News for hackers. Stuff that matters.

A comment on TPM GPIO fail: How bad OEM firmware ruins Intel TPM security. Parent comment

Re:TPM GPIO fail: How bad OEM firmware ruins Intel TPM security by kukrimate on Thursday June 06, 2024 @11:48AM (#40598849)
No.

But on essentially all existing UEFI systems you can trivially overwrite the "db" keystore in flash and install anything you please.

Also most (all?) UEFI systems are not locked to Windows and allow customizing the keystore via the firmware console interface anyhow.

[ Parent | on HN ]
Re:TPM GPIO fail: How bad OEM firmware ruins Intel TPM security by Foxboron on Thursday June 06, 2024 @12:10PM (#40599127)
> Also most (all?) UEFI systems are not locked to Windows and allow customizing the keystore via the firmware console interface anyhow.

All of them.

The Secured Core machines still allows you to reset Secure Boot into user mode as mandated by the spec.

[ Parent | on HN ]
Re:TPM GPIO fail: How bad OEM firmware ruins Intel TPM security by josephcsible on Thursday June 06, 2024 @09:51PM (#40604550)
Isn't this only true of x86 ones, not ARM ones?
[ Parent | on HN ]
Re:TPM GPIO fail: How bad OEM firmware ruins Intel TPM security by Foxboron on Friday June 07, 2024 @06:40AM (#40607262)
If ARM implements the UEFI specification then there are escape hatches to enroll your own PKI.

I don't own ARM machines with UEFI so I have no clue.

[ Parent | on HN ]