4 ms·

> We believe the T2 platform is a leap forward in platform security in the Apple ecosystem, and it begins to bring exciting security properties like Secure Boot

> We believe the T2 platform is a leap forward in platform security in the Apple ecosystem, and it begins to bring exciting security properties like Secure Boot capabilities to the mass market. So the vast PC-market with UEFI secure boot which predates this by 6 year was somehow not the “mass market”, but the relatively tiny MacBook market is? With factual errors like this present already in the introduction, it’s hard to take anything which follows it seriously. This just comes off like fanboy-fluff.

nneonneo 8y ago
Serious question - how well does UEFI secure boot protect against an attacker with a high degree of physical access to the machine? Online docs focus mostly on the software/firmware security but less on the hardware side. Is hardware security specified, or left up to individual vendors?
- josteink 8y ago
  > how well does UEFI secure boot protect against an attacker with a high degree of physical access to the machine? Everything is relative. When enabled, what Secure Boot ensures is that only boot media signed by a trusted a key (which unless user-replaced, typically are the vendor-provided key which trusts MS Windows and common Linux-distros) can be booted. This guarantees that the base OS and kernel booted by the machine can be trusted to not be tampered with by untrusted parties. That is, the most important part of the OS is protected against malicious modifications and attacks by the firmware. However if this is the only security-measure you have, there is nothing preventing a physical attacker from extracting the drive into another machine, and on this machine modify non-boot related OS-files to introduce a backdoor or trojan, and then put the drive back into the original machine. You will then boot a trusted kernel, which later on may load malicious code. Secure boot alone does not protect against a scenario like this. But if you use Secure Boot together with and BitLocker, LUKS or other full-disk encryption solutions, you should be reasonably secure, even against physical attackers. Basically Secure Boot is not a full security solution, but it is the base which you need for a fully trusted, tamper-proof computing environment. Without it, you wouldn't know if someone is logging your password or not when unlocking the encrypted drives.
  - X-Istence 8y ago
    > Basically Secure Boot is not a full security solution Which is what the Apple T2 chip is... which is why it is being lauded as such.
    - josteink 8y ago
      It's being presented as something revolutionary and new, while that's clearly not the case. And it provides Apple with the means to enforce platform-lock in, not only on its mobile line of offerings, but also on their regular laptops and machine, which traditionally has been 100% open computing owner by the end-users. Which is why it is being widely criticized as unwanted, as a misfeature.
X-Istence 8y ago
You are missing the bigger picture in your attempt to immediately discard the original articles premise because you feel like it comes off as fanboy-fluff. No other device on the market currently provides a secondary processor that runs full validation of the UEFI firmware before allowing the processor to start booting. It's not just secure boot, which has been around for a while, it's everything around it. On almost all other devices you could write new data to a flash chip and that now becomes the UEFI boot loader that is used (and can bypass secure boot). There is no verification of the UEFI boatloader that is possible because it's sitting in NVRAM or Flash... and you can't trust it to self-verify because it may have been tampered with.
- walterbell 8y ago
  > No other device on the market currently provides a secondary processor that runs full validation of the UEFI firmware before allowing the processor to start booting. HP laptops have a secondary processor (SureStart) for firmware integrity, http://h10032.www1.hp.com/ctg/Manual/c05163901 http://h10032.www1.hp.com/ctg/Manual/c05163901
- josteink 8y ago
  > On almost all other devices you could write new data to a flash chip and that now becomes the UEFI boot loader that is used (and can bypass secure boot). Let me see if I understand you completely. What you're saying that if an attacker is willing to physically dismantle the machine, he can then, using SPI-flasher HW, replace the UEFI firmware on the machine with a custom UEFI firmware which does not enforce secure-boot... And thus the machine's security is compromised? If so, let me just state my opinion: If that's the kind of attacker you are trying to protect against, no matter of security measures is going to keep you fully secure. And if we're going down that lane: what prevents an attacker this sophisticated from doing the same with the T2-chip's firmware? What Apple offers with the T2 chip, for most people, has almost zero value, while providing lots of drawbacks over traditional UEFI Secure Boot. This is all about Apple extending their platform lock-in to no longer only apply to mobile and tablet-space, but also to their traditional computer-line of products. There's nothing noble being done here. It's just a plain-in-sight money-grab.

nneonneo 8y ago

Serious question - how well does UEFI secure boot protect against an attacker with a high degree of physical access to the machine? Online docs focus mostly on the software/firmware security but less on the hardware side. Is hardware security specified, or left up to individual vendors?

josteink 8y ago
> how well does UEFI secure boot protect against an attacker with a high degree of physical access to the machine? Everything is relative. When enabled, what Secure Boot ensures is that only boot media signed by a trusted a key (which unless user-replaced, typically are the vendor-provided key which trusts MS Windows and common Linux-distros) can be booted. This guarantees that the base OS and kernel booted by the machine can be trusted to not be tampered with by untrusted parties. That is, the most important part of the OS is protected against malicious modifications and attacks by the firmware. However if this is the only security-measure you have, there is nothing preventing a physical attacker from extracting the drive into another machine, and on this machine modify non-boot related OS-files to introduce a backdoor or trojan, and then put the drive back into the original machine. You will then boot a trusted kernel, which later on may load malicious code. Secure boot alone does not protect against a scenario like this. But if you use Secure Boot together with and BitLocker, LUKS or other full-disk encryption solutions, you should be reasonably secure, even against physical attackers. Basically Secure Boot is not a full security solution, but it is the base which you need for a fully trusted, tamper-proof computing environment. Without it, you wouldn't know if someone is logging your password or not when unlocking the encrypted drives.
- X-Istence 8y ago
  > Basically Secure Boot is not a full security solution Which is what the Apple T2 chip is... which is why it is being lauded as such.
  - josteink 8y ago
    It's being presented as something revolutionary and new, while that's clearly not the case. And it provides Apple with the means to enforce platform-lock in, not only on its mobile line of offerings, but also on their regular laptops and machine, which traditionally has been 100% open computing owner by the end-users. Which is why it is being widely criticized as unwanted, as a misfeature.

X-Istence 8y ago

You are missing the bigger picture in your attempt to immediately discard the original articles premise because you feel like it comes off as fanboy-fluff. No other device on the market currently provides a secondary processor that runs full validation of the UEFI firmware before allowing the processor to start booting. It's not just secure boot, which has been around for a while, it's everything around it. On almost all other devices you could write new data to a flash chip and that now becomes the UEFI boot loader that is used (and can bypass secure boot). There is no verification of the UEFI boatloader that is possible because it's sitting in NVRAM or Flash... and you can't trust it to self-verify because it may have been tampered with.

walterbell 8y ago
> No other device on the market currently provides a secondary processor that runs full validation of the UEFI firmware before allowing the processor to start booting. HP laptops have a secondary processor (SureStart) for firmware integrity, http://h10032.www1.hp.com/ctg/Manual/c05163901 http://h10032.www1.hp.com/ctg/Manual/c05163901
josteink 8y ago
> On almost all other devices you could write new data to a flash chip and that now becomes the UEFI boot loader that is used (and can bypass secure boot). Let me see if I understand you completely. What you're saying that if an attacker is willing to physically dismantle the machine, he can then, using SPI-flasher HW, replace the UEFI firmware on the machine with a custom UEFI firmware which does not enforce secure-boot... And thus the machine's security is compromised? If so, let me just state my opinion: If that's the kind of attacker you are trying to protect against, no matter of security measures is going to keep you fully secure. And if we're going down that lane: what prevents an attacker this sophisticated from doing the same with the T2-chip's firmware? What Apple offers with the T2 chip, for most people, has almost zero value, while providing lots of drawbacks over traditional UEFI Secure Boot. This is all about Apple extending their platform lock-in to no longer only apply to mobile and tablet-space, but also to their traditional computer-line of products. There's nothing noble being done here. It's just a plain-in-sight money-grab.