5 ms·
The pervasiveness of secure boot has genuinely made things difficult for attackers - there'd have been no reason for the Black Lotus bootkit to jump through all
by mjg59 3y ago
The pervasiveness of secure boot has genuinely made things difficult for attackers - there'd have been no reason for the Black Lotus bootkit to jump through all the hoops it did if it weren't for secure boot, and the implementation of UEFI secure boot does make it possible to remediate in a way that wouldn't be the case without it.
But secure boot at the OS level (in the PC world, at least) is basically guaranteed to give users the ability to enable or disable it, change the policy to something that uses their own keys, and ensure that the system runs the software they want. When applied to firmware, that's not the case - if Boot Guard (or AMD's equivalent, Platform Secure Boot) is enabled, you don't get to replace your firmware with code you control. There's still a threat here (we've seen firmware-level attacks for pre-Boot Guard systems), but the question is whether the security benefit is worth the loss of freedom. I wrote about this a while back (https://mjg59.dreamwidth.org/58424.html https://mjg59.dreamwidth.org/58424.html) but I lean towards thinking that in most cases the defaults are bad, and if users want to lock themselves into only using vendor firmware that's something that users should be able to opt into.
- hathawsh 3y agoWould it be sensible to make that choice using a good old fashioned jumper? For example, when the jumper is connected to pins 1 and 2, the firmware must be signed by a list of vendor-controlled keys; when the jumper is connected to pins 2 and 3, the firmware must be signed by a list of user-managed keys. That way, I can choose what kind of freedom makes sense for me. Most people value the freedom of not having to worry about firmware, while others value the freedom to use or create their own firmware.
- Cloudef 3y agoThen netflix wont serve you HD content unless you run your OS with pin 1-2 setup as those are the only keys they "trust" :) This is what "trusted platform" is all about.
- mjg59 3y agoNo, because the entire point of this is to be resilient against physical attack - anyone re-flashing your firmware already has your case open and can just move the jumper while they're at it.
- 14 3y agoYa sure but my threat level doesn’t include the worry of physical attacks like that.
- mjg59 3y agoThen you don't need a jumper - you can trust the firmware to impose any policy you've set (re-flashing firmware is mediated by the firmware, so you can just have a setup option that lets you choose which signing keys are trusted)
- nextaccountic 3y agoUnless the firmware has a bug and code downloaded from the Internet can exploit it
- simonh 3y agoIn which case you’re just hosed anyway. A jumper won’t change that.
- Too 3y agoTaken to the extreme, someone with physical access could replace the whole unit, to something which has the malware pre installed. A switch that can’t be controlled via software is at least more secure than the alternatives. If you check the jumper before booting up you can still be 100% sure even if someone previously flashed stuff onto it. Remember, it is called secure boot, not secure flash, so fw get verified again during boot up.
- LoganDark 3y ago
- thathndude 3y agoThis would have such a niche market, but also be so wonderful. I would love to have a physical switch that toggles between, essentially, secure boot and a user-programmable boot.
- Dalewyn 3y ago>the question is whether the security benefit is worth the loss of freedom. At least as far as Benjamin Franklin would tell you: No.
- stevefan1999 3y agoAbsolutely agree on here as Benjamin Franklin once said: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
- mjg59 3y agoThe freedom to choose which software runs on your computer is also the freedom to choose that certain software shouldn't run on your computer. The freedom to make that decision should be left up to the individuals rather than being imposed on them, but making an explicit choice that my computer should only run specific firmware builds is an expression of freedom, not a rejection of it.
- account42 3y agoExcept that describes a fantasy reality and not our reality where the user has no say and even if you are lucky enough to be able to run the software that you want it won't have access to the keys demanded by third parties like the media industry. The mere existence of "trusted comuting" is a threat to free computing.
- simonh 3y agoThe key term there is “essential liberty”, by which he meant political rights. Choosing to delegate management of a computer’s firmware to a third party firstly isn’t giving away any political rights, and is a rational choice in some circumstances. It’s a choice I might make for some computers I own or operate, and not others. Suggesting that this choice has anything to do with what Franklin was talking about is nonsense on stilts.
- salawat 3y ago
- MertsA 3y ago>if users want to lock themselves into only using vendor firmware that's something that users should be able to opt into. But even this is a potential risk all by itself if you aren't making sure this can only be done by someone with physical access to the hardware. Case in point is Dell and AMD EPYC CPUs that were locked to Dell firmware if they had been booted on a Dell motherboard in the past. It's bad enough that processors were being locked to Dell only without the user making the choice but that also allows for the possibility of some pretty potent ransomware. Not just holding data for ransom but holding hardware as well and with the same durable cryptographic guarantees.