LAST WEEK we saw numerous reports about UEFI being used to attack, impede -- or whatever one wishes to call it -- Coreboot. It's an attack on computing freedom at the very core, but given the long history of Intel crimes, we were hardly shocked by it. We included relevant links in our daily links, but citing [1], the biggest UEFI apologist writes [2] that this is justified in the name of 'security', erroneously assuming that it was ever about security rather than domination and control over the user. We have already shown, on numerous occasions in fact (even earlier this year), that UEFI achieves the very opposite of security, enabling even remote bricking of entire motherboards (Intel seems more interested in intel' agencies than in actual purchasers of hardware). As the apologist is cited by FOSS sites we just thought it is worth pointing out again. People whose job is to write code for UEFI (and a lot of money is being paid for this) have a bit of an undeclared conflict of interest when writing about UEFI.
One solution, as we have pointed out before, is to avoid UEFI, which still helps Microsoft attack GNU/Linux. One effective way to achieve this is to boycott Intel, which deserves a boycott for many other reasons (much bigger and more compelling reasons than this). ⬆
Even if you’re rocking the most open of open-source operating systems, chances are your laptop isn't really that "free," betrayed by closed firmware binaries lurking deep within the hardware itself.
Modern UEFI firmware is a closed-source, proprietary blob of software baked into your PC’s hardware. This binary blob even includes remote management and monitoring features, which make it a potential security and privacy threat.
You might want to replace the UEFI firmware and get complete control over your PC’s hardware with Coreboot, a free software BIOS alternative—but you can’t in PCs with modern Intel processors, thanks to Intel’s Boot Guard and the “Verified Boot” mode PC manufacturers choose.
PC World wrote an article on how the use of Intel Boot Guard by PC manufacturers is making it impossible for end-users to install replacement firmware such as Coreboot on their hardware. It's easy to interpret this as Intel acting to restrict competition in the firmware market, but the reality is actually a little more subtle than that.
UEFI Secure Boot as a specification is still unbroken, which makes attacking the underlying firmware much more attractive. We've seen several presentations at security conferences lately that have demonstrated vulnerabilities that permit modification of the firmware itself. Once you can insert arbitrary code in the firmware, Secure Boot doesn't do a great deal to protect you - the firmware could be modified to boot unsigned code, or even to modify your signed bootloader such that it backdoors the kernel on the fly.