9 ms·
Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
- rgrs 6y agoWhat is SSDT? What's exactly going on in this exploit?
- rswail 6y agoRefer to https://uefi.org/specifications https://uefi.org/specifications > ACPI defines many tables that provide the interface between an ACPI-compliant operating system, and system firmware. This includes Differentiated System Description Table (DSDT), Secondary System Description Table (SSDT), and Static Resource Affinity Table (SRAT), for example. https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface https://en.wikipedia.org/wiki/Advanced_Configuration_and_Pow...
- loeg 6y agoAs far as table contents, it's essentially an auxiliary DSDT (ACPI table defining variables, functions, interrupts, ...). An ACPI system has one DSDT and zero or more SSDTs.
- rswail 6y agoRequires the ability to edit information in /boot and to reboot, so effectively root access but it does circumvent secure boot.
- est31 6y agoThe idea of secure boot is to have a security level above root. So that even if you gain root level access, you can't put an APT onto the box or similar.
- rswail 6y agoAgreed, so it's definitely a bug. But it does require disabling kernel address translation and two reboots. Secure boot doesn't disable installing APTs, it disables installing kernel modules. If you want to disable apts etc, you need SELinux or AppArmor or equivalent.
- elmo2you 6y agoYou may want to think that statement through a bit more. Secure boot, as the name suggests, secures initial loading of the most central/core parts of an operating system: (indeed) the kernel and kernel modules. While APTs can be installed on different levels, anywhere from kernel up to user space, a good (hard to detect) place for those is inside the kernel itself or in a kernel module. Secure boot is definitely intended to prevent APTs, even if its only a part of the the full equation. You still need additional tools on top of a kernel, e.g. SELinux or AppArmor, that monitor, audit and (hopefully) prevent the introduction of APTs. However, without a trusted kernel (and kernel modules), all of those tools can be compromised/circumvented, making it ultimately an impossible task to secure the system as a whole.
- aaron_m04 6y agoThe person you are replying to is confused about what an APT is. Looks like they think it is a package installed with `apt get`.
- elmo2you 6y agoAfter reading it again, you may indeed be right. I didn't see it the first time around. My bad. Still, "installing APTs" as a synonym for installing packages with apt? I guess I would have noticed it, if it had been "installing DEBs". Also, using SELinux or AppArmor to disable the ability to install packages with apt is a new thing to me. But I have to admit that I'm not an expert at either.
- deleted 6y ago[deleted]
- eddieoz 6y agoMaybe you don't need physical access, but through some RCE and then inject the module.
- rswail 6y agoI said root access, not physical :) so I agree, you don't need physical access.
- fearingreprisal 6y agoVery cool. A very clever exploit.
- josteink 6y agoIn every UEFI thread there’s a bunch of critics saying, “See! It doesn’t work! UEFI secure boot is pointless!” I say that it takes this much effort to bypass it shows the opposite: that it does work, it does increase security. Because without it, you’d be compromised already at step zero. But like every security measure so far, it’s seemingly not perfect. Nobody is honestly surprised by that, are they?
- tenebrisalietum 6y agoPeople cheer UEFI failures because Microsoft's actions with Secure Boot and such could align with an effort to eventually completely lock out the ability to install other operating systems on bare metal on hardware you own and don't rent from Microsoft. Microsoft isn't making OEMs only install their own platform keys now, but there's nothing guaranteeing the future will be the same, especially since they can claim to support Linux on Windows through WSL. Also the whole scheme is not better than making boot configuration read only with a hardware switch, or storing your bootloader and /boot on a read-only medium, assuming you are using full-disk encryption.
- yencabulator 6y agoWorkable read-only mediums are darn hard to come by these days :-(
- llarsson 6y agoIf by "compromised already at step zero" you mean "just the way computers worked for decades prior to secure boot", then yeah, I suppose. The issue that I have heard people bring up is that it could potentially make it harder to install free and open source operating systems and thus turn consumer-grade and relatively cheap computers into less of a tool that you can use the way you want and more into an appliance. For all the panic that ensued when stuff like secure boot and similar were first announced, and the fact that I still seem able to install my Linux distro of choice, I as somebody who has not gotten personally invested in this am not in a position to know how real such an issue is. But I would like to know what proponents of secure boot think the technology solves and why what we had before inadequately addressed security needs. Because it seems to me that e.g. Windows will still happily get infected with viruses such that whether the boot process itself has been compromised, or just what comes immediately thereafter, does not matter too much. Or does it?
- mmm_grayons 6y agoDoes this affect Debian, or Ubuntu only?
- egberts1 6y agoNo, and APTs refer to Advanced Persistent Threat (can be an organization, a malware, but with non-friendly or unintended intent). And nothing to do with Debian package management that had the command and file type of “apt”.
- mmm_grayons 6y agoThanks. I'm aware it's not related to the package manager, just wanted to check.
- jm1337 6y agoThe author has published a new lockdown bypass that affects the mainline kernel as well: https://www.openwall.com/lists/oss-security/2020/06/15/3 https://www.openwall.com/lists/oss-security/2020/06/15/3
- snuxoll 6y agoSo building a signed kernel that doesn’t support the nokalsr would be sufficient to stop this attack.
- rurban 6y agoNever heard of iasl, but it is automatically installed and looks cool.