Poettering: Brave new trusted boot world [LWN.net]

Poettering: Brave new trusted boot world

Posted Nov 6, 2022 3:10 UTC (Sun) by nybble41 (subscriber, #55106)
In reply to: Poettering: Brave new trusted boot world by farnz
Parent article: Poettering: Brave new trusted boot world

> On all the Secure Boot devices I've owned, if there is a firmware password set, then the only way to change the boot option is to enter the firmware password - otherwise, the device will only boot the single entry it's been configured to boot (the Linux OS on the SSD in the case of my current laptop).

But does it identify "the single entry it's been configured to boot" in a secure way, such as a hash of the boot image or its signing key? If not, one could still swap out the boot device for another one with the "same" entry (same identification), but controlled by the attacker. If that ultimately results in a system with PCR 11 not initialized (zero) then the attacker could feed in the expected measurements after booting their own OS and obtain the keys to unlock the encrypted storage.

to post comments

Poettering: Brave new trusted boot world

Posted Nov 6, 2022 9:01 UTC (Sun) by farnz (subscriber, #17727) [Link]

The ones I've owned rely on physical security - you can't set a default boot device that's not inside the laptop chassis, and if intrusion detection triggers, which is supposed to happen in any case where you have access to the boot devices, you must enter the firmware password to boot. If you choose the onboard NIC as a boot device, then you need the firmware password after UEFI has downloaded an image, but before it starts the executed code (this appears to be done this way so that you can set netboot first, then on-board SSD, and as long as you don't connect to the provisioning network, it boots without a password). An attacker would therefore need the firmware password to carry out the attack you describe.