Collaborate Disseminate
Is Secure Boot without the Secure just “Boot”? Continue reading Patch Tuesday: Microsoft fixes a zero-day, and two curious bugs that take the Secure out of Secure Boot
Are there any real examples (malware, rootkits, etc.) of exploiting the UEFI secure boot mechanism vulnerabilities such as CVE-2022-21894?
I need to rate the risk of not having secure boot for a specific embedded device.
It is clear to me that secure boot is an essential part of the root of trust of a system.
In the scenario however, I have difficulties describing the specifi… Continue reading Why do I need secure boot?
I need to rate the risk of not having secure boot for a specific embedded device.
It is clear to me that secure boot is an essential part of the root of trust of a system.
In the scenario however, I have difficulties describing the specifi… Continue reading Do I need Secure Boot on an Embedded Device?
As the title says, can BIOS/UEFI malware pretend that secure boot is enabled? And if so, is there any point to enabling secure boot on a device that came with it disabled (or that you previously disabled), considering that the BIOS/UEFI mi… Continue reading Can BIOS/UEFI malware pretend that secure boot is enabled?
FDE tools like VeraCrypt will encrypt the whole system drive when the machine uses legacy boot mode (MBR). But they will only encrypt the system partition if the machine uses EFI boot mode (the EFI partition remains unencrypted).
Most sour… Continue reading Full disk encryption: Legacy boot mode (MBR) vs. EFI boot mode
I think that AMD GPUs can be flashed with any modded VBIOS because the GPU doesn’t check for firmware signature.
Shouldn’t the secure boot be able to check signature of the AMD GPUs modded VBIOS and block the PC from booting if the signatu… Continue reading Would secure boot block GPU if it has modified vbios?
I’m redoing my laptop installation from scratch, and this time I want a full secure boot chain.
Here’s what I did so far :
Enroll my own keys in the UEFI firmware
Sign my grub bootloader
Full disk encryption (implying /boot is encrypted a… Continue reading Secure boot + full disk encryption, should I sign the kernel?
I’ve now googled a lot, but the only information I can find is ‘kon-boot hides its code in BIOS memory and changes kernel-code on the fly’…
As far as I understand, UEFI initializes devices and tries to load bootloaders into memory from M… Continue reading How can kon-boot run code in UEFI?
For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and check their integrity manually. Can you… Continue reading Is there any security technology/technique beside tpm/secure boot which can verify the integrity of the bios or bootloader?