3 ms·
> Chromebooks are quite robust against remote attacks, and they're fairly robust against local physical attacks, but "Put an external interface on the NOR SPI f
by ajross 3y ago
> Chromebooks are quite robust against remote attacks, and they're fairly robust against local physical attacks, but "Put an external interface on the NOR SPI flash and put whatever you want there" defeats just about everything they do with secure boot, because you can put your own code there instead
This hasn't been true for a decade or more. Boot ROMs are validated by on-chip firmware in the modern world (not just on Chromebooks, everywhere). You can flash the chip with your JTAG gadget, sure, but if doesn't have a signature that works it won't do anything but brick your board.
No, the obvious holes have long since been plugged. The design is secure. The implementation may have holes, but on the whole you can't break into an arbitrary box. You need to get lucky with a crack like the one in the linked article.
- Syonyk 3y agoYes, and one can bypass those write protections with physical access. I'm going with what's written here as truth - if that's out of date, well... wouldn't surprise me, really: https://chromium.googlesource.com/chromiumos/docs/+/HEAD/write_protection.md https://chromium.googlesource.com/chromiumos/docs/+/HEAD/wri... > Note that even in case of the devices protected by the SE, opening up the device and disconnecting the battery would still disable write protection. Unless I'm missing something, the "read only" region is simply a normally write-protected region of the flash chip, and with physical access, there a range of ways to rewrite that region.