| |||||||||||||
SUSE and Secure Boot: The Details (SUSE Blog)SUSE and Secure Boot: The Details (SUSE Blog)Posted Aug 14, 2012 21:34 UTC (Tue) by Wol (guest, #4433)In reply to: SUSE and Secure Boot: The Details (SUSE Blog) by drag Parent article: SUSE and Secure Boot: The Details (SUSE Blog)
But you solve those problems by booting from CD, and scanning the hard disk for rootkits.
The problem with UEFI is it provides a large attack surface that can be compromised before any sort of external trusted media can load. A minimal bios, booting a CD, is guaranteed to give you a system as secure as your CD.
A UEFI system, if compromised, means your system is unrecoverable.
Cheers,
(Log in to post comments)
SUSE and Secure Boot: The Details (SUSE Blog) Posted Aug 14, 2012 22:28 UTC (Tue) by raven667 (subscriber, #5198) [Link]
A BIOS booting a CD is not guaranteed to give you a secure system as there is nothing protecting the BIOS itself. The BIOS can be modified with malware that you'd be unable to detect with anything running afterwards. UEFI Secure Boot both protects the firmware from modifications unauthorized by the user and provides a base to check the bootloader, kernel, etc. so that you can have a small beachhead of known good code before any malware can load. This allows you to self-host the kind of rootkit scanning that you are trying to use a CD for.
|
|||||||||||||