3 ms·

> but in the sense of ChromeOS devices? You can fairly easily flash a custom ROM onto a ChromeOS device and remove the boot-up warning. It does require taking

by cyphar 9y ago

> but in the sense of ChromeOS devices? You can fairly easily flash a custom ROM onto a ChromeOS device and remove the boot-up warning. It does require taking apart the device quite significantly, and then flashing different u-boot firmware using a firmware flasher. But it's definitely possible. The problem with ChromeOS devices' "secure boot" is that it is disabled if you want to boot something not trusted in the firmware, so if you have a custom OS you have to disable one of the main security features of the device (unless you flash different firmware onto the device). Oh, and Android already has this feature. But as with ChromeOS you can disable the warning if you re-lock the bootloader. However, each time you unlock (or relock in the case of Pixel devices) the bootloader, the device will be reset to factory defaults.

derefr 9y ago
> Oh, and Android already has this feature. But as with ChromeOS you can disable the warning if you re-lock the bootloader. Ah, I was basically imagining that there was some separate "bootloader" stage sitting on a chip that can't be user-flashed (and is hopefully even fully WORM, like old school OTP-NVM PROMs) which would handle the secure-boot logic. So I guess I should rephrase my hypothetical technology as "like Secure Boot in x64-platform PCs—where the CPU checks the BIOS signature and then the BIOS checks the boot loader signature and then the boot loader checks the OS signature—and where the CPU and BIOS can't be tampered with after the factory, thus guaranteeing the sanctity of the bootloader—but where a failure of the boot loader to verify the OS just results in a click-through boot warning."
- kogepathic 9y ago
  What you are describing is Intel BootGuard. [1] There is a signature burned into efuses in the CPU that is used as a root of trust for the BIOS, which implements SecureBoot. In theory this protects the boot chain from tampering. In practice vendor BIOS implementations are usually buggy garbage, so while you cannot replace the BIOS (because then the signature would fail and the platform won't boot) it may be possible to circumvent the security features by exploiting some bug in the IBV code or in their UEFI implementation. [1] https://patrick.georgi.family/2015/02/17/intel-boot-guard/ https://patrick.georgi.family/2015/02/17/intel-boot-guard/

by cyphar 9y ago

derefr 9y ago

> Oh, and Android already has this feature. But as with ChromeOS you can disable the warning if you re-lock the bootloader. Ah, I was basically imagining that there was some separate "bootloader" stage sitting on a chip that can't be user-flashed (and is hopefully even fully WORM, like old school OTP-NVM PROMs) which would handle the secure-boot logic. So I guess I should rephrase my hypothetical technology as "like Secure Boot in x64-platform PCs—where the CPU checks the BIOS signature and then the BIOS checks the boot loader signature and then the boot loader checks the OS signature—and where the CPU and BIOS can't be tampered with after the factory, thus guaranteeing the sanctity of the bootloader—but where a failure of the boot loader to verify the OS just results in a click-through boot warning."

kogepathic 9y ago
What you are describing is Intel BootGuard. [1] There is a signature burned into efuses in the CPU that is used as a root of trust for the BIOS, which implements SecureBoot. In theory this protects the boot chain from tampering. In practice vendor BIOS implementations are usually buggy garbage, so while you cannot replace the BIOS (because then the signature would fail and the platform won't boot) it may be possible to circumvent the security features by exploiting some bug in the IBV code or in their UEFI implementation. [1] https://patrick.georgi.family/2015/02/17/intel-boot-guard/ https://patrick.georgi.family/2015/02/17/intel-boot-guard/