Collaborate Disseminate
In my laptop I’ve set up a bios password when I power on the laptop, and once I enter it the laptop starts my linux distro and decrypts the disk without asking any other password. To do this I’ve set up TPM to automatically decrypts the di… Continue reading Why the TPM PCRs does not consider a UEFI settings change? If someone resets CMOS, it’s undetected
Apple Silicon-based Macs have a LocalPolicy file that controls the secure boot process. To prevent replay attacks of the LocalPolicy, hashes of nonces are used. From here:
The lpnh is used for anti-replay of the LocalPolicy. This is an SH… Continue reading How do nonce hashes prevent replay attacks on Apple Silicon?
As far as I’ve seen, the Secure Boot process is described like so: A firmware stored in read-only memory and therefore considered secure starts. It verifies the next software component (e.g. a bootloader), loads it and – if the check is su… Continue reading Secure Boot: Can Firmware verify every component?
This is coming from Qualcomm’s Secure Boot explanation.
https://www.qualcomm.com/content/dam/qcomm-martech/dm-assets/documents/secure-boot-image-authentication_11.30.16.pdf
Within it, it explains that each bootloader loads and verifies the… Continue reading In a secure boot bootloader chain, does a bootloader image contain the RootCA certificate of the next bootloader?
I’m trying to understand how shim is considered secure.
Shim is a signed bootloader that allows to load any image (at a fixed path in the EFI System Partition) as long as its hash is added to a MOK (machine owner’s key) list, which is stor… Continue reading Is shim secure if new MOK entried can be added without a password?
As far as I understand, Secure Boot protects system from running code not signed by a specific vendor(s) during early boot stages.
In order to attempt an attack on the bootloader in the first place, an attacker would need either:
Boot fr… Continue reading What does Secure Boot protect against?
it seems state of the art that the autmotive electronical Control units (ECUs) contain security features as Secure Flashing and Secure Boot. For secure flashing, each new software to be programmed is verified by performing signature verifi… Continue reading Why is Secure Boot in an ECU required when there is Secure Flashing capabilities?
The world may not be ready, but the .zip Top Level Domain (TLD) is here. It’s a part of the generic TLD category, which was expanded to allow applications for …read more Continue reading This Week in Security: .zip Domains, Zip scanning
My phone restarted extra long for no reason and now the firmware is different. It shows up as generic android device not moto g pure. Can I encrypt the hardware to prevent this in the future
My phone restarted extra long for no reason and now the firmware is different. It shows up as generic android device not moto g pure. Can I encrypt the hardware to prevent this in the future