User: Password:
Subscribe / Log in / New account

Taking it seriously

Taking it seriously

Posted Jun 2, 2012 6:54 UTC (Sat) by dilinger (subscriber, #2867)
In reply to: Taking it seriously by nybble41
Parent article: Implementing UEFI Secure Boot in Fedora

After my exploit takes over the system, I replace your unsigned code with my own. It pretends to download the secure update, but either a) doesn't, or b) just re-downloads an older (still exploitable, and very much signed/valid) update.

You then reboot into a known-good state, and the signed and validated boot code checks the signature on the update and.. whoops, there is no update (or we apply an older update if the user expects to see something happen). The system boots up, the exploit is re-run, and the user has no idea that they're still running an old version.

(Log in to post comments)

Taking it seriously

Posted Jun 4, 2012 4:43 UTC (Mon) by raven667 (subscriber, #5198) [Link]

I don't understand why a secured, trusted process would have a dependency on an exploitable unsecured process. That doesn't seem like a sane design

Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds