Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2

Re:Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2 by wmil on Friday June 22, 2012 @11:49AM (#4147268)

I don't see how. Flame managed to create signed malware with an MD5 prefix attack... but MD5 had known problems for over 10 years.

And Flame is widely thought to have been produced by a government intelligence service -- it still takes massive talent and CPU time to do something like that.

I'm not aware of any MS private key ever being leaked or cracked.

There will be weaknesses in specific UEFI implementations, but I don't think they'll be able to produce anything general purpose.

[ Parent | on HN ]

Re:Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2 by nl on Friday June 22, 2012 @12:15PM (#4147404)

I think the point was that Flame was signed with a Microsoft key.

It's true that key shouldn't have been trusted for what it was used for, and that the MD5 attack basically elevated the rights of the key, but the parent's point isn't 100% wrong (nor is it 100% right..)

[ Parent | on HN ]

Re:Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2 by sseveran on Friday June 22, 2012 @02:23PM (#4148012)

Flame used a prefix collision attack that had not been seen before. The concept was demonstrated a couple of years ago but the attack itself was novel.

http://arstechnica.com/security/2012/06/flame-crypto-breakth...

[ Parent | on HN ]

Re:Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2 by beagle3 on Friday June 22, 2012 @03:28PM (#4148335)

While that's true, what enabled Flame to use that to sign code was a chain-of-trust mistake as nl pointed above -- and there's no guarantee that such chain-of-trust mistakes will not happen in the future.

[ Parent | on HN ]

Re:Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2 by sseveran on Sunday June 24, 2012 @07:45PM (#4154549)

Chain of trusts always require the chain to be secure. In fact there will undoubtedly be future chain of trust attacks on certificates.

[ Parent | on HN ]