3 ms·

If an attacker is in a position to jam a random fob into your laptop then they can just enter the firmware and change the config to enable it. If you're going t

by mjg59 4y ago

If an attacker is in a position to jam a random fob into your laptop then they can just enter the firmware and change the config to enable it. If you're going to posit an attack scenario then please describe the entire sequence of events and where the attack would be prevented by this configuration.

Jenk 4y ago
It happens at airports, coffee shops, etc. Anywhere there are people working in public places. Jam a fob in, force a reboot, ransomware now loaded (for one example)
- mjg59 4y ago
  Force a reboot, jam a fob in, hit F1, cursor down three times, tab, down five times, space, F12, ransomware now loaded, except: System doesn't boot because PCR 7 is now different, just like it would be if you didn't have to do those additional (rapid) keypresses. This is not the threat model you're looking for.
badcppdev 4y ago
I see it as quite feasible that an attacker could insert a fob or organise for a fob to be inserted without also having opportunity to reboot the computer. That fob could then compromise the system when the computer was rebooted. The Lenovo bios setting being discussed would prevent that. BTW Can you clarify if you think the feature from Lenovo is a good or a bad thing given your claim that it's very easy to disable?
- mjg59 4y ago
  The boot variables won't point at the device, and so the firmware will never bother to scan the device. The bios setting therefore provides no additional security in this scenario.
deepsun 4y ago
Attacker leaves a USB stick somewhere on a parking lot, and curious employee plugs it in to see what's there, and reboots machine (or USB stick makes it reboot).
Someone 4y ago
The attacker may entice the user to do the “jam a random fob into your laptop” step for them, for example by giving away USB drives at a conference. If so, they need not come close to your laptop at all, certainly not close enough to change BIOS settings.

by mjg59 4y ago

Jenk 4y ago

It happens at airports, coffee shops, etc. Anywhere there are people working in public places. Jam a fob in, force a reboot, ransomware now loaded (for one example)

mjg59 4y ago
Force a reboot, jam a fob in, hit F1, cursor down three times, tab, down five times, space, F12, ransomware now loaded, except: System doesn't boot because PCR 7 is now different, just like it would be if you didn't have to do those additional (rapid) keypresses. This is not the threat model you're looking for.

badcppdev 4y ago

I see it as quite feasible that an attacker could insert a fob or organise for a fob to be inserted without also having opportunity to reboot the computer. That fob could then compromise the system when the computer was rebooted. The Lenovo bios setting being discussed would prevent that. BTW Can you clarify if you think the feature from Lenovo is a good or a bad thing given your claim that it's very easy to disable?

mjg59 4y ago
The boot variables won't point at the device, and so the firmware will never bother to scan the device. The bios setting therefore provides no additional security in this scenario.

deepsun 4y ago

Attacker leaves a USB stick somewhere on a parking lot, and curious employee plugs it in to see what's there, and reboots machine (or USB stick makes it reboot).

Someone 4y ago

The attacker may entice the user to do the “jam a random fob into your laptop” step for them, for example by giving away USB drives at a conference. If so, they need not come close to your laptop at all, certainly not close enough to change BIOS settings.