3 ms·
A physical keylogger is more complicated then messing with the EFI boot partition and adding some persistent code to the initramfs or kernel. Some people might
by Foxboron 6y ago
A physical keylogger is more complicated then messing with the EFI boot partition and adding some persistent code to the initramfs or kernel.
Some people might say they have a detached bootloader (secondary USB which contains the LUKS headers+bootloader), but that depends on them actually keeping the two separate. Even then there is no way to authenticate what you are booting.
- 1996 6y ago> Even then there is no way to authenticate what you are booting. Let me introduce you to TPM, signed binaries and measured boot! However, the most secure ways usually involve a flashed kernel (coreboot) on a write protected NAND chip, of course with encrypted root, that start the boot process by dumping and sha'ing the NAND and comparing that to the whitelist.
- Foxboron 6y agoTPM usage assumes Secure Boot though. It's fairly useless if you are booting malicious files.
- 1996 6y agoWith enrolled keys and a password protected bios that refuses to add boot options to the boot menu, and refuse to boot existing options if the signature no longer matches, you can't be booting malicious files.