EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

04.07.13

UEFI Restricted Boot No Longer Valid for Security, Keys Leaked

Posted in Antitrust, GNU/Linux, Microsoft, Security at 2:30 pm by Dr. Roy Schestowitz

As much about security as multimedia DRM

Drip

Summary: Antitrust offences with UEFI restricted boot can no longer be defended as an act of enhancing security because keys are leaking

A Fedora developer was the first to embrace Microsoft’s restricted boot, so Fedora was usually ahead of the curve when it comes to it and it shows.

Torvalds criticised Red Hat for complicity with Microsoft [1, 2] after he had slammed restricted boot as something that would not improve security. He was right. Keys were inevitably leaked, leaving UEFI restricted boot (which former Novell/SUSE developers too helped promote) in a position where it is only an antitrust issue and nothing to do with computer security, just protectionism. As one new article puts it, the “Linux Lawsuit Shines Uncomfortable Light on UEFI Standard” and a Restricted Boot proponent leads with this news about UEFI signing keys getting leaked:

A hardware vendor apparently had a copy of an AMI private key on a public FTP site. This is concerning, but it’s not immediately obvious how dangerous this is for a few reasons. The first is that this is apparently the firmware signing key, not any of the Secure Boot keys. That means it can’t be used to sign a UEFI executable or bootloader, so can’t be used to sidestep Secure Boot directly. The second is that it’s AMI’s key, not a board vendor – we don’t (yet) know if this key is used to sign any actual shipping firmware images, or whether it’s effectively a reference key. And, thirdly, the code apparently dates from early 2012 – even if it was an actual signing key, it may have been replaced before any firmware based on this code shipped.

But there’s still the worst case scenario that this key is used to sign most (or all) AMI-based vendor firmware. Can this be used to subvert Secure Boot? Plausibly. The attack would involve producing a new, signed firmware image with Secure Boot either disabled or with an additional key installed, and then to reflash that firmware. Firmware images are very board-specific, so unless you’re engaging in a very targeted attack you either need a large repository of firmware for every board you want to attack, or you need to perform in-place modification.

Now we know that UEFI restrictions had nothing to do with security and eventually became just a competition barrier. Rather than cracking we are seeing leaking as the end of UEFI restricted boot’s (or ‘secure’ boot’s) reputation.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 24/7/2014: Oracle Linux 7; Fedora Delays

    Links for the day



  2. Valerie Strauss Explains Why Gates Foundation's Lobbying for 'Common Core' (Privatisation) is a Swindle That Makes Microsoft Richer

    Continued criticism of the Gates Foundation's lobbying and masquerading, with more journalists brave enough to highlight the corruption



  3. USPTO Officially Sets New Guidelines to Limit Scope of Software Patents in the United States

    Even patent lawyers finally acknowledge that the incentive to file software patent applications has been reduced, as the scope of patents on software has been noticeably narrowed and they are harder to acquire, let alone enforce in a courtroom



  4. UK Government Adopts OpenDocument Format (ODF) and Microsoft Already Attacks the Government Over It, Showing Absolutely No Commitment to Open Standards

    Only "Microsoft as the standard" is the 'standard' Microsoft is willing to accept, as its response to the Cabinet Office's judgment reveals



  5. Microsoft Layoffs of 2014

    Another quick look at Microsoft's horrible state of affairs and why it has virtually nothing to do with Nokia



  6. Links 22/7/2014: Linux 3.16 RC 6, New UberStudent

    Links for the day



  7. Links 20/7/2014: Jolla in India, Mega Censored in Italy

    Links for the day



  8. Longtime Mono Booster Joins Microsoft-linked Xamarin

    Jo Shields almost joins Microsoft, settling instead for its proxy, Xamarin



  9. Linux Foundation Welcomes Patent Aggressor Red Bend Software

    The Linux Foundation's AllSeen Alliance welcomes as a member a company that uses software patents to sue Free/Open Source software



  10. Matt Levy From Patent Progress (and CCIA) Does Not Really Want Patent Progress

    Matthew ('Matt') Levy moved into a foe of patent progress last year, but he still runs a site calls Patent Progress, in which he diverts all attention to patent trolls (as large corporations such as Microsoft like to do)



  11. Attacking FOSS by Ignoring/Overlooking Issues With Proprietary Software

    The biasing strategy which continues to be used to demonise Free/Open Source software (FOSS) along with some new examples



  12. Links 19/7/2014: CRUX 3.1 is Out, CyanogenMod Competes With Google Now

    Links for the day



  13. Microsoft's Massive Layoffs Go Far Beyond Nokia; Nokia's Android Phones Axed by Microsoft's Elop

    Microsoft's rapid demise and permanent exit from Nokia's last remaining Linux platform (after Microsoft had killed two more)



  14. Patents on Software Already Being Invalidated in Courts Owing to SCOTUS Ruling on 'Abstract' Patents

    The Federal Circuit Appeals Court has just "invalidated a software patent for being overly abstract," says a patents expert



  15. OpenSUSE 'Community' is Crumbling, AttachMSFT Killed SUSE's Potential (Except as Microsoft Tax)

    Not much too see in the land of SUSE and Attachmate, or formerly the company known as Novell



  16. Links 18/7/2014: Slackware Turns 21, Spotify Switches to Ubuntu

    Links for the day



  17. Links 16/7/2014: Manjaro 0.8.10 Third Update, SIA Migrates to Red Hat

    Links for the day



  18. Microsoft's Latest Round of Massive/Bulk/Large-scale Layoffs

    Microsoft boosters are preparing 'damage control' pieces ahead of massive layoffs at Microsoft



  19. Secrecy Allows British Government to be Manipulated by Microsoft for Spyware Behind Closed Doors

    Dependence on malicious software from NSA ally Microsoft is highly dependent, at least in Britain, on government secrecy and vain refusal to comply with Freedom of Information (FOI) requests



  20. Software Patent Applications Already Being Rejected in the US Owing to SCOTUS Ruling, Some Patent Lawyers Are Fuming

    Good news on the software patents front as the USPTO starts rejecting software patent applications, based on patent lawyers' words



  21. Links 15/7/2014: New Plasma, Google Announces Project Zero

    Links for the day



  22. Interest in Free Software Coverage and 9 Months With Tux Machines

    Thoughts about the level of interest in Free/Open Source software (FOSS) and growth of at least some sites that focus on GNU/Linux



  23. White House Backs Away From Appointing Patents Zealot to Top USPTO Position

    Philip Johnson is no longer poised to become the Director of the USPTO, which is basically an establishment that provides protectionism to primarily US-based corporations



  24. Professor James Bessen Presents the Case Against Software Patents After Important SCOTUS Ruling

    The debate about software patents in the Unites States continues, with academia on one side and greedy patent lawyers on the other



  25. Software Patents Demising in the US as Microsoft Patent Attacks on Android/Linux Suffer a Huge Setback

    M-Cam's assessment of Microsoft's bundle of extortion (using software patents) shows toothlessness, irrespective of the SCOTUS decision to effectively annul "abstract" software patents



  26. Links 13/7/2014: KDE Activity Surge

    Links for the day



  27. Pro-Microsoft Spin in Microsoft-Funded News Networks

    The rogue media (misinformation) campaign of Microsoft benefits from networks which have been paid by Microsoft over the years



  28. Cronyism at Play: European Hostility Towards Free/Libre Software Despite Espionage and Moles

    Europe continues to be held hostage with back doors, lock-in, and massive payments to foreign powers, despite evidence that these powers are destructive and hostile



  29. Wirelessly-Controlled Contraceptives and Other Villainous Bill Gates Initiatives

    Remote controls for people's reproductive systems are now in the making and Bill Gates is a prominent investor in the technology



  30. Links 12/7/2014: CrossOver, New Wine

    Links for the day


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts