these leaks are getting ridiculous...

Secure Boot is great. Private keys leaked on Github? Not so great.
Go pick up a YubiKey and secure yourself online with two factor authentication! yubi.co/lowlev...
pk.fail/
Writeups:
arstechnica.co...
🏫 COURSES 🏫 Learn to code in C at lowlevel.academy
👕 MERCH 👕 Like the shirt? lowlevel.store
📰 NEWSLETTER 📰 Sign up for our newsletter at mailchi.mp/low...
🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒
Blue Fox: Arm Assembly Internals and Reverse Engineering: amzn.to/4394t87
Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation : amzn.to/3C1z4sk
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software : amzn.to/3C1daFy
The Ghidra Book: The Definitive Guide: amzn.to/3WC2Vkg
🔥🔥🔥 SOCIALS 🔥🔥🔥
Low Level Merch!: lowlevel.store/
Follow me on Twitter: / lowleveltweets
Follow me on Twitch: / lowlevellearning
Join me on Discord!: / discord

[@LowLevelTV]

wow haha I really wish I had a yubikey to secure myself online with 2FA: yubi.co/lowlevellearning-2024

[@LowLevelTV]

frfr

[@paddyk45]

!

[@circularanemone]

ur looking kinda insecure, no cap, get a yubyub

[@circularanemone]

ur looking kinda insecure, no cap. get a yubyub

[@erictrinque6513]

i c u, i aplod u klapklap

[@JamesR624]

- AT&T Data Breach - Crowdstrike Update Crash - CPU Predictive Processing Bypass - Intel CPU 100% Failure Rate Bug - Secure Boot Bypass Man, this month has NOT been a good month for computers and security.

[@comradepeter87]

Try "year"

[@stacklysm]

"Year" is more accurate, add SSH vulnerability to the mix

[@harriet-x.x]

xz backdoor

[@dagomara8380]

gay furries

[@sonicbhoc]

The GamersNexus Disappointment Tour shirt this year is going to be amazing

[@pwnmeisterage]

It's annoying that all these sites report "the vulnerability affects 200+ motherboards from the big OEMs" but nobody has a compiled list of exactly which motherboards are affected and which are not. You can test your motherboard. You can't test the one in the store.

[@vaikjsf34a]

you can buy it first then test the mobo and curse when you find its affected then refund it as long as you didnt bend pins :P

[@AswinC2]

The mentioned article has a list of 215 devices at the end.

[@ThatOneChannelURL]

@@vaikjsf34a Only for a Newegg RMA center employee to drag a flathead screwdriver over the pins and blame you for it.

[@SBlazeable]

@@pwnmeisterage just RMA it :)

[@NikorouKitsunerou]

200+ models that have been tested. Sounds like a list we need of which aren't vulnerable.

[@f.andersen3824]

"Don't trust it. Do not ship!" Did it get shipped? Hell ya! ☠️

[@arthurmoore9488]

As a dev, am I surprised? Hell no!

[@ゾカリクゾ]

I'm not a software dev but could this be what happens if you write a comment instead of opening a ticket/issue?

[@pattyguy]

@@ゾカリクゾ wat

[@fullfungo]

@@ゾカリクゾthis is why you are not a software dev

[@ゾカリクゾ]

@@fullfungo can u explain?

[@AshnSilvercorp]

"proprietary" and "security" really shouldn't be in the same sentence anymore...

[@arthurmoore9488]

Yet plenty of security people genuinely believe that being able to see the source code makes you more vulnerable. It's one of the reasons companies like GlobalProtect are able to sell their proprietary VPN solution. :(

[@kevikiru]

Sometime ago, I would have totally agreed. Open source never guarantees security, it's all up to you to to implement it properly.

[@emjizone]

Oh, so you prefer when nobody knows who own the keys you use ?

[@evilmuke]

having code validated by public is always better, implementing it in a way that even if breached risk and exposure will be reduced thats the other thing, from my experience its best to use both when You deploy something really critical

[@XanTheDragon]

ascension spotted

[@LukasSmith827]

Here we go again I guess

[@SterileNeutrino]

DVD Jon, where are you today?

[@NeoKailthas]

See you next week

[@alfonzo7822]

That probably shouldn't have made me laugh

[@chriss3404]

These massive breaches, failures, and outages are going to turn this into a weekly news channel 😔

[@metcaelfe]

You forgot the "ahh shit"

[@neilbrookins8428]

Don’t worry guys, if someone guesses our 4 character password we will just change it to a new 5 character long password. And just in case this change is needed under short timeframe we will all agree in advance that the fifth character is a “1” and we will reuse the first four characters to make it easy to remember.

[@send_love]

The real tragedy here is that many such people exist :')

[@lezbriddon]

Anyone else here old enough to remember flashing bios by physically removing the bios chip, UV erasing it and then re programming it, now THATS security.

[@ck17350]

Yeah, we had one of those UV EEPROM burners at work in the 90's. I loved the sound made when burning all of those gates again.

[@freedustin]

You got 7 thumbs up in 4 hours so there's your answer. Dinosaurs remember. Nobody else does.

[@la.zanmal.]

When exactly did it become possible to write to "firm"ware without that kind of physical setup, anyway? And why?

[@nickwallette6201]

The promise: "We can add new features and fix bugs in hardware you already own." The reality: "We can sell unfinished products with the carrot on a stick of potentially being finished.. some day."

[@CyReVolt]

The flash parts that can be erased and rewritten in-system and from within the system are due to updatability. The physical extra parts make it hard for people to upgrade when there are already bugs in the firmware, which happens often. And yes, it is not as "firm" as the name suggests - especially with UEFI bringing a whole other OS on its own. Bryan Cantrill calls firmware the "software that is hard to get to". Anyway, secondly, part of the flash is used for storage, where user settings, EFI variables and such are stored, like volatile data from other platform components, like the CSME, possibly EC, ethernet adapter, etc..

[@thewalrusdragon9579]

Think it’s a coincidence that tech layoffs are at a high and at the same time stuff like this is happening every other day now?

[@MrAwesomeTheAwesome]

Throw in a little increased rate of adoption of AI in software development and I'm not opposed to accepting that explanation.

[@MyVlogTubes]

@@thewalrusdragon9579 A.I and lay offs + stupid CeOs. They always get the wrong man innthe place with no expertises wtf, this way he will fuck the company and the industry

[@CyReVolt]

No, firmware has been a dumpster fire for decades. This is largely due to the ecosystem behind it. See the UEFI Forum whitepaper from August 2023 on embargo / disclosure periods for security issues. They demand a *year* because they are so slow and complex.

[@hashbrown777]

​@@CyReVoltyou meant to write "yes". Yes it is a coincidence.

[@CyReVolt]

@@hashbrown777 I'm saying that this isn't new. :-)

[@jorgelotr3752]

The powershell command doesn't work as given. Where it has '.:' between the right bracket and 'ASCII', it should say '::'. Also, 'True' is the response you should get if you are compromised ('False' means you are not, while an error message saying GetSecureBootUEFI is undefined means you don't have SecureBoot activated).

[@test-rj2vl]

Expectations: Viruses gonna bypass secure boot. Reality: Game cheaters gonna bypass secure boot that anticheats require these days.

[@jamesarthurkimbell]

Rogue nation states have obtained +12.5% melee damage buff for more than the allotted thirty seconds

[@vaikjsf34a]

Not sure why game cheaters would, because cheats don't run on the firmware and in some cases there are even peripherals they can plug in that cheat for them. I think they can still run an executable even if secure boot is there, they just cant flash the firmware no? not too familiar with secure boot or TPM I think they trash.

[@SirLightfire]

​@@vaikjsf34ait would be a very difficult thing to do, but you could inject your own bootloader into the boot process, that then injects a custom kernel patch into the kernel. From there, it'd be trivial to hide anything you want from the anticheat

[@terorvlad]

Easy fix - Just ban all devices with said vulnerability the same way RUST banned all a4tech hardware due to the powerful macro software that some people used to make anti recoil macros. Sure, you will piss a lot of people off, but hey, all in the name of security

[@JohnDoeWasntTaken]

@@vaikjsf34a Because kernel-level anti cheats like Vanguard which is required to play Valorant require secure boot to be enabled.

[@Deniil2000]

private keys should be made by people who want to protect their devices against maid attacks, not by companies. this is just absurd

[@2khz]

You can (usually) enroll your own secure boot keys *IF* your board's UEFI supports it... In which case it's up to you to sign the bootloader and/or kernel. I 100% agree that these companies should not hold the keys and determine what it is "secure" to boot from on OUR hardware.

[@SterileNeutrino]

Maid and catgirl attacks.

[@2khz]

@@SterileNeutrino need

[@Foxite__]

@@SterileNeutrino I'm gonna start calling it an Evil Catgirl attack now.

[@CPSPD]

@@SterileNeutrino when you put it that way

[@eeka_droid]

Thanks for bringing awareness on the subject Ed, it led me to double check my secure boot settings. People are questioning the effectiveness of secure boot after this issue but what they're failing to realize is that this is a "~200 devices affected" kind of thing rather than "all devices from 200 manufacturers affected", there's a huge difference. Thankfully my device is not compromised at this time.

[@nomore6167]

"rather than 'all devices from 200 manufacturers affected', there's a huge difference." - True, but on the other hand, we don't know how many devices currently have unknown/undisclosed vulnerabilities. The ONLY reason we know about this vulnerability is because someone posted the key on Github.

[@Fedor_Dokuchaev_Color]

Disabled secure boot because my Linux Distro wasn't working with it. You don't fear secure boot issues if you disable it 😊

[@tablettablete186]

Tbh, I think you can add the signature or hash of your custom kernel.

[@Pipe0481]

Same lol

[@Octahedran]

@@tablettablete186 You can, but i don't think its worth 15 minutes out of my day because that 15 minutes will always become 5 hours

[@eps-nx8zg]

@@tablettablete186 Yeah its super easy, at least on arch to enroll your own keys and automatically sign your kernels and stuff.

[@Mordecrox]

​@@tablettablete186signature: "1234"

[@SterileNeutrino]

I never understood the value proposition of "secure boot" except as making Open Source bootloaders hard or impossible to use and disallowing tweaking/analyzing manufacturers firmware aka. "locking the system down like a Playstation", and maybe make money on the side with "signing services". Anyway, I found a writeup of the state of this approach from 2020 in "Communications of the ACM": "Securing the Boot Process: The hardware root of trust."

[@probablypablito]

Secure boot is super important, especially on mobile devices. On many Android phones (where it is called Verified Boot) it is often disabled when rooting the device. This means anyone with access to the phone can run any code they want, such as a bruteforcer for a PIN (assuming no hardware limiting) With it on, only updates/code signed by the registered private key can be used. This ensures that if someone steals your phone, your data & phone are fully inaccessible.

[@JamesR624]

_except as making Open Source bootloaders hard or impossible to use and disallowing tweaking/analyzing manufacturers firmware aka. "locking the system down like a Playstation", and maybe make money on the side with "signing services"._ That's exactly the only value proposition. It was a way for Microsoft to keep it's technically illegal monopoly and they sold it as a "security feature".

[@lainwired3946]

​@@probablypablitocelebrites various services show this doesnt reslly help though doesnt it. Samsung even have a bunch of knox tech and theyre one of the most vunerable.

[@Madinko12]

@@probablypablito This is not perfectly accurate. Though they achieve basically the same goal as you mentioned, AVB and Secure Boot are two completely distinct thing: most Android devices don't support UEFI which is needed for Secure Boot. Also, all SB/AVB "guarantees" is that you don't execute a bootloader that hasn't been signed by whatever keys are enrolled on the device. Once you've executed that bootloader, arbitrary code can be executed by other means. It's not much about bruteforcing: with physical access, one could extract your eMMC and try bruteforcing from there (as I don't think the master key is stored in a "secure device", correct me if I'm wrong though). You *should* be expecting RCE exploits on your phone anyways if someone has physical access to it: the safety of your full disk encryption should not rely on the ability of the attacker to execute arbitrary code on your device. However, SB/AVB prevents installing and executing a rogue bootloader that would, for example, keylog the decryption password when user unlocks the device.

[@mx338]

It really doesn't make open source bootloaders impossible at all, just load your own keys into the BIOS.

[@LetrixAR]

0:08 - That was your mistake

[@NatetheAceOfficial]

"I'm not even supposed to be here today!"

[@nomore6167]

@@NatetheAceOfficial It's sad how Smith decided to end Clerks III. I guess he finally wanted to put that franchise to bed.

[@somerandomchannel2669]

Good, secure boot is only good when you use your own keys, not ones made by people you don't even know

[@catcatcatcatcatcatcatcatcatca]

Well, it is there to authenticate the bootloader binary. And they wrote it. Arguably you want to check their private key at least before you would self-sign it, and had they not leaked their keys in a git-repo it would have been perfectly good way to verify the binary is written by the author it was supposed to be written by. How I see it is that when you use your own key, you have no way of actually knowing what you sign, as it is proprietary code. You can however sign a state you trust, to ensure that state hasn’t changed.

[@kellymoses8566]

It is perfectly reasonable and actually a good idea for a company to ship products with their trusted root key and use it to verify signed software upgrades. BUT they must protect the private key by using real hardware security modules which make leaking the private root key impossible but they are expensive and painful to use so many companies don't bother.

[@somesalmon5694]

You know you can resign or add another signature to the binary correct? If you remove the companies PK from secure boot you're not just blindly signing completely unknown code and there are open source bootloaders right?

[@test-rj2vl]

NSA really needs to learn not to leaks their secret keys.

[@vaikjsf34a]

@@Maxjoker98 now we know why they are the ones who hold the keys and not us :)

[@brettlaw4346]

@@Maxjoker98 This would be a plausibly deniable leak. Just try to remember, your government made an agreement with at least 14 other governments that they were allowed to spy on you as long as they "promise" to share the information they gather. I think we can *fingers crossed* be sure, that they aren't using that agreement for their own gain or sharing the information with US citizens inside the country with direct lineage to foreign intelligence so they can have an advantage in love, economics and war.

[@spicybaguette7706]

​@@Maxjoker98They might have one of Microsofts private keys. Or who knows, maybe they don't even need them...

[@moalboris239]

@@Maxjoker98 Honestly yeah the NSA is far more likely to show up and tell them they need their keys and here is their court orders for it. They don't really have a lot of need to be sneaky when they have government backing.

[@eadweard.]

I'm old enough to remember when Secure Boot was a Microsoft conspiracy to stop Linux.

[@throwaway6478]

To be fair, literally everything is a Microsoft conspiracy to stop Linux to certain groups. I've started calling it "Windows Derangement Syndrome", since the symptoms are so similar.

[@NJ-wb1cz]

@@eadweard. so, you're older than a few years?...

[@eadweard.]

@@NJ-wb1cz I am.

[@NJ-wb1cz]

@@eadweard. wow

[@eadweard.]

@@NJ-wb1cz Bar burpates.

[@RadikaRules]

I'm not even surprised, not because of what's been happening recently. But because I already knew secure boot really just means "Microsoft-approved boot OS" Was never about security, but having more control of the user's machine. Keeping out possible competition

[@NinjaRunningWild]

“Secure” in modern computing just means “safe for now”.

[@benhetland576]

No, it means "vendor remains in control of _your_ computer".

[@NinjaRunningWild]

@@benhetland576 Those two things aren’t mutually exclusive. Study formal logic.

[@benhetland576]

@@NinjaRunningWild Fair enough, but notice also that safe isn't the same as secure, and neither implies the other.

[@asailijhijr]

Buffalo

[@asdfghyter]

@@benhetland576 until they inevitably slip up, so every hacker in the world can use the vendors' backdoors

[@grimvian]

It's a bit funny to think of the computer, I started up with 40 years ago. The OS was in a ROM or EPROM and you had to replace the chip to change the OS. When rebooting NOTHING had changed, but now everything have to be updated all the time, but why do anything else than the OS need to have kernel access? Companies should not have the keys, it's just a matter of time, before something is exposed.

[@firewalldaprotogen]

i've had secure boot disabled for years, especially since the one hack that had something to do with it. just seems useless at this point

[@Madinko12]

Secure boot is useful, you just need to disable vendor keys and enroll your own.

[@COALEDasICE]

Secure boot protects important data, it's very useful.

[@arcaegecengiz]

The fact that a way to bypass secure boot has been found, and one or two viruses are designed to be able to do so does *not* mean that you're better off letting all other malware easily insert code at boot by disabling secure boot. Having it enabled doesn't affect you detrimentally in any way. Unless you use a custom unsigned Linux kernel, keep secure boot on. It's like disabling Windows Defender because some malware found a way to bypass it.

[@mx338]

That's a really bad fallacy in cybersec, just because there's ways to bypass some security measure doesn't mean that you shouldn't use it. Defence in depth is one of the most fundamental security principles.

[@Ferrari255GTO]

@@firewalldaprotogen more like insecure boot, amiright?... Right?... Yeah it wasn't that funny

[@J.erem.y]

If you dont control it, you dont own it. Its really as simple as that.

[@MZZenyl]

The PowerShell script isn't even going to work, it incorrectly uses ".:" (which isn't valid PowerShell code), when it should be "::", the static accessor operator.

[@RokeJulianLockhart.s13ouq]

Broken PowerShell scripts are par for the course. Somehow, scripted OOP breaks peoples' minds.

[@MZZenyl]

@@RokeJulianLockhart.s13ouq Yeah, being primarily designed with less tech-savvy, non-developer sysadmins in mind (hence the verbose verb-noun naming conventions of cmdlets), a lot of PowerShell scripts tend to be written quite poorly. And in this case, the script is essentially just a .NET API call, which could just as well be written in C#. But this is just straight up invalid syntax. The author of the article didn't even bother copy-pasting the script into the shell and executing it before publishing the article.

[@ZergRadio]

Is this correct? [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI PK).bytes) -match "DO NOT TRUST|DO NOT SHIP"

[@MZZenyl]

@@stefanalecu9532 Indeed, I do that regularly. Although in my experience, the code quality of C# code tends to be greater than that of PowerShell.

[@matteofalduto766]

password must have been "asdf"

[@susugar3338]

How do you know my password?😢

[@spookynutsack]

@@susugar3338 because you said it

[@smallSphere69]

How do you know my area's power station's controller's password? 😢

[@jalil2985]

I vote "test"

[@JoeJoeTater]

​@@jalil2985Yeah, given the content of the "Issuer" field, that seems pretty likely.

[@glarynth]

Thanks for coming in on your day off 👍

[@brianbrian5842]

OEM management: Hey we gotta make sure we offer secure boot just like our competitors. *Proceeds to distribute certificates insecurely*

[@jcdentonunatco]

Why does every motherboard manufacturer use the same private key? That sounds incredibly stupid

[@CMarxChako]

Probably part of the "UEFI Feature" standard...

[@JohnDoe-us5rq]

That took way longer than I expected, when they introduced that feature back in the days.

[@TheKeirsunishi]

Wonder how many mobos will not receive a firmware update as they are considered "deprecated"

[@tomschi9485]

*That's a stupid question: “how does this keep happening???” The answer is triaial: manufacturers can be grossly negligent in threatening customers and never have to take responsibility.* If it were otherwise, Dell, for example, would now be sued, e.g. with 10$ for each affected device. *I bet manufacturers would never define a standard router password 'admin/admin' again and they would take very simple measures to ensure that test keys would never be in productive systems again.* 🙂

[@marcusmeaney]

wtf is a secure boot. i use arch btw

[@buddinglearner7085]

lmao

[@darrennew8211]

A secure boot ensures the part of the bootloader that prompts you for your encryption key to unlock the encrypted boot drive hasn't been replaced with code that steals your password.

[@itsTyrion]

@@darrennew8211 nope

[@darrennew8211]

@@itsTyrion Yep. Secure boot is designed to protect all the parts of the operating system that aren't protected by the OS authentication systems. I.e., it protects everything you can get to without a password. In theory.

[@PokeRuto898]

​@@darrennew8211Secure Boot doesn't encrypt anything. TPM does. Secure Boot itself only lets verified code run at boot. This prevents evil maid attacks such as modifying the bootloader to put a keylogger on it and steal the encryption key.

[@kellymoses8566]

It is perfectly reasonable and actually a good idea for a company to ship products with their trusted root key and use it to verify signed software updates. BUT they must protect the private key by using real hardware security modules which make leaking the private root key impossible but they are expensive and painful to use so many companies don't bother.

[@MandenTV]

Anti-tech movement making moves.

[@redwind3475]

"My video rate is going up because guees the world is on fire." should be the tagline of all of KZbin at this point 😂😂😢

[@igorordecha]

Remember: this doesnt affect you if you dont use secure boot in the first place

[@faares_]

i don't completely understand secure boot and what its associated with (if its just a windows thing or a motherboard thing) but if i get mint linux will i neeed to worry

[@moneyluser5711]

Secure boot is NOT a good thing because it is centrally managed by extremely untrustworthy corporations.

[@junzhengca]

I mean, same goes for HTTPS, you need a central list of trusted CAs. Better than not having it, plus, you can turn it off.

[@ozzieggg]

you can roll your own keys

[@RokeJulianLockhart.s13ouq]

​@@junzhengca I agree, but I trust ICANN more than I do Dell.

[@lbgstzockt8493]

Is there any evidence of this actually being bad or is it just more conspiracy and fearmongering by people who would force me to use Linux at gunpoint?

[@threepe0]

@@junzhengca no you absolutely do not.

[@XerrolAvengerII]

that secure boot isn't actually secure is the least surprising revelation tbh

[@user-to7ds6sc3p]

@@XerrolAvengerII Well it is, until it isnt'.

[@roguegryphonica3147]

It just seems like branding right now... pepsi is really just flavored carbonated water... secure boot is really mostly secure until it isn't.

[@SanguinariusUmbra]

Secure boot is secure as long as you: 1. enroll your own keys, and 2. aren't being threatened by a state actor. This problem is caused by irresponsible manufacturers who don't know how to do proper secret management, not by broken secure boot implementations

[@eitantal726]

Not your keys, not your hardware

[@emjizone]

That's why you should never buy any computer with a firmware and design, code and deploy the boot, kernel and OS yourself, deciding by yourself how to interpret and possibly execute every single software you get access to. Same for your car: you don't design the fuel you put in it, you don't decide of the design of the airbag: nothing but ownership issues ! Build you car yourself from raw mineral : THAT is ownership and security ! 🤣

[@spicybaguette7706]

​Imagine if your manufacturer had the key to your car (or, more accurately, a key that opens all the same models of that car) and someone just carelessly leaves it somewhere in public. And I have to argue, you only truly own your device when you've manufactured all the chips with your own billion dollar fab of course

[@AetherStreamer]

@@emjizone There is a big huge jump from _having the only and only keys of your own vehicle,_ to "building it yourself from raw minerals". Your analogy is just plain bad and wrong.

[@thesenamesaretaken]

​@@emjizoneCringe take

[@mixit247]

Honestly nobody in those corporations gives a shit as long as the money keeps on rolling in.

[@XenXenOfficial]

The year of CyberPunk 😅🤣

[@whtiequillBj]

This feels like it's just one thing after another this year.

[@eugenej.5584]

00:33 "slow learning channel" :D

[@666samurai_]

“if you’re a freak and use power shell” took me out

[@wlockuz4467]

PR Changeset "abcd" -> "abcde" _Increased password entropy for encrypting the private key_

[@RealTNSEE]

If they have access and admin rights to the machine to mess with secure boot... the house is on fire already. This just adds to the pwnage, but isn't the root cause of it.

[@sloppydoggy9257]

Automation prevents human mistakes, but automation eventually breaks and when it does it reproduces the same mistake on every unit. This is an expected kind of issue. It will come back again some day..

[@yoshi314]

from one article "For reasons that aren’t clear, the test keys made their way into devices from a nearly inexhaustive roster of makers" LAZINESS.

[@dono42]

The PowerShell command has a typo in it. It should be double colon (::) rather than dot colon (.:) before the ASCII.GetString.

[@rashidisw]

The problem rooted in the wish to do away with READ ONLY chip and TOTALLY replace it FLASHABLE chip. The wish were granted but it has the consequences!

[@Peekofwar]

The problem with 2FA from what I've heard, is that many sites that use it require you to have a less secure 2FA option enabled, and it's a this OR that approach instead of this AND that. Meaning the more-secure option is not making the account more secure when an attacker only needs to attack the less secure 2FA, for example SIM swapping or something.

[@mjmeans7983]

You can bet state actors aren't happy that someone is shining a light on a bypass that has existed for years.

[@Iceman259]

It’s crazy that the channel blew up so big that he had to change his name to Ed

[@GeorgeNoiseless]

Wow, Gigabyte is winning this one with the largest number and variety of compromised devices! Intel/AMD/ARM Server boards, full Rackmount Servers, Mini-PCs... At this point I'm downright impressed by Gigabyte's consistency in upholding their poor reputation.

[@reymalik1023]

Disabled secure boot to install arch a while back and forgot to turn it on again, totally forgot about it's existence till now

[@JohnnyLin-z8u]

UEFI never fails to fail

[@rekall76]

is UEFI now synonymous with RBMK ? 🤔☢️

[@icybrain8943]

UEFI was also the password

[@wargreymon2024]

Looks like you have more juicy content to come in this year 😁

[@SpeedUpThatComputer]

This is why we need a non-flashable bios. It would solve the problem. However it does make a new problem. You can't update the microcode to fix issues things like the CPU.

[@namenlosNamenlos]

How many years since defected products to stop preventing secure boot???......... 🤔

[@hotnikq]

THE ONLY THING I CAN HEAR FROM THIS VIDEO IS: please make a cpu mod to enable cores , please make a cheat for this game , please make a overclock mods , please make a custom bios , please make extra cpu support for this platform

[@teleprint-me]

A basic rule in cryptography is to always verify and never trust. This is why you should always be allowed to generate your own keys and only you should have a private key. Centralized 3rd parties are alwats going to be a major vulnerability.

[@markustieger]

Or you just take control of your secure boot and put your own platform key in there. (Yes you can do that)

[@somesalmon5694]

People saying secure boot doesnt make anything more secure and that its a proprietary stack that the user has no control over don't know what or how secure boot actually works. The user can reset, remove or distrust whatever keys they want and create their own to replace the Microsoft and oem keys to have full control over which signed binaries are allowed at boot

[@BitwiseMobile]

DAMNIT! I ALWAYS do this. I come up with an idea as a prototype/proof of concept. Once I prove my hypothesis I pretty much shelve it. The last thing I worked on two years ago was an SSO dongle very similar to this YubiKey thing. I went super paranoid and used biometric - fingerprint - in order to access it. That way it had 2FA built in - something you are, and something you have. Your fingerprint is something you are - it's unique to you and nobody else can take it from you. The device is something you have, and it can physically be taken from you. Edit: Forgot to mention it was built around a Pico Pi for the prototype. Those are like $4 boards with a custom M0 Cortex chip called an RP2040 which is the microcontroller in the Raspberry Pi ecosystem. It can run MicroPython which makes writing the application code dirt simple and pretty safe as well. Writing native C can introduce memory bugs that could be exploited.

[@asificam1]

There is now a project developing an open source U2F dongle (part of what the yubikey does)... tricky part is getting a dongle that works U2F and SSH and GPG... and now they want us to use discoverable device resident crednetials called Passkeys which used to be called Password-less FIDO2 discoverable credentials. I dislike device resident creds for so many reasons including these dongles have VERY limited key storage space, and also U2F uses the same math and has same security as Passkeys but lets the host store a wrapped key (only the correct U2F dongle can decrypt the secret portion with its master key) which means they can be used for an unlimited number of logins on unlimited website (literally unlimited), but also an attacker with your key has to first find by trial and error which account that key opens and where... discoverable credentials are less good because the attacker now has the key and a list of what it opens... bypass the PIN (If one was set anyhow) and you're in.

[@notafbihoneypot8487]

A day in the life: Wakes up 😊 Gets lower level learning notification: 😊 Sees title 😮 Watches vid :/😢

[@Wampa842]

god fucking dammit that is at least 400 computers I'm responsible for that I'll have to check

[@brianbrian5842]

Sure the OEM(s) used secure boot certificate technology during manufacturing but they did so in a way that effectively undermines the whole reason to be implementing secure boot in the first place. OEM managers were probably non technical and saw secure boot as no different as any item on a checklist. "We have it? Okay good". Secure boot needs to be managed directly by sometime who has a technical understanding of securely distributing security certificates and the importance of doing so SECURELY.

[@davidf6592c]

Hey man, love your work. Important question, I stumbled on this video, the day before I got a gigabyte B450M delivered. I opened the box containing all the components for my PC build to find all the components were factory sealed, except the motherboard. Of course, after watching this video, I'm paranoid. So I enquired with the supplier and the Gigabyte local representatives as well and I'm shocked to learn that the boxes are not necessary "factory sealed". This just seems absolutely bonkers, the supply chain from the manufacturer to consumer have just accepted that it's ok for this low level (again, lover the channel 😉) and vulnerable component to not be sealed. I think you should dive into this with an investigation, and call it out.

[@virkony]

Just create a ring of root authorities owned by different entities. Require all of them to agree so even if one is compromised, you still can't bypass "the ring".

[@luketurner314]

Four character password on the platform key be like, "You're the head of security and your password is 'password'?!" - Spider-Man: Far From Home

[@not-underscore]

And windows 11 requires secure boot to be enabled 😂 So much for security ,no?

[@fmoessbauer]

Embedded dev working on Secure Boot(SB) here: Correctly integrating secure boot is absolutely non trivial (esp. on non x86 devices). But my biggest concern is about people who are told to „enable secure boot on that device“, but who don’t understand how it works. For testing, test signatures are added to the db, but forgotten to be removed when shipping. In CI/CD pipelines the signing is done, but it is not carefully checked who can run the pipeline. Then there are signed recovery shells (used to recover broken devices), but with root access (making SB basically pointless). As said, it’s not so much about the technology, but about people using but not understanding it.

[@SimonBuchanNz]

And then all the clueless weniees blame Microsoft, just like with CrowdStrike.

[@hyamamoto2000]

I designed offline signing procedures for financial institutions. Damn if the devices are on the list, we might need to renew many of them (I'll physically destroy and blend them all) and get them re-audited by third parties >.> I'm also curious that Chromebooks' keys are safe. Those are securebooted linux.

[@blonkasnootch7850]

It happen when ever sales go down and new hardware have to be sold 😂

[@coreC..]

quote: "What secure boot is supposed to be..." That sounds scary already :)

[@jama5424]

"And then I opened up twitter" Day ruined

[@thedapperfoxtrot]

Four character password: 1234 ...that's something an idiot would put on their luggage. "Honey! I'm ordering new luggage!"

[@attilao]

I thought most folks would use their own certificate authority for secure boot. Why would I trust a public CA if I don't have to? The main use case for public CAs is certificate distribution, e.g. for TLS over the public internet. Moreover, anyone who is self-signing their UKI would have to replace the CAs on the board - which I thought was basically everyone except maybe Windows users.

[@bjorntorlarsson]

Wouldn't it be the height of irony, if he makes his next video on the Youbico hack...?

[@marcellkovacs5452]

4:32 "OEM manufacturer" = original equipment manufacturer manufacturer

[@sparcnut]

This message brought to you by the Department of Redundancy Department.

[@shoego]

Security by obscurity AGAIN?

[@jan_en_ik]

That is most cyber security. as long as someone doesn't have the key/password your safe enough but, if the secret gets leaked Pandoras box is opened.

[@throwaway6478]

Most encryption works by the keys not being known by everyone - that is, obscurity.

[@drdca8263]

@@throwaway6478No, “the adversary doesn’t know the keys” is *not* “security by obscurity” . “Security by obscurity” is when the security is based on adversaries not knowing how the system works, and is *specifically in contrast to* security based on adversaries not knowing the secret keys.

[@SBlazeable]

this isn't security by obscurity this is security by password authentication with a stupidly low amount of bits of entropy so it was easy to crack security by obscurity is when you use a reversible, simple cypher such as the alphabet +2 where A=C B=D and so on, or you hide passwords by checking the "show hidden files" box to unchecked or you take the first half and append it to the second half so ABCD becomes CDAB, THAT'S obscurity

[@Sylvan_dB]

Once you conflate "obscurity" with "secret" you realize that all security rests on a foundation of secrets, or obscurity.

[@linuxguy1199]

Secure boot was never meant for security, the only reason it exists is to make it more difficult for people to install Linux on budget Windows laptops which incentivizes them to buy a new laptop after a year or two when Windows automatically upgrades requiring double the RAM that was soldered onto your laptops motherboard.

[@DNFINST]

Oh i was scared for a second. I turn that shit off.

[@n8works]

Tech people should unionize and demand fair compensation for the value we've created over the last 50 years. We are in the power position right now. If we don't work, none of this shit gets fixed.

[@eNNercY]

if none of you worked, stuff like that wouldnt happen

[@JonMurray]

Thanks man, great video. New subscriber ✌🏻

[@williamdrum9899]

Imagine if every car exploded like the Ford Pinto. That's what this feels like

[@monad_tcp]

0:27 good, very good, the architecture is open and free still !

[@claycassin8437]

No MSI. Whew. Dodged that one.

[@cariyaputta]

Secure Boot sounds funny. When the biggest security threats are closed source code themselves.

[@defnlife1683]

"What if we blame C again?" - Rustaceans, probably.

[@RaminOhebshalom]

Thank you

[@kellymoses8566]

root private keys must only be generated in Hardware Security Modules where the key CANNOT be exported in plaintext. Even Azure didn't adhere to this rule and had a SAML signing key leaked in a memory dump.

[@ThePlayerOfGames]

Funnily enough, it's wherever Microsoft gets seriously involved that we get a massive security flaw.

[@juanmacias5922]

1:16 he said the thing! :D

[@PGW90RU14]

Hi. If I remember correctly, TPM key should be generated by TPM itself. I'm not sure that "platform key" in this article means TPM key. If so, how the predefined key was embedded in TPM? TPM should generate its own Private/Public RSA key pair by itself at initialization phase so I guess that theoretically each TPM has its own key pair. On the other hand trusted certificates stored in NVM (BIOS) are defined by some organizations.

[@advaithmadhukar2609]

This is correct. You can generate your own set of secure boot keys and if your motherboard isn't shit enroll it into your firmware

[@vlaydn]

just checked on my laptop to see if I have one of those do not trust pk's ( i don't know anything about coding or IT so i'm just following the steps people show in the video), turns out it is indeed one of these which have this vulnerability, wtf do I do now? pray that no one hacks into my PC? I will probably buy a new one but how do I know that's not compromised as well?

[@ghostlyjester5080]

none of those cammands work and im not sure why

[@andrewwilson7169]

Hi. Presumably, the most secure way to use Secure Boot is to use your own keys. Of course, this will also be the least convenient way to use Secure Boot, but at least it then will be SECURE?

[@易利亚]

So does this mean they want us to purchase a newer device and throw out our old device? Imagine have 14th intel and these motherboard... We know its a bomb, but cant defuse it