EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

04.07.13

UEFI Restricted Boot No Longer Valid for Security, Keys Leaked

Posted in Antitrust, GNU/Linux, Microsoft, Security at 2:30 pm by Dr. Roy Schestowitz

As much about security as multimedia DRM

Drip

Summary: Antitrust offences with UEFI restricted boot can no longer be defended as an act of enhancing security because keys are leaking

A Fedora developer was the first to embrace Microsoft’s restricted boot, so Fedora was usually ahead of the curve when it comes to it and it shows.

Torvalds criticised Red Hat for complicity with Microsoft [1, 2] after he had slammed restricted boot as something that would not improve security. He was right. Keys were inevitably leaked, leaving UEFI restricted boot (which former Novell/SUSE developers too helped promote) in a position where it is only an antitrust issue and nothing to do with computer security, just protectionism. As one new article puts it, the “Linux Lawsuit Shines Uncomfortable Light on UEFI Standard” and a Restricted Boot proponent leads with this news about UEFI signing keys getting leaked:

A hardware vendor apparently had a copy of an AMI private key on a public FTP site. This is concerning, but it’s not immediately obvious how dangerous this is for a few reasons. The first is that this is apparently the firmware signing key, not any of the Secure Boot keys. That means it can’t be used to sign a UEFI executable or bootloader, so can’t be used to sidestep Secure Boot directly. The second is that it’s AMI’s key, not a board vendor – we don’t (yet) know if this key is used to sign any actual shipping firmware images, or whether it’s effectively a reference key. And, thirdly, the code apparently dates from early 2012 – even if it was an actual signing key, it may have been replaced before any firmware based on this code shipped.

But there’s still the worst case scenario that this key is used to sign most (or all) AMI-based vendor firmware. Can this be used to subvert Secure Boot? Plausibly. The attack would involve producing a new, signed firmware image with Secure Boot either disabled or with an additional key installed, and then to reflash that firmware. Firmware images are very board-specific, so unless you’re engaging in a very targeted attack you either need a large repository of firmware for every board you want to attack, or you need to perform in-place modification.

Now we know that UEFI restrictions had nothing to do with security and eventually became just a competition barrier. Rather than cracking we are seeing leaking as the end of UEFI restricted boot’s (or ‘secure’ boot’s) reputation.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Calling Proprietary Software, Software Patents, Lock-in (Like OOXML) and DRM 'Open'

    What Microsoft et al. call 'Next-Generation Open Media Formats' are basically neither open nor acceptable (it's DRM) and what Microsoft apologists dub 'Open Source Tools' are just another example of a Microsoft Office openwashing Trojan horse



  2. Recycled Old News About Vista 10, Stressing That Not Only '10' is Spyware But All of Windows is

    How Microsoft propagandists are spinning Microsoft's gross and potentially illegal privacy violations as a reason to 'upgrade' to Vista 10



  3. Links 1/9/2015: Manjaro Linux 0.8.13, Netrunner 14.2 LTS

    Links for the day



  4. Patents Roundup: IAM's Claims About India, Lawyers' Patent Bias, ITC for Microsoft, and PTAB Against Kyle Bass

    Another weekly summary, focusing on issues that pertain to or affect Free software in particular



  5. Microsoft Crowd Rocks the Media With Misleading Claims and Deliberate Lies About GNU/Linux, Vista 10, and Free/Open Source Software

    A roundup of rigged press coverage, intended purely to serve Microsoft's agenda



  6. Links 31/8/2015: Linux 4.2, LXLE 14.04.3

    Links for the day



  7. IRC Proceedings: August 9th, 2015 – August 29th, 2015

    Many IRC logs



  8. “Conservative” Site Responds (Yet Again) to Misguided “Conservative” Efforts to Derail Patent Reform in the US

    Patent trolls throw stones in glass houses, contributing to their own unpopularity, but some influential “Conservatives” continue to defend (conserve) them



  9. Increase in Lobbying for Software Patents in Europe and Its Trojan Horse, the Unitary Patent (UPC)

    The relentless campaigns to bring software patents into Europe have not stopped and so-called 'unification' -- much like so-called 'trade' deals -- serves to support them



  10. Microsoft Technology Crashes Financial Markets, Again

    SunGard, which is a Microsoft shop, is clearly failing to provide what it calls mission-ciriticaal [sic] solutions



  11. Alice v. CLS Bank (Alice/§101) Comes to Squash Software Patents Even in Eastern District of Texas

    The crackdown on software patents is coming along nicely and the Alice case is now being utilised even in the capital of patent trolls



  12. Apple's Patent Cases Against Android Are Falling Apart, as Acknowledged Even by the Anti-Android Lobby





  13. Links 29/8/2015: NetworkManager 1.0.6, Systemd Merges “su” Command Replacement

    Links for the day



  14. Microsoft Loves Linux to Death and Still Tries to Kill GNU/Linux

    Microsoft's relentless attacks on GNU/Linux and Free software in general (even if it runs on Windows) are so evident that claims of 'love' remain laughable at best (if not infuriating)



  15. Censorship, Self-Censorship and Intimidation Now the Modus Operandi at EPO

    The European Patent Office has ceased even trying to pretend that it respects human rights, including the right to free speech



  16. Patent Practitioners: "The Unitary Patent Might be Able to Open the Floodgates for Software Patents in Europe"

    The EPO-backed Unitary Patent scheme threatens to bring software patents to Europe and along with them a lot of patent trolls from all around the world (especially the United States)



  17. Microsoft Lies About Vista 10 and Increases Microsoft Surveillance (Even Beyond Vista 10 and Into Android, Vista 7/8)

    Windows surveillance expands retroactively, making its way into platforms other than Windows and also expanding to predecessors of Vista 10



  18. Another Suicide at the EPO, Fifth by Our Count

    Yet another EPO member of staff has just committed suicide, leading to the inevitable question: how many people need to die before Battistelli and his minions are out of the Office for good?



  19. Links 27/8/2015: ownCloud Desktop Client 2.0, Red Hat Downgraded

    Links for the day



  20. Microsoft-connected Mesosphere Threatens to Eliminate Free Software in the Datacentre

    Hiding behind a misleading 'open' label while actually backed by Microsoft (and based on new rumours may join Microsoft), Mesosphere wishes to eradicate Free and back doors-free software in large datacentres hosting a lot of physical and virtual servers



  21. Microsoft Aggression Against GNU/Linux Amid Vista 10's Failure

    A look at the recent assault on GNU/Linux in Munich and the likely cause for this assault (in such a timely fashion, too)



  22. Message to LinuxCon Regarding Microsoft: “It is Necessary to Get Behind Someone in Order to Stab Them in the Back.” -Sir Humphrey Appleby

    Jim Zemlin, executive director of the Linux Foundation, helps Microsoft gain influence in the Foundation after payments are received



  23. Market Share Estimates Confirm That Vista 10 Failed in a Major Way

    Confirmatory evidence that Vista 10 is failing in the market about a month after its much-hyped (paid coverage) release



  24. When Microsoft, the Master of Patent Trolls, Complains About Trolls

    Possibly the world's biggest patent abuser and monopolist, which also creates many patent trolls (including by far the biggest one), takes on a far smaller abuser in Court



  25. Letter Signed by Two German Officials Becomes a Microsoft Weapon of Propaganda

    Microsoft and its minions refuse to leave Munich alone, even though the vast majority in Munich are perfectly happy with Free/libre software



  26. Links 25/8/2015: Linux Kernel 4.2 Final RC, KDE Ships Plasma 5.4.0

    Links for the day



  27. Sabine Pfeiler and Otto Seidl Should Take Note as Russia -- Like China -- is in the Process of Banning Microsoft Windows for Security Reasons

    A look at a strange suggestion, signed by Sabine Pfeiler and Otto Seidl, who suggest going back to Microsoft which is basically a spyware company now



  28. Microsoft Windows Leads to Espionage and Blackmail: Latest Examples

    Another news overview, detailing high-profile examples of high-cost Windows deployments (including the cost of litigation and settlement)



  29. Links 23/8/2015: BcacheFS Benchmarks, Blackphone 2

    Links for the day



  30. Links 22/8/2015: Chromebook Gains, GNOME 3.18 Clues

    Links for the day


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts