News for hackers. Stuff that matters.

A comment on Authenticated Boot and Disk Encryption on Linux. Parent comment

Re:Authenticated Boot and Disk Encryption on Linux by smoldesu on Thursday September 23, 2021 @02:17PM (#28632960)
> If your attacker is both sophisticated and able to access your hardware directly, the game is over; nothing we can do can currently avoid this.

This, particularly if your hardware has Thunderbolt capabilities. It's been proven that Thunderbolt can be exploited to give an attacker direct memory access[0], and there's really no recourse for it in the spec. Physical access is going to be game-over for a very long time, unfortunately.

[0] https://thunderspy.io/#affected-apple-systems

[ Parent | on HN ]
Re:Authenticated Boot and Disk Encryption on Linux by mjg59 on Thursday September 23, 2021 @03:02PM (#28633660)
> there's really no recourse for it in the spec

There's not only a recourse for it, modern firmware implements it. You just use the IOMMU to restrict Thunderbolt devices to being able to access their own buffers.

[ Parent | on HN ]