News for hackers. Stuff that matters.

A comment on Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2. Parent comment

Re:Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2 by sseveran on Friday June 22, 2012 @02:23PM (#4148012)
Flame used a prefix collision attack that had not been seen before. The concept was demonstrated a couple of years ago but the attack itself was novel.

http://arstechnica.com/security/2012/06/flame-crypto-breakth...

[ Parent | on HN ]
Re:Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2 by beagle3 on Friday June 22, 2012 @03:28PM (#4148335)
While that's true, what enabled Flame to use that to sign code was a chain-of-trust mistake as nl pointed above -- and there's no guarantee that such chain-of-trust mistakes will not happen in the future.
[ Parent | on HN ]
Re:Ubuntu's Plans To Implement UEFI SecureBoot: No GRUB2 by sseveran on Sunday June 24, 2012 @07:45PM (#4154549)
Chain of trusts always require the chain to be secure. In fact there will undoubtedly be future chain of trust attacks on certificates.
[ Parent | on HN ]