard + cpu costing $1,732.07 [0] https://www.raptorcs.com/content/BK1B01/intro.html

Is ARM an option? I know in practice many ARM systems rely on blobs, but it's not clear to me that that's universal.

There are ARM systems that don't need blobs. Whether they are useful to you is a different question. An example is the iMX line from NXP.

Re: Safeboot: Booting Linux Safely

#39

Post by CameronNemo »

q92z8oeif wrote: post #29
yjftsjthsd-h wrote: post #25

Earlier quoted context omitted.

Is ARM an option? I know in practice many ARM systems rely on blobs, but it's not clear to me that that's universal.

There is nothing like "ARM" in the market. There is CPU/SoC X by Y, built on top of a license from ARM. So you would have to boycott N companies instead of just AMD & Intel :( And even more so, since all their customers are EOM that are happy to sign NDAs.

Decent blob scarce arm option: https://libre.computer/

Re: Safeboot: Booting Linux Safely

#40

Post by CharlesW »

balnaphone wrote: post #28

I really like the philosophical approach here, even if it's too finicky to put in practice today. I'm really sick of everything being made "secure", when in fact the "security" is for someone other than the legitimate user of the thing. Phones, laptops, physical security systems, cars, the list goes on. There was a post here yesterday ( https://news.ycombinator.com/item?id=23149771 ) about the (in)security of Linux,…

> I'm really sick of everything being made "secure", when in fact the "security" is for someone other than the legitimate user of the thing.

It's less binary than that for me. Yes, the same technologies that keep my data secure also act as a buttress against jailbreaking. But people who want to jailbreak can simply choose less-secure devices, while I would personally not trade that security for greater hackability. There are other, lower-risk devices than phones and cars that I can use for that.

Post reply on HN