• deadcade@lemmy.deadca.de
    link
    fedilink
    arrow-up
    130
    arrow-down
    1
    ·
    2 days ago

    This is heavily sensationalized. UEFI “secure boot” has never been “secure” if you (the end user) trust vendor or Microsoft signatures. Alongside that, this ““backdoor”” (diagnostic/troubleshooting tool) requires physical access, at which point there are plenty of other things you can do with the same result.

    Yes, the impact is theoretically high, but it’s the same for all the other vulnerable EFI applications MS and vendors sign willy-nilly. In order to get a properly locked-down secure boot, you need to trust only yourself.

    When you trust Microsoft’s secure boot keys, all it takes is one signed EFI application with an exploit to make your machine vulnerable to this type of attack.

    Another important part is persistence, especially for UEFI malware. The only reason it’s so easy is because Windows built-in “factory reset” is so terrible. Fresh installing from a USB drive can easily avoid that.

        • Ŝan@piefed.zip
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          8
          ·
          2 days ago

          Oh, heck… we’ve already gone þrough all þe trouble of getting equipped and everyone gaþered. Might as well go ahead wiþ it.

          • Crogdor@lemmy.world
            link
            fedilink
            arrow-up
            3
            ·
            2 days ago

            I think… we all think the bag was a nice idea. But - not pointin’ any fingers - they coulda been done better. So, how 'bout, no bags this time - but next time, we do the bags right, and then we go full regalia.

      • deadcade@lemmy.deadca.de
        link
        fedilink
        arrow-up
        5
        ·
        1 day ago

        Depends entirely on the device. On most desktops, you should be able to. On a lot of laptops, this may leave them in an unbootable state (due to GPU option ROMs).

        Check for your specific hardware before removing factory default secure boot keys.

    • MonkeMischief@lemmy.today
      link
      fedilink
      arrow-up
      3
      arrow-down
      1
      ·
      1 day ago

      Alongside that, this ““backdoor”” (diagnostic/troubleshooting tool) requires physical access

      Can’t have an “evil maid” if I do my own cleaning around here.

      😏 <br> 👉 👉