←back to thread

658 points transpute | 3 comments | | HN request time: 0s | source
Show context
PrimeMcFly ◴[] No.35844325[source]
There is no reason to use a manufacture key anyway, at least for SecureBoot.

Obviously it isn't in everyone's skillset, but if you have the means there is nothing preventing you from generating and using your own key.

Honestly it seems like a good basic security precaution, not only to prevent against leaks like this, but also to counteract any backdoors (although kind of a moot point with chipmakers).

replies(3): >>35844568 #>>35844657 #>>35844906 #
1. AshamedCaptain ◴[] No.35844906[source]
If your firmware and its UEFI modules were originally signed by these leaked signatures, what are you going to do? You can't just un-trust those.

In many BIOSes were you can apparently remove all keys and the firmware still loads its own builtin components, that's because the manufacturer has put a backdoor so that their own components can always be loaded irregardless of Secure Boot state. (Otherwise users would be able to brick their own machines). MSI, for example, does this. And guess what: with these leaked keys, now anyone can claim to be a "manufacturer's own component". Secure Boot is useless.

replies(2): >>35846286 #>>35848274 #
2. Avamander ◴[] No.35846286[source]
There are plenty of mobos that gladly brick themselves until you reset configuration. The most common way being Device Guard getting enabled and GPU not being initialized after that. I've not taken a look about manufacturers' own components and those defaults however.
3. csdvrx ◴[] No.35848274[source]
> If your firmware and its UEFI modules were originally signed by these leaked signatures, what are you going to do? You can't just un-trust those.

You are going to tweak them again, and check down the line (ex: grub) that they match the hash you've stored, say inside you secureboot, or in your TPM

This should get you MORE security: before, you had to accept whatever the board manufacturer though it was ok (ex: any WWAN or WLAN cared with just these Ids). Now you can add more checks (just this serial or mac address) and refuse to boot.

Someone could do the same, but if you verify at the next level (ex: grub, etc) that you tweaks are present, you can refuse to boot if they aren't.