News for hackers. Stuff that matters.

A comment on QEMU Advent Calendar: A surprise disk image each day until Christmas. Parent comment

Re:QEMU Advent Calendar: A surprise disk image each day unti... by LeonM on Monday December 03, 2018 @10:58AM (#18589680)
> What does https buy you in this case ?

It ensures the response from the webserver really is from netboot.xyz, and not from any mitm server.

> It does not prevent server spoofing attacks (as in attackers changing the code you boot) in 99% of situations. Nor man-in-the-middle protection ...

Can you elaborate? How would you spoof the server response without having a valid certificate key for the netboot.xyz domain?

[ Parent | on HN ]
Re:QEMU Advent Calendar: A surprise disk image each day unti... by gsich on Monday December 03, 2018 @01:59PM (#18591754)
For this to work trusted CAs need to be compiled into the iPXE binary. Since those can change you'll need to update that binary from time to time. Or ignore cert warnings, which reduces the security to plain HTTP.
[ Parent | on HN ]
Re:QEMU Advent Calendar: A surprise disk image each day unti... by kpcyrd on Tuesday December 04, 2018 @10:26AM (#18600208)
>> server spoofing attacks (as in attackers changing the code you boot) > Can you elaborate?

I think this is referring to the server being compromised. This isn't something that can be solved easily because while the bootloader could include signify[1] to verify its downloads, the bootloader itself can't be verified with anything. (disclaimer: I don't know very much about iPXE)

https://www.openbsd.org/papers/bsdcan-signify.html

[ Parent | on HN ]