i like how the manufacturers who responded to the author’s queries basically said ‘tough shit, that product is out of support’
lol at the DO NOT TRUST keys.
I’ve learnt over the years that you have to make the example code fail to compile or print out huge user-visible warnings or something like that, otherwise people can and will use it as-is in production, hard-coded keys and all.
Even if you make it print out a huge message, some manufacturers will just comment that out while keeping all the other dummy example data.
I’ve seen several production OAuth/OpenID servers that accepted an app ID and secret from a “how to set up an OAuth server” tutorial, and in one case the company was using that app ID for all their production services.
That’s on the company for paying pennies for their dev and production roles.
Secure Boot is a broken concept by design.
To this day, key players in security—among them Microsoft and the US National Security Agency—regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments, including in industrial control and enterprise networks.
You dare question a monopoly corporation and the spymasters of this country??
(/s)
Yes, surely randoms on Lemmy know better than Microsoft and the NSA in regards to security.
Oh anyone who doesn’t trust Microsoft with their life is a complete idiot. And the NSA only illegally spied on everyone until Bush the II made it legal! So of course we should unquestioningly follow their configuration guides. I mean - haha - we don’t wanna get disappeared! Haha ha. Not. Not that that’s ever happened. That we know of. For sure. Probably.
in regards to security
in regards to security
in regards to security
in regards to security
Just wanted to make sure you saw it this time because you went off on a tangent there.
It doesn’t matter if they know about security (which they do). A burglar could know about locks and home security systems, would you take his advice?
Their positions on security of others is dismissed on grounds of trust not of competence.
Exactly, they have a clear conflict of interest
A burglar could know about locks and home security systems, would you take his advice?
Literally, yes. There was even a TV show about it.
Do you have any evidence those two people are still committing burglaries? The NSA is not an ex-intelligence agency.
Hey what is that, some kinda tangent
A burglar could know about locks and home security systems, would you take his advice?
If they were an expert burglar, I might
Source: I’m an expert burglar and all of the others on my burglar crew are very helpful when people ask about home security stuff.
Security is the last thing NSA and Micro$oft care about. NSA wants to be sure they can do all they need to with your devices, and M$ just wants to discourage you from switching to linux.
This is obviously insane
Select models of:
Acer
Dell
Gigabyte
Intel
Supermicro
aopen
formelife
You’re welcome.
Doing the lord’s work here!
Even Intel lmao
You’re missing the additional list mentioned later on, also includes Lenovo and some others
o7
The repository included the private portion of the platform key in encrypted form. The encrypted file, however, was protected by a four-character password, a decision that made it trivial for Binarly, and anyone else with even a passing curiosity, to crack the passcode and retrieve the corresponding plain text.
It’s like installing a top-of-the-line alarm system for your house with camera, motion detector, alarm, and immobilizing gas, then leaving the unlock password on a PostIt under the welcome mat.
immobilizing gas
BRB, setting up a new automation in Homeassistant…
Send yaml
K-rapy garboge!:
There’s little that users of an affected device can do other than install a patch if one becomes available from the manufacturer.
Gentoo gives extensive instructions:
Arch:
NIST (US government guides cover POSIX/Windows with a layperson explanation and guide):
- https://csrc.nist.gov/projects/key-management
- https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-57pt3r1.pdf
The technical documentation about Secure Boot says that SB is not a mechanisms to steal ownership of your device. It is a spurious claim because the design specification is only a reference and not a requirement. Gentoo has further documentation that can be found describing KeyTool, a package that enables booting directly into UEFI to change the keys manually if your implemented UEFI bootloader lacks the functional implementation required to sign your own keys. I’ve never tried it personally. I merely know of its existence.
“It’s a big problem,” said Martin Smolár, a malware analyst specializing in rootkits who reviewed the Binarly research and spoke to me about it. “It’s basically an unlimited Secure Boot bypass for these devices that use this platform key. So until device manufacturers or OEMs provide firmware updates, anyone can basically… execute any malware or untrusted code during system boot. Of course, privileged access is required, but that’s not a problem in many cases.”
I mean, I don’t really have much interest in requiring that my BIOS code be signed, but I have a hard time believing that this Martin Smolár guy is correct. Just entirely disable firmware updates in the BIOS, and re-enable just for the one boot where you update your BIOS while booting off a trusted USB key. You’d never put your OS in a position of being able to push an update to the BIOS.
EDIT: Actually, if current BIOSes can update without booting to an OS at all, just selecting a file on a filesystem that they can understand – IIRC my last Asus motherboard could do that – you never need to enable it for even that.
I think Secure boot is intended to check that the boot loader itself is signed.
This is a way to mitigate viruses and malware that infects the boot loader so it can reinstall itself if it’s removed by AV, or something else.
If you can create a boot loader that is signed in such a way that secure boot can’t tell it’s invalid then you can do some nasty stuff.
Closest analogy I can think of is verisigns private key being leaked and there’s no fast and easy way to revoke and replace it without wreaking havoc on currently installed OS’s machines.
i heard that linux users dont rlly like secure boot
They don’t like it because it’s mostly implemented in microsofts favor. It’s shipped with microsoft keys by default and needs to be disabled to boot a lot of linux distros. If there was a more unbiased way to load a new os like a default key setup routine at first boot or a preinstalled key for major linux distros they wouldn’t be so hostile towards secure boot. The technology isn’t bad and it’s the only way to not have somebody temper with your system at rest without TPM.
i agree and makes sense
Which is dumb. Secure Boot does make sense (if handled correctly, unlike here).
I don’t speak for all Linux users, but it’s not like we don’t like the tech or the concept… We don’t like it because a lot of the time it’s just another way for Microsoft to throw around their weight, you need a valid key to sign your kernel images with to be able to boot another OS instead of Windows, and some motherboards don’t support installing your own keys as trusted keys. But usually there are ways around that issue nowadays.
And also it’s not an easy process if you’re not an advanced user of sorts. You have to know what is entailed, what to use, where to store your keys safely, have a script to re-sign the kernel image every kernel update(which happens every week on something like Arch), etc.
ngl i got fedora secure boot working with microsoft uefi keys it required some tinkering
200+ models from 5 big device makers
Nearly 500 device models use them anyway.
Bleeping Computer reports 813 products from 10 vendors.
Checked the BIOS update file of a Gigabyte motherboard I have here (Z170X - Gaming 7):
DETECTED PKfail untrusted certificateIssuer: CN=DO NOT TRUST - AMI Test PKClearly, the solution is to just abandon all
hopehigher level abstraction. Pedal to the metal with Assembly (and maybe LISP and Forth) straight from boot
