Technology

59374 readers

7033 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

315

Secure Boot is completely broken on 200+ models from 5 big device makers (arstechnica.com)

submitted 3 months ago by [email protected] to c/[email protected]

77 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 63 points 3 months ago (33 children)

Secure Boot is a broken concept by design.

[–] [email protected] 14 points 3 months ago (13 children)

Can you explain more (don't doubt you)

[–] [email protected] 13 points 3 months ago* (last edited 3 months ago) (6 children)

Ok, so I am not an expert, and I am not the OP. But my understanding is that Secure Boot is checking with a relatively small list of trustworthy signing certificates to make sure that the OS and hardware are what they claim to be on boot. One of those certificates belongs to a Microsoft application called Shim, which can be updated regularly as new stuff comes out. And technically you can whitelist other certificates, too, but I have no idea how you might do that.

The problem is, there's no real way to get around the reality that you're trusting Microsoft to not be compromised, to not go evil, to not misuse their ubiquity and position of trust as a way to depress competition, etc. It's a single point of failure that's presents a massive and very attractive target to attackers, since it could be used to intentionally do what CrowdStrike did accidentally last week.

And it's not necessarily proven that it can do what it claims to do, either. In fact, it might be a quixotic and ultimately impossible task to try and prevent boot attacks from UEFI.

But OP might have other reasons in mind, I dunno.

[–] [email protected] 5 points 3 months ago (1 children)

And technically you can whitelist other certificates, too, but I have no idea how you might do that.

When you enter the UEFI somewhere there will be a Secure Boot section, there there is usually a way to either disable Secure Boot or to change it into "Setup Mode". This "Setup Mode" allows enrolling new keys, I don't know of any programs on Windows that can do it, but sbctl can do it and the systemd-boot bootloader both can enroll your own custom keys.