3 ms·
So the revocation list is distributed by BIOS updates? If yes, then secure boot seems like a joke for most consumers.
by megous 4y ago
So the revocation list is distributed by BIOS updates? If yes, then secure boot seems like a joke for most consumers.
- mjg59 4y agoNo, revocation lists can be updated from the OS and are freely available from https://uefi.org/revocationlistfile https://uefi.org/revocationlistfile
- megous 4y agoSo the OS just doesn't do it automatically?
- skozharinov 4y agoIt does. Windows ships them as part of security updates, Linux distributions can use fwupd.
- mjg59 4y agoAs noted in the other comment, Linux (if running fwupd) and Windows support doing it automatically, but the files are made public so other operating systems and distributions can also implement that.
- megous 4y agoI find it hard to square with: "In this blogpost we present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled."
- mjg59 4y agoMicrosoft has not yet chosen to revoke the vulnerable bootloader
- akira2501 4y agoIt already has 234 entries, all issued within a year of each other. How much space does a UEFI BIOS typically allocate for this list? Are you able to use this mechanism to revoke good BIOS signatures, is there an availability issue potentially created by misuse?
- mjg59 4y agoA new mechanism called SBAT (https://github.com/rhboot/shim/blob/main/SBAT.md https://github.com/rhboot/shim/blob/main/SBAT.md) is now used to allow revocation of groups of bootloaders rather than individual hashes in order to mitigate the resource consumption
- deleted 4y ago[deleted]
- red_trumpet 4y agoI don't know about Windows, but I'm quite sure my Ubuntu Update mechanism has distributed BIOS updates to my Laptop.