Hacker News Reader

Comment by JoachimSchipper | Hacker News Reader

Secure Boot can prevent an attacker who has compromised a system from persistently compromising said system - provided all data used by the system is properly authenticated.

For a typical laptop, Secure Boot plus Full-Disk Encryption (e.g. Windows BitLocker) makes it harder but not impossible for an "evil maid" - an attacker with temporary, undetected access to the hardware - to compromise the system. (Note that Qubes' VM isolation, per se, does not help in an "evil maid" scenario! - the evil maid typically never even turns the system on.)

There's a lot to say about Secure Boot, and Intel's "measured boot" is rather different from the usual authenticate-then-start approach. If you want to know more, Rutkowska's (of Qubes OS fame) "x86 considered harmful" has quite a lot of good information.

[EDITed to properly spell Rutkowska’s name; thanks, e Erik!]

View on HN

> the evil maid typically never even turns the system on

What exactly are you imagining the maid doing, taking apart the laptop, removing the hard disk, mounting the EFI partition on another device... at that point, why not just install a physical keylogger?

To me, this sort of threat model never made sense, once physical access is possible your main worry ought to be https://xkcd.com/538/

What about a rogue datacenter technician that plugs usb devices into a few servers? Or a wiring contractor that installs a pcie card on your servers while they're conveniently powered off during the weekend while they upgrade something? Sure, the $5 wrench attack makes sense to steal data from an individual's laptop, but keeping undetected persistent access to some servers/networks is, in many cases, much more valuable than a one-time data dump.

A physical keylogger is more complicated then messing with the EFI boot partition and adding some persistent code to the initramfs or kernel.

Some people might say they have a detached bootloader (secondary USB which contains the LUKS headers+bootloader), but that depends on them actually keeping the two separate. Even then there is no way to authenticate what you are booting.

> Even then there is no way to authenticate what you are booting.

Let me introduce you to TPM, signed binaries and measured boot!

However, the most secure ways usually involve a flashed kernel (coreboot) on a write protected NAND chip, of course with encrypted root, that start the boot process by dumping and sha'ing the NAND and comparing that to the whitelist.

TPM usage assumes Secure Boot though. It's fairly useless if you are booting malicious files.

With enrolled keys and a password protected bios that refuses to add boot options to the boot menu, and refuse to boot existing options if the signature no longer matches, you can't be booting malicious files.

And that is what Secure Boot does for you. Not the TPM.

And to do that, a TPM is needed to keep the keys/signatures

> What exactly are you imagining the maid doing, taking apart the laptop, removing the hard disk, mounting the EFI partition on another device... at that point, why not just install a physical keylogger?

On my laptop the SSD can be removed and replaced in 1-2 minutes - you just remove a single panel with 2 screws to get at it. On the other hand, the keyboard would take 10+ minutes to get at and rebuild the computer.

> To me, this sort of threat model never made sense, once physical access is possible your main worry ought to be https://xkcd.com/538/

Sometimes, compromise without the target's knowledge is useful.

Just a nitpick here, it is "Rutkowska" and not "Rutkovska" (although that is how you would pronounce the surname).

Is it possible to use secure boot to boot e.g a Linux environment with something like AppArmor enabled in a way that can’t be disabled without resigning a new bootloader?

That’s generally the idea of “lockdown” mode but I’m not sure if it specifically applies to Apparmor.

https://man7.org/linux/man-pages/man7/kernel_lockdown.7.html

Secureboot alone can't do it, you'll need a TPM so the disk stays encrypted (and therefore protected from unwanted modifications) and to ensure the keys only get released if the bootloader is verified (to prevent the bootloader/kernel, which must remain unencrypted from being modified).

Excuse me kind sir, where may one procure the services of an evil maid?

Asking for a friend.

Reply on news.ycombinator.com