these leaks are getting ridiculous...

Secure Boot is great. Private keys leaked on Github? Not so great.

Writeups:

🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒

🔥🔥🔥 SOCIALS 🔥🔥🔥

[JamesR]

- AT&T Data Breach
- Crowdstrike Update Crash
- CPU Predictive Processing Bypass
- Intel CPU 100% Failure Rate Bug
- Secure Boot Bypass
Man, this month has NOT been a good month for computers and security.

[pwnmeisterage]

It's annoying that all these sites report "the vulnerability affects 200+ motherboards from the big OEMs" but nobody has a compiled list of exactly which motherboards are affected and which are not.
You can test your motherboard. You can't test the one in the store.

[f.andersen]

"Don't trust it. Do not ship!"
Did it get shipped? Hell ya! ☠️

[AshnSilvercorp]

"proprietary" and "security" really shouldn't be in the same sentence anymore...

[jorgelotr]

The powershell command doesn't work as given. Where it has '.:' between the right bracket and 'ASCII', it should say '::'. Also, 'True' is the response you should get if you are compromised ('False' means you are not, while an error message saying GetSecureBootUEFI is undefined means you don't have SecureBoot activated).

[neilbrookins]

Don’t worry guys, if someone guesses our 4 character password we will just change it to a new 5 character long password. And just in case this change is needed under short timeframe we will all agree in advance that the fifth character is a “1” and we will reuse the first four characters to make it easy to remember.

[thewalrusdragon]

Think it’s a coincidence that tech layoffs are at a high and at the same time stuff like this is happening every other day now?

[test-rjvl]

Expectations: Viruses gonna bypass secure boot.
Reality: Game cheaters gonna bypass secure boot that anticheats require these days.

[Fedor_Dokuchaev_Color]

Disabled secure boot because my Linux Distro wasn't working with it.

You don't fear secure boot issues if you disable it 😊

[lezbriddon]

Anyone else here old enough to remember flashing bios by physically removing the bios chip, UV erasing it and then re programming it, now THATS security.

[somerandomchannel]

Good, secure boot is only good when you use your own keys, not ones made by people you don't even know

[eeka_droid]

Thanks for bringing awareness on the subject Ed, it led me to double check my secure boot settings.
People are questioning the effectiveness of secure boot after this issue but what they're failing to realize is that this is a "~200 devices affected" kind of thing rather than "all devices from 200 manufacturers affected", there's a huge difference.
Thankfully my device is not compromised at this time.

[SterileNeutrino]

I never understood the value proposition of "secure boot" except as making Open Source bootloaders hard or impossible to use and disallowing tweaking/analyzing manufacturers firmware aka. "locking the system down like a Playstation", and maybe make money on the side with "signing services".
Anyway, I found a writeup of the state of this approach from 2020 in "Communications of the ACM": "Securing the Boot Process: The hardware root of trust."

[MZZenyl]

The PowerShell script isn't even going to work, it incorrectly uses ".:" (which isn't valid PowerShell code), when it should be "::", the static accessor operator.

[Deniil]

private keys should be made by people who want to protect their devices against maid attacks, not by companies.
this is just absurd

[NinjaRunningWild]

“Secure” in modern computing just means “safe for now”.

[grimvian]

It's a bit funny to think of the computer, I started up with 40 years ago. The OS was in a ROM or EPROM and you had to replace the chip to change the OS. When rebooting NOTHING had changed, but now everything have to be updated all the time, but why do anything else than the OS need to have kernel access?

Companies should not have the keys, it's just a matter of time, before something is exposed.

[matteofalduto]

password must have been "asdf"

[TheKeirsunishi]

Wonder how many mobos will not receive a firmware update as they are considered "deprecated"

[tomschi]

*That's a stupid question: “how does this keep happening???” The answer is triaial: manufacturers can be grossly negligent in threatening customers and never have to take responsibility.* If it were otherwise, Dell, for example, would now be sued, e.g. with 10$ for each affected device. *I bet manufacturers would never define a standard router password 'admin/admin' again and they would take very simple measures to ensure that test keys would never be in productive systems again.* 🙂