4 ms·
If your firmware and its UEFI modules were originally signed by these leaked signatures, what are you going to do? You can't just un-trust those. In many BIOSe
by AshamedCaptain 3y ago
If your firmware and its UEFI modules were originally signed by these leaked signatures, what are you going to do? You can't just un-trust those.
In many BIOSes were you can apparently remove all keys and the firmware still loads its own builtin components, that's because the manufacturer has put a backdoor so that their own components can always be loaded irregardless of Secure Boot state. (Otherwise users would be able to brick their own machines). MSI, for example, does this. And guess what: with these leaked keys, now anyone can claim to be a "manufacturer's own component". Secure Boot is useless.
- Avamander 3y agoThere are plenty of mobos that gladly brick themselves until you reset configuration. The most common way being Device Guard getting enabled and GPU not being initialized after that. I've not taken a look about manufacturers' own components and those defaults however.
- csdvrx 3y ago> If your firmware and its UEFI modules were originally signed by these leaked signatures, what are you going to do? You can't just un-trust those. You are going to tweak them again, and check down the line (ex: grub) that they match the hash you've stored, say inside you secureboot, or in your TPM This should get you MORE security: before, you had to accept whatever the board manufacturer though it was ok (ex: any WWAN or WLAN cared with just these Ids). Now you can add more checks (just this serial or mac address) and refuse to boot. Someone could do the same, but if you verify at the next level (ex: grub, etc) that you tweaks are present, you can refuse to boot if they aren't.