3 ms·
UEFI Secure Boot doesn't completely protect against physical attacks. If a person can turn off and turn on the computer, they can replace the currently active U
by zekica 4y ago
UEFI Secure Boot doesn't completely protect against physical attacks. If a person can turn off and turn on the computer, they can replace the currently active UEFI bootloader with a shim app, enroll their own key. They can then run any UEFI binary, that binary can then do whatever, and at the end remove the SHIM NVRAM variable that it used, finally loading the original OS bootloader and removing all traces.
- Arnavion 4y ago>UEFI Secure Boot doesn't completely protect against physical attacks. I didn't say it did. In fact I formulated what I wrote precisely to convey the opposite message. >they can replace the currently active UEFI bootloader with a shim app, enroll their own key. UEFI can be protected by a password if the implementation supports it. How secure that is is of course up to the implementation.