4 ms·
True, but that kind of also requires some way of distributing the bootable binaries, e.g. via netboot image via a TFTP server. I usually store these keys on a
by cookiengineer 2y ago
True, but that kind of also requires some way of distributing the bootable binaries, e.g. via netboot image via a TFTP server.
I usually store these keys on a LUKS encrypted flash drive. Not the best opsec, but at least good enough to prevent this kind of malware from spreading around. Can't update the kernel without the flash drive though :D
- exceptione 2y ago> I usually store these keys on a LUKS encrypted flash drive. Not the best opsec Why would it not be the best opsec? I replied to your other comment suggesting encrypting your local signing keys. I am not sure if I would use a flash drive though, why not just using the local disk?
- josephcsible 2y agoIf you have malware running on your system, couldn't it inject its bootkit code into whatever you're about to sign?