Microsoft secure boot “fix”

[dada_dave]

So this seems to be a major issue. Unfortunately the fix isn’t really a fix (see below) and can itself wreck your machine:

For those on Windows machines, be careful?

https://twitter.com/MalwareJake/status/1656043142766837767

 

[Colstan]

It looks like MSI is getting in on the fun, having their UEFI BootGuard keys leaked.

Leak of MSI UEFI signing keys stokes fears of “doomsday” supply chain attack

With no easy way to revoke compromised keys, MSI, and its customers, are in a real pickle.

arstechnica.com

What's most remarkable is MSI's response, or lack thereof. While some PC suppliers have a patching procedure that is ramshackle, at the best of times, it appears that MSI has no security process, and therefore has no idea how to deal with this. Intel has also been cagey with a response, having already had issues with their Management Engine firmware a couple years ago. It looks like the keys are burned into hardware, so there's not much MSI can do about this, other than warn users to only download updates directly from their website...the same website that has already been compromised previously. Since it isn't clear how long they've been vulnerable, there's no telling how many products may have been impacted.

With Intel's BootGuard keys being leaked, maybe it's time for PC users to switch to AMD, and hope that their chips don't explode. Both are bad outcomes, either having all of your credentials stollen, or your house burning down.

This also brings up the wider issue with the adoption of UEFI. The more complex the firmware, the more it is open to attack. I wasn't a big fan of UEFI when it was first announced, and assumed it would become a security nightmare. It's essentially an operating system that boots before your operating system.

While no product is 100% secure, this is yet another reason for Apple to move Mac users over to Apple Silicon as quickly as possible. Intel Macs still use UEFI, which has had security issues over the years, while iBoot remains secure. That's not to mention the side-channel attacks with Hyper-threading within Intel's CPUs. On top of that, Apple's T2 chip has its own unfixable vulnerability. Thus far, Apple Silicon looks to be reasonably bullet proof, certainly compared to traditional PC technology.

It's another example of the benefits Apple has when controlling the whole stack. Microsoft didn't get serious about security until Windows XP SP2. OS X had been traditionally more secure, but there was a time when Apple appeared to fall behind, mainly being protected by marketshare. These days, I'd wager that the Mac is far more secure than the average PC, which depends upon the chain of trust of dozens of manufacturers. Plus, Apple can issue an update as soon as it's ready, while herding the PC suppliers is an entirely different proposition.

 

[dada_dave]

It looks like MSI is getting in on the fun, having their UEFI BootGuard keys leaked.

Leak of MSI UEFI signing keys stokes fears of “doomsday” supply chain attack

With no easy way to revoke compromised keys, MSI, and its customers, are in a real pickle.

arstechnica.com

What's most remarkable is MSI's response, or lack thereof. While some PC suppliers have a patching procedure that is ramshackle, at the best of times, it appears that MSI has no security process, and therefore has no idea how to deal with this. Intel has also been cagey with a response, having already had issues with their Management Engine firmware a couple years ago. It looks like the keys are burned into hardware, so there's not much MSI can do about this, other than warn users to only download updates directly from their website...the same website that has already been compromised previously. Since it isn't clear how long they've been vulnerable, there's no telling how many products may have been impacted.

With Intel's BootGuard keys being leaked, maybe it's time for PC users to switch to AMD, and hope that their chips don't explode. Both are bad outcomes, either having all of your credentials stollen, or your house burning down.

This also brings up the wider issue with the adoption of UEFI. The more complex the firmware, the more it is open to attack. I wasn't a big fan of UEFI when it was first announced, and assumed it would become a security nightmare. It's essentially an operating system that boots before your operating system.

While no product is 100% secure, this is yet another reason for Apple to move Mac users over to Apple Silicon as quickly as possible. Intel Macs still use UEFI, which has had security issues over the years, while iBoot remains secure. That's not to mention the side-channel attacks with Hyper-threading within Intel's CPUs. On top of that, Apple's T2 chip has its own unfixable vulnerability. Thus far, Apple Silicon looks to be reasonably bullet proof, certainly compared to traditional PC technology.

It's another example of the benefits Apple has when controlling the whole stack. Microsoft didn't get serious about security until Windows XP SP2. OS X had been traditionally more secure, but there was a time when Apple appeared to fall behind, mainly being protected by marketshare. These days, I'd wager that the Mac is far more secure than the average PC, which depends upon the chain of trust of dozens of manufacturers. Plus, Apple can issue an update as soon as it's ready, while herding the PC suppliers is an entirely different proposition.

Yeah Apple’s device tree makes some difficulty for Hector’s work (as one would expect as it is designed to be used primarily by themselves) but there’s no question that UEFI is a security nightmare. The trouble is there isn’t anything better that is standardized and can handle all the disparate things UEFI can handle but the fact that it can handle all those things is part of why it’s so difficult to secure.

That’s why as I wrote to you in the other post in the other thread ARM under the “System Ready” program pushes their partner server chip makers to support UEFI. Server management expects it because MS standardized it and therefore so did Linux and now it’s expected. I’m not sure anyone really likes UEFI intrinsically but no one sees much of a choice.

Since Apple doesn’t have to worry about complying with WIntel standards anymore or having to work with every possible hardware manufacturer’s screwy device on their SOC board they can roll their own solution and be a lot more secure.

 

[mr_roboto]

While no product is 100% secure, this is yet another reason for Apple to move Mac users over to Apple Silicon as quickly as possible. Intel Macs still use UEFI, which has had security issues over the years, while iBoot remains secure. That's not to mention the side-channel attacks with Hyper-threading within Intel's CPUs. On top of that, Apple's T2 chip has its own unfixable vulnerability. Thus far, Apple Silicon looks to be reasonably bullet proof, certainly compared to traditional PC technology.

The first 17 minutes or so of Ivan Krstić's Black Hat 2019 presentation have a lot of interesting stuff about how Apple hardened their UEFI considerably above standard.



Part of Apple's enhanced UEFI security was based on the known-to-be-flawed T2, but for what it's worth the T2 exploits require the attacker to be physically present at the computer to plug in a USB device, and do not persist after T2 is rebooted.