EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

04.07.13

UEFI Restricted Boot No Longer Valid for Security, Keys Leaked

Posted in Antitrust, GNU/Linux, Microsoft, Security at 2:30 pm by Dr. Roy Schestowitz

As much about security as multimedia DRM

Drip

Summary: Antitrust offences with UEFI restricted boot can no longer be defended as an act of enhancing security because keys are leaking

A Fedora developer was the first to embrace Microsoft’s restricted boot, so Fedora was usually ahead of the curve when it comes to it and it shows.

Torvalds criticised Red Hat for complicity with Microsoft [1, 2] after he had slammed restricted boot as something that would not improve security. He was right. Keys were inevitably leaked, leaving UEFI restricted boot (which former Novell/SUSE developers too helped promote) in a position where it is only an antitrust issue and nothing to do with computer security, just protectionism. As one new article puts it, the “Linux Lawsuit Shines Uncomfortable Light on UEFI Standard” and a Restricted Boot proponent leads with this news about UEFI signing keys getting leaked:

A hardware vendor apparently had a copy of an AMI private key on a public FTP site. This is concerning, but it’s not immediately obvious how dangerous this is for a few reasons. The first is that this is apparently the firmware signing key, not any of the Secure Boot keys. That means it can’t be used to sign a UEFI executable or bootloader, so can’t be used to sidestep Secure Boot directly. The second is that it’s AMI’s key, not a board vendor – we don’t (yet) know if this key is used to sign any actual shipping firmware images, or whether it’s effectively a reference key. And, thirdly, the code apparently dates from early 2012 – even if it was an actual signing key, it may have been replaced before any firmware based on this code shipped.

But there’s still the worst case scenario that this key is used to sign most (or all) AMI-based vendor firmware. Can this be used to subvert Secure Boot? Plausibly. The attack would involve producing a new, signed firmware image with Secure Boot either disabled or with an additional key installed, and then to reflash that firmware. Firmware images are very board-specific, so unless you’re engaging in a very targeted attack you either need a large repository of firmware for every board you want to attack, or you need to perform in-place modification.

Now we know that UEFI restrictions had nothing to do with security and eventually became just a competition barrier. Rather than cracking we are seeing leaking as the end of UEFI restricted boot’s (or ‘secure’ boot’s) reputation.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Microsoft Lies, Propaganda, Embedded 'Journalism' and Other Dirty Tricks to Promote Vista 10

    The Vista 10 entrapment is being sold to the public using bogus/unverified figures, Microsoft propagandists pretending to be journalists, and some gullible people who actually believe them



  2. Microsoft -- Like Bill Gates -- Bribes PBS for Propaganda to be Presented as 'TV Programme'

    Microsoft pays the supposedly 'public' network to act as courier of Microsoft marketing, shrewdly disguised as 'information'



  3. Links 2/8/2015: KDE Applications 15.08 Beta, Zorin OS 10

    Links for the day



  4. Links 1/8/2015: Steam Sale, blackPanther OS 14.1

    Links for the day



  5. Vista 10 Inherently Criminal: Vandalising the Competition (Dual Boot, Rival Web Browsers, Online Services)

    Vista 10, the latest incarnation of Windows, takes its anticompetitive aspects to a whole new level, betraying even so-called 'partners' in the process



  6. As Microsoft AstroTurfing/PR Budget Runs Dry, Vista 10 Truths Come Out

    The media manipulation by Microsoft (to the tune of hundreds of millions of dollars spent on 'marketing') grows thin as a growing number of growingly angry early adopters of Vista 10 publicly rant



  7. Links 31/7/2015: Lennart Poettering as 'Linux Hero' and systemd Conference Coming

    Links for the day



  8. Links 30/7/2015: Apache Spark on Z System, Elive 2.6.8 Beta

    Links for the day



  9. Microsoft's Mouthpiece Mary Branscombe Tries to Shoot Down Free Software, But Fails Miserably

    At the CBS-owned ZDNet, which is Free/Open Source software-hostile, new FUD surfaces, but the FUD is so flawed that a full rebuttal is easy and almost imperative



  10. People of New Zealand Must Rise Up to Defend Sovereignty and Stop Software Patents

    The TPPA serves to override (launder) the law of New Zealand, allegedly legalising patents on software in the process



  11. Microsoft Illegally Evades Billions of Dollars in Tax, Says IRS

    The criminal enterprise known as Microsoft finds itself embarrassingly exposed in the courtroom, for the IRS belatedly (decades too late) targets the company in an effort to tackle massive tax evasions



  12. Vista 10 Very Buggy Upon Release, Just as We Have Repeatedly Warned for Weeks

    Vista 10 is prematurely pushed out the door (to meet a deadline) way ahead of it being stable, even remotely polished, and supported by hardware companies (there is a serious drivers issue)



  13. Surveillance Machine With a Keylogger: Vista 10 Will Spy on the User (Over the Internet) Even While Playing Games

    Microsoft is making it clear that even playing a simple game like Solitaire on Vista 10 will make one subjected to spying (for targeted ads); other serious violations of privacy revealed upon release



  14. Links 29/7/2015: Akademy 2015 Ends, NetBSD 7.0 RC

    Links for the day



  15. MPEG-LA is Preparing New Patent Obstruction (Called DASH) Against Free Software, OIN Grows

    A new conspiracy against free multimedia software, set up by the MPEG cartel, is called DASH



  16. New Zealand's Media Gets History Wrong on Software Patents

    Setting the record straight on the fight against software patents in New Zealand



  17. Not Only Vista 10 Crashes a Lot, Any .NET Application Does Too (Updated)

    Microsoft software is quickly becoming synonymous with crashes as any piece of software developed with Microsoft's tools, not just the underlying platform, crashes chronically



  18. The Government of Bulgaria Sells Out to Microsoft, Again

    Despite some promises and reassurances that Bulgaria will consider Free/libre software, the Bulgarian government hands out a lot more of taxpayers' money to the Mafia



  19. Corporate Media Finally Finds Out That Vista 10 Crashes a Lot

    Stability issues of Vista 10 are belatedly reported to be a major catastrophe, leaving it unusable for many early adopters



  20. Links 28/7/2015: Linux 4.2 RC4, New Logos and Bug 'Branding' for FUD

    Links for the day



  21. Patents Roundup: Technicolor, Alice, Voip-Pal, Fitbit, Marijuana Patents, and JDate

    A look at some of last week's patent news, with imperative responses that criticise corporate exploitation of patents for protectionism (excluding and/or driving away the competition using legal threats)



  22. Corporate Lobbyists Including Koch-Connected Front Groups Attack Real and Perceived Patent Reform in the United States

    Looking at some of the latest propaganda for and against a bill which is already too watered-down to actually fix the US patent system



  23. Patents in the Android World Further Complicate Freedom in This Linux-Powered Platform

    A survey of last week's news with special focus on Google and Android, which are trying to coexist and thrive in a world full of patent maximalists



  24. The 'Unitary' Patent Trojan Horse Rammed Down the Throat of Europe

    Under the guise of 'unification' or 'unity', existing patent systems are being abandoned and more power gets passed to corrupt EPO officials



  25. HEVC Cartel is Not News, Only the Names of Backers and the Costs Are New

    A few remarks on and a roundup of recent articles about HEVC, which we first wrote about in spring



  26. IRC Proceedings: July 12th, 2015 – July 25th, 2015

    Many IRC logs



  27. Links 26/7/2015: Purism Librem and Freedom, Akademy Updates

    Links for the day



  28. Vista 10 (Windows 10) Has NSA Back Doors and Front Doors

    Vista 10 to bring new ways for spies (and other crackers) to remotely access people's computers and remotely modify the binary files on them (via Windows Update, which for most people cannot be disabled)



  29. Vista 10 Not Ready, But Released Anyway

    Despite severe technical issues in the rushed-out-the-door Vista 10, Microsoft decides to stick with the deadline, only days after reporting billions of dollars in losses



  30. Links 25/7/2015: Plasma Mobile, Linux Mint 17.2 OEM

    Links for the day


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts