reminder: July24th: UEFI Forum’s first security webinar

July 16, 2018 ~ hucktech ~ Leave a comment

Michael Krau, Industry Communications Working Group Chair
Eric Johnson, American Megatrends, Inc.
Tim Lewis, Insyde Software
Dick Wilkins, Phoenix Technologies
Vincent Zimmer, Intel

The panelists will outline the major challenges currently facing platform security, how the UEFI Forum and UEFI specification address these challenges and finally, how you can join us in the battle to protect firmware from outside threats. The webinar is open to the public and attendees will get the chance to participate in a live Q&A session.

http://www.uefi.org/node/3877
https://register.gotowebinar.com/register/3708207810278601474
https://www.gotomeeting.com/webinar/join-webinar

UEFIrand: Entropy visualization example using RDRAND

July 14, 2018 ~ hucktech ~ Leave a comment

UEFI application. Entropy visualization example. Use RDRAND instruction.

https://github.com/manusov/UEFIrand

Pentecost UEFI: we estimate the security of UEFI firmware with CHIPSEC

July 12, 2018 ~ hucktech ~ Leave a comment

https://twitter.com/yeggorv/status/1016438496641216513

https://xakep.ru/2018/07/09/uefi-pentest/

https://translate.google.com/translate?hl=en&sl=ru&u=https://xakep.ru/2018/07/09/uefi-pentest/

IBM: UEFI fixes for Spectre variants 4 and 3a (CVE-2018-3639 CVE-2018-3640)

July 12, 2018 ~ hucktech ~ Leave a comment

https://twitter.com/micsieg/status/1017402630606290944

https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-has-released-unified-extensible-firmware-interface-uefi-fixes-in-response-to-spectre-variants-4-and-3a-cve-2018-3639-cve-2018-3640/

Apple macOS 10.13.6: UEFI SecureBoot support for iMac Pro

July 10, 2018 ~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2017/12/13/apple-secure-boot/ and https://firmwaresecurity.com/2017/12/20/apple-kb-article-on-secure-boot/

there is more info on Apple Secure Boot:

macOS 10.13.6 update brings (limited) UEFI SecureBoot support for iMac Pro, so now if SecureBoot is enabled, Windows detects that and acts accordingly.

PK, KEK, db and dbx are read-only (hence limited), configured to trust MS 1st-party CA only. pic.twitter.com/M81xcJB1RG

— Nikolaj Schlej (@NikolajSchlej) July 9, 2018

UEFI CA is used to sign many things, none of which is supported.
We don't trust MS 1st-party by default too, BootCamp needs to be used to enable that first.

— Nikolaj Schlej (@NikolajSchlej) July 10, 2018

Send a bug report (https://t.co/NLzOFixGG7) stating that you need SecureBoot support for custom keys and/or 3rd-party OSes.

Right now the only way out for such OSes is to disable SecureBoot.

— Nikolaj Schlej (@NikolajSchlej) July 10, 2018

https://support.apple.com/en-us/HT208864
https://support.apple.com/en-us/HT208937

Anti-Evil Maid with UEFI and Xen

July 9, 2018 ~ hucktech ~ Leave a comment

Slides of our recent @platformsec talk: Anti-Evil Maid with UEFI and Xen https://t.co/hi3V0gWHE5

— Tamas K Lengyel (@tklengyel) July 6, 2018

https://docs.google.com/presentation/d/1bJP1I74MjmXdlxxG6MDdipa5bZ9KFyLbcJ5hG2NIAjA/edit#slide=id.g399aaa7d14_8_89

CVE-2017-3197: GIGABYTE UEFI security problems

July 9, 2018 ~ hucktech ~ Leave a comment

What’s this? No more info, but it almost looks like someone at MITRE ran CHIPSEC against a GIGABYTE box and found some failures, so assigned a CVE. Too bad MITRE doesn’t have boxes from ALL OEMs. Maybe this is something more than simple CHIPSEC failures, but the CVE omits details…

GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_BWP, and PRx features. As a result, the BIOS is not protected from arbitrary write access and may permit modifications to the SPI flash.

https://nvd.nist.gov/vuln/detail/CVE-2017-3197

An Attempt to port linuxboot to Dell Latitude E7240

July 5, 2018 ~ hucktech ~ Leave a comment

An Attempt to port linuxboot to Dell Latitude E7240 https://t.co/JhW01Yoeq2 #coreboot #linuxboot

— Hardened-GNU/Linux (@hardenedlinux) July 5, 2018

https://twitter.com/qrs/status/1014805759819907072

https://github.com/hardenedlinux/Debian-GNU-Linux-Profiles/blob/master/docs/hardened_boot/linuxboot-attempt.md

https://github.com/linuxboot/linuxboot/issues/31

Super Mario Bros (NES emulator) ported to UEFI

July 3, 2018 ~ hucktech ~ Leave a comment

NES emulator on the UEFI Shell running Super Mario Bros.https://t.co/VgmYAjQGoQ

— Nicolas Krassas (@Dinosn) July 3, 2018

David Lee has apparently ported a NES emulator — without sound — to UEFI, but source code is not apparently available:

I used EDK II framework.
About the keyboard input, Program reads the value from 0x60 port directly because of multi-key input processing.
I measure the timer count twice(for 1sec) by using the rdtsc instruction to make game delay more accurate.
I didn’t implement the audio output.

efiboot-rs: efivar and efiboot UEFI tools in Rust

July 1, 2018 ~ hucktech ~ Leave a comment

This repository contains the source code for:
* efivar – A Rust crate to read and write EFI variables
* efiboot – A command-line tool to manage the UEFI boot manager

https://github.com/vtavernier/efiboot-rs

Ubuntu: DKMS modules need to be configured to work with UEFI Secure Boot

June 29, 2018 ~ hucktech ~ Leave a comment

I just noticed this nice document on Ubuntu security features, maybe it is new, maybe I never noticed it before:

https://wiki.ubuntu.com/Security/Features#secure-boot

I also notice this page, which I believe has recently been updated:

DKMS modules need to be configured to work with UEFI Secure Boot

Ubuntu is now checking module signing by default, on kernels 4.4.0-18.34, 4.4.0-21.37, 4.2.0-42.49, 3.19.0-65.73 and 3.13.0-92.139 onwards. You can read more details in this bug in Launchpad. Because of those changes, DKMS modules will not work on systems with Secure Boot enabled unless correctly configured. In order to make DKMS work, Secure Boot signing keys for the system must be imported in the system firmware, otherwise Secure Boot needs to be disabled. There are several methods to configure your system to properly load DKMS modules with Secure Boot enabled.

https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1566221

Apple: periodic reminder: set your firmware password

June 29, 2018 ~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2018/05/02/apple-set-your-firmware-password/

periodic reminder: If you care about pre-OS security, you should set a firmware password on your Mac. "sudo firmwarepasswd -setpasswd" in Terminal, or from the GUI in the recovery OS: https://t.co/k9PY6EvnpO

— Xeno Kovah (@XenoKovah) June 29, 2018

Something you can't do from the GUI that you can do from CLI is set it so that it asks for the password *every* boot (even the ones where you're not changing your boot target): "sudo firmwarepasswd -setpasswd -setmode full"

— Xeno Kovah (@XenoKovah) June 29, 2018

https://support.apple.com/en-us/ht204455

Conan for UEFI??

June 27, 2018 ~ hucktech ~ Leave a comment

An open source, secure, vendor-neutral, pre-OS packaging tool for updating platform microcode and firmware might be interesting. So when I saw this UEFI test app:

https://github.com/matlo607/uefi-test

it was interesting to note that it includes some support for the Conan C/C++ packaging tool for UEFI, eg:

https://github.com/matlo607/uefi-test/blob/master/conan-recipes/edk2/conanfile.py

I’ve no time today to study it closely, so I’m unsure if it is using conan as an OS-present tool, or it has conan running as a pre-OS UEFI app. Big difference! 🙂

Conan is a C/C++ packaging tool. The official docs don’t mention UEFI support:

Conan can be installed in many Operating Systems. It has been extensively used and tested in Windows, Linux (different distros), OSX, and is also actively used in FreeBSD and Solaris SunOS. There are also several additional operating systems on which it has been reported to work. […] Conan works and is being actively used on Windows, Linux (Ubuntu, Debian, RedHat, ArchLinux, Raspbian), OSX, FreeBSD, and SunOS, and, as it is portable, it might work in any other platform that can run python. In the documentation, examples for a specific OS might be found, such as conan install . -s compiler=”Visual Studio”, which will be specific for Windows users. If on a different system, the reader should adapt to their own platform and settings (for example conan install . -s compiler=gcc). […] Also conan works with any build system. In the documentation, CMake will be widely used, because it is portable and well known. But conan does not depend on CMake at all; it is not a requirement. Conan is totally orthogonal to the build system. There are some utilities that improve the usage of popular build systems such as CMake or Autotools, but they are just helpers. Furthermore, it is not necessary that all the packages are built with the same build system. It is possible to depend on packages created with other build system than the one you are using to build your project.

https://github.com/conan-io/conan
https://conan.io/

PS: Above project uses CMake, and Conan supports CMake. And there’s also this CMake/UEFI project, but appears to not be native UEFI use of CMake:

UEFI VirtualBox tutorial

https://github.com/eruffaldi/uefiboot
http://teslacore.blogspot.com/2016/02/starting-with-uefi-with-cmake-and.html

shimdemo: UEFI PXE + shim transparent loader demo

June 25, 2018 ~ hucktech ~ Leave a comment

This is a simple proof of concept illustrating the use of shim (with the transparent loader enhancements) to load iPXE, which in turn boots an operating system.

https://github.com/ipxe/shimdemo

cPlusPkg: UEFI BIOS C++ package

June 22, 2018 ~ hucktech ~ Leave a comment

https://github.com/open-workspace/uefi-bios

uefi-bios C++ package

Projet PXE UEFI avec iPXE

June 21, 2018 ~ hucktech ~ Leave a comment

https://github.com/itsAgb/ipxe

Title contains all of the documentation. Bluntly, I’m not sure what this does, I’m not great at PXE and iPXE. Amongst other things, here’s an ipxe.efi, but no source code, so this is NOT open source, be careful. I have no time to dig further…

EFI3M: EFI Multi-boot Menu Maker

June 20, 2018 ~ hucktech ~ Leave a comment

EFI3M builds a Multi-boot menu for computers with an EFI firmware. The menu will be displayed when booting the computer and allows the user to start any of the installed system from its EFI boot loader: not only Linux distributions, but also BSD distributions, Microsoft Windows, Apple OS X, pretty much any system that has a boot loader in an ESP (EFI System Partition) on any drive of the computer, be it a hard disk, a SSD, a NVMe, whatever. The multi boot menu is installed in an internal ESP as /EFI/efibootmenu/BOOTx64.EFI alongside its configuration file grub.cfg and also, optionally, in /EFI/BOOT/ which is the fall back directory looked at by the firmware, if it is not not already busy. It can also be installed on an USB stick, to allow booting any installed system if for some reason booting would otherwise fail.

https://github.com/DidierSpaier/EFI3M