LSS: Secure Boot

Posted Sep 14, 2012 13:07 UTC (Fri) by kugel (subscriber, #70540)
Parent article: LSS: Secure Boot

I'm wondering why hibernation is even an issue.

Don't you need physical access to the machine to subvert the hibernation file? After all, the machine must be off so no running computer program on the hibernated machine can do it.

And the physical present user is trusted (and a physically present attacker can simply turn off secure boot), so to my understanding hibernate shouldn't be affected by secure boot.

Also: I'm fairly sure Windows will still have hibernate. If that's true then Microsoft would seem to agree with me thinking it's not an issue.

LSS: Secure Boot

Posted Sep 14, 2012 14:04 UTC (Fri) by hummassa (subscriber, #307) [Link] (2 responses)

> Don't you need physical access to the machine to subvert the hibernation file?

No, a piece of malware can create a subverted hibernation file and force-reboot the machine.

LSS: Secure Boot

Posted Sep 15, 2012 8:15 UTC (Sat) by kugel (subscriber, #70540) [Link] (1 responses)

Thanks. I have never seen this kind of attack

LSS: Secure Boot

Posted Sep 15, 2012 9:59 UTC (Sat) by khim (subscriber, #9252) [Link]

This attack only makes sense in secure-boot enhanced world. In any other world it's easier to just replace the kernel if you've reached the state where you can do raw disk access.