Practical security for 2014 [LWN.net]

Practical security for 2014

Posted Jan 11, 2014 4:30 UTC (Sat) by drag (guest, #31333)
In reply to: Practical security for 2014 by ssmith32
Parent article: Practical security for 2014

I don't see anything less then requiring to move a jumper to make a portion of a flash drive read-write should be required.

Making this sort of thing update-able from a browser pretty much completely defeats the purpose of having secure boot in the first place.

to post comments

Practical security for 2014

Posted Jan 11, 2014 4:34 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link] (3 responses)

> I don't see anything less then requiring to move a jumper to make a portion of a flash drive read-write should be required.

In most cases it's usually a keypress immediately after the cold reboot. That's not as resilient as a jumper, but still pretty secure.

Practical security for 2014

Posted Jan 11, 2014 4:53 UTC (Sat) by drag (guest, #31333) [Link] (2 responses)

Just as long as it can't be done via software is really the most important part.

But nothing beats physically disabling the ability of the computer to write to flash when it comes to making sure that nothing writes to flash without your permission. :)

Practical security for 2014

Posted Jan 11, 2014 5:17 UTC (Sat) by tnoo (subscriber, #20427) [Link] (1 responses)

Sure, as long as the flash drive or the system's software really honors this jumper setting. Like, for example, CHDK on Canon cameras uses the storage card lock slider to indicate whether the firmware should be loaded from the card on bootup. If so, the camera writes the images to the locked storage card.

The situation might be still worse with flash drives which contain full microcontrollers doing all kinds of elaborate calculations, and thus are likely to be hackable as well.

Practical security for 2014

Posted Jan 17, 2014 10:05 UTC (Fri) by robbe (guest, #16131) [Link]

> The situation might be still worse with flash drives which contain full
> microcontrollers [...]

Every storage device since at least 2000 (including "simple" cards) includes controllers sufficiently complex to host malware.

See for example http://www.bunniestudios.com/blog/?p=3554