4 ms·

> in that it only truly offers security to the people holding the signing keys i.e. a firm that did not pay for the computer That's not true. Practically all

> in that it only truly offers security to the people holding the signing keys i.e. a firm that did not pay for the computer That's not true. Practically all servers and more high end motherboards (even my HP zbook allows it) allow you to install your own CA's. Allowing you to create your own trust chain from firmware to OS. By itself there is nothing wrong with wanting a chain of trust between firmware and OS.

Joel_Mckay 4y ago
Sure.. if you can manage your own keys and still install a normal OS, than you have done 2 things most home PC users will never do… and others simply cannot with a crippled factory BIOS. Yet we are not talking about servers, as features like Backplane administrative subsystems and hot-swapping internal bus parts are not standard on most PCs. Also, the Intel management engine and Computrace decedent features are not always removable, include their own CVE, and companies like Toshiba and Sony would trip the permanent asset flag at the factory forcing end users to adopt features they never asked for. “chain of trust between firmware and OS” assumes physical security in logistics and co-locations is perfect, and given the number of unsolicited network appliances we would get from vendors in some places I worked... a CA no one ever checks is the least of peoples issues. We avoided HP after the quality dipped for their fragile laptops, and some server firmware would reject generic storage options. ;-)
- jsiepkes 4y ago
  > Intel management engine and Computrace decedent features are not always removable Intel ME and Computrace have nothing to do with UEFI secureboot. > “chain of trust between firmware and OS” assumes physical security in logistics and co-locations is perfect Secureboot isn't just about physical security. It also (probably even more important) ensures malware can't modify anything in the chain of trust. Meaning malware can't backdoor the bootloader and in turn also can't install a rootkit in the kernel. If you would modify the binary of the bootloader or kernel their signatures would be modified. The firmware (ie. UEFI) won't load the bootloader anymore (because the signature check fails) and the bootloader (which verifies the kernel signature) won't boot the kernel.
  - Joel_Mckay 4y ago
    Except there are already POC UEFI level rootkits that can't be detected by the host OS. Thus, such systems would appear to function normally to the common users, but offers zero benefit and may actually worsen the situation. Are you sure you are not confusing this with the TPM extensions? Again, one wrongly assumes a supplier hardware comes into a facility clean in the first place, and historically this process has already proven problematic to secure (Acer, Asus, Lenovo, CISCO etc.) ;-)
    - jsiepkes 4y ago
      > Except there are already POC UEFI level rootkits that can't be detected by the host OS. I don't see how that changes anything? There are also HDD firmware hacks which can't be detected by the OS. Does that mean we should do away with filesystem security and permissions? You still have to hack the UEFI to get a rootkit in there. And yes, everything can get hacked. But that's not an excuse not to have security, is it? > Thus, such systems would appear to function normally to the common users, Secure boot changes nothing in that scenario. You can also hack the UEFI and install a root kit without the UEFI even supporting secure boot. > Again, one wrongly assumes a supplier hardware comes into a facility clean in the first place, If you find supply chain security important, then you should choose your supplier accordingly. That has nothing to do with secure boot.
      - Joel_Mckay 4y ago
        "then you should choose your supplier accordingly" Yes, choose the refurbished, quietly restocked, and or disgruntled worker malware for your CEO. If you sell out, than don't go halfway dude... but buy a SSD/HDD retail like a sane person. ;) "I don't see how that changes anything?" Well... Lenovo just patched 70 models for UEFI security issues, so some people see this a little differently. While I respect you opinion, it is irresponsible to frame blatant illegal product tying as a security feature. "Secure boot changes nothing in that scenario" We can agree it does nothing for security in most scenarios, and it is really weird some are so emotionally invested in convincing people otherwise. "we should do away with filesystem security and permissions?" While I appreciate the off-topic rhetoric, one needs to recognize the main issue I see is who holds the signing keys. Would you buy a car someone in the next town needs to unlock for you everyday, well apparently some people are that lame. I think we will have to agree to disagree on this issue =)

Joel_Mckay 4y ago

Sure.. if you can manage your own keys and still install a normal OS, than you have done 2 things most home PC users will never do… and others simply cannot with a crippled factory BIOS. Yet we are not talking about servers, as features like Backplane administrative subsystems and hot-swapping internal bus parts are not standard on most PCs. Also, the Intel management engine and Computrace decedent features are not always removable, include their own CVE, and companies like Toshiba and Sony would trip the permanent asset flag at the factory forcing end users to adopt features they never asked for. “chain of trust between firmware and OS” assumes physical security in logistics and co-locations is perfect, and given the number of unsolicited network appliances we would get from vendors in some places I worked... a CA no one ever checks is the least of peoples issues. We avoided HP after the quality dipped for their fragile laptops, and some server firmware would reject generic storage options. ;-)

jsiepkes 4y ago
> Intel management engine and Computrace decedent features are not always removable Intel ME and Computrace have nothing to do with UEFI secureboot. > “chain of trust between firmware and OS” assumes physical security in logistics and co-locations is perfect Secureboot isn't just about physical security. It also (probably even more important) ensures malware can't modify anything in the chain of trust. Meaning malware can't backdoor the bootloader and in turn also can't install a rootkit in the kernel. If you would modify the binary of the bootloader or kernel their signatures would be modified. The firmware (ie. UEFI) won't load the bootloader anymore (because the signature check fails) and the bootloader (which verifies the kernel signature) won't boot the kernel.
- Joel_Mckay 4y ago
  Except there are already POC UEFI level rootkits that can't be detected by the host OS. Thus, such systems would appear to function normally to the common users, but offers zero benefit and may actually worsen the situation. Are you sure you are not confusing this with the TPM extensions? Again, one wrongly assumes a supplier hardware comes into a facility clean in the first place, and historically this process has already proven problematic to secure (Acer, Asus, Lenovo, CISCO etc.) ;-)
  - jsiepkes 4y ago
    > Except there are already POC UEFI level rootkits that can't be detected by the host OS. I don't see how that changes anything? There are also HDD firmware hacks which can't be detected by the OS. Does that mean we should do away with filesystem security and permissions? You still have to hack the UEFI to get a rootkit in there. And yes, everything can get hacked. But that's not an excuse not to have security, is it? > Thus, such systems would appear to function normally to the common users, Secure boot changes nothing in that scenario. You can also hack the UEFI and install a root kit without the UEFI even supporting secure boot. > Again, one wrongly assumes a supplier hardware comes into a facility clean in the first place, If you find supply chain security important, then you should choose your supplier accordingly. That has nothing to do with secure boot.
    - Joel_Mckay 4y ago
      "then you should choose your supplier accordingly" Yes, choose the refurbished, quietly restocked, and or disgruntled worker malware for your CEO. If you sell out, than don't go halfway dude... but buy a SSD/HDD retail like a sane person. ;) "I don't see how that changes anything?" Well... Lenovo just patched 70 models for UEFI security issues, so some people see this a little differently. While I respect you opinion, it is irresponsible to frame blatant illegal product tying as a security feature. "Secure boot changes nothing in that scenario" We can agree it does nothing for security in most scenarios, and it is really weird some are so emotionally invested in convincing people otherwise. "we should do away with filesystem security and permissions?" While I appreciate the off-topic rhetoric, one needs to recognize the main issue I see is who holds the signing keys. Would you buy a car someone in the next town needs to unlock for you everyday, well apparently some people are that lame. I think we will have to agree to disagree on this issue =)