| |||||||||||||
SUSE and Secure Boot: The Details (SUSE Blog)SUSE and Secure Boot: The Details (SUSE Blog)Posted Aug 11, 2012 21:34 UTC (Sat) by geofft (subscriber, #59789)In reply to: SUSE and Secure Boot: The Details (SUSE Blog) by hummassa Parent article: SUSE and Secure Boot: The Details (SUSE Blog)
That attack doesn't work -- it requires relying on the user to make a specific typo. If there's only one signature on a particular bootloader, then the user has to type in the correct typo exactly.
There's no network interaction here, we're just bootstrapping from SSL as an existing way to get certificates associated with well-known names with some amount of validation. So it's not like you can type in "dabien.org" and get to the wrong page in the bootloader, or trick the user to visiting "debiŠ°n.org", or whatever.
(And it also requires that the user be planning to boot a custom distribution, and go into the shim-loader settings and enter the hostname -- not a very effective attack. There's no prompt to accept a particular certificate.)
(Log in to post comments)
SUSE and Secure Boot: The Details (SUSE Blog) Posted Aug 12, 2012 13:41 UTC (Sun) by HelloWorld (guest, #56129) [Link]
It's easy to make them type something like debian-project.org. or ubuntu-os.com or whatever.
SUSE and Secure Boot: The Details (SUSE Blog) Posted Aug 12, 2012 21:29 UTC (Sun) by dlang (✭ supporter ✭, #313) [Link]
just ubuntu.org instead of ubuntu.com is easy enough (it's a mistake I make about half the time anyway)
SUSE and Secure Boot: The Details (SUSE Blog) Posted Aug 12, 2012 23:59 UTC (Sun) by geofft (subscriber, #59789) [Link]
That still requires a fairly targeted attack -- you have to MITM the installation instructions and the ISO download, such that they access your text and your bootloader instead of the real one, and you have to do this while they're attempting to download and install a new OS. (And if you can do this MITM, you can as easily trojan the text instructions to say "go turn Secure Boot off", which is something lots of legitimate small distros will say.)
In other words, it's perfectly fine to accept that this attack exists. It still helps people from being infected with boot-sector viruses when they're not reinstalling their OS, which is the goal of this process. In general, people do not switch operating systems all the time; at most they tend to do so once or twice. Closing an existing vulnerability all the time except for during OS install is still a benefit.
SUSE and Secure Boot: The Details (SUSE Blog) Posted Aug 17, 2012 14:48 UTC (Fri) by pjones (subscriber, #31722) [Link]
Not really, no - you make /dozens/ of sites like this. It's not a targeted attack - it's agriculture.
|
|||||||||||||