you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 1 year ago (13 children)

If you have physical access you have full access anyway. Etc.

You know secure boot was specifically made to protect users for this exact use case. Any tampering of the system will prevent the system from booting.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 9 points 1 year ago (8 children)

    I get your pc, "tamper" it, then i install a fake bios that tells you all is well and that your tpm and secureboot and whatever else bullcrap they invent is still happy.

    See the problem?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 5 points 1 year ago (7 children)

    It won't boot though, because the keys to decrypt the system are stored in the TPM.

    Sure you could replace the whole OS, but that's going to be very obvious and won't allow you access to the data.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 9 points 1 year ago (5 children)

    If you have physical access you could go into the bios and turn off secure boot

  • source
  • parent
  • hideshow 5 child comments
  • [–] 5 points 1 year ago (2 children)

    If you enable Secure Boot you should also set a BIOS password for this very reason.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago (3 children)

    A person with physical access can tamper with the OS, then tamper with the signing keys. Most secure boot systems allow you to install keys.

    Secure boot can't detect a USB keylogger. Nothing can.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    The signature checks will immediately fail if ANY tampering has occurred.

    Adding a USB keylogger that has not been signed will cause a signature verification failure during boot.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    A USB keylogger is not detectable by the computer, not in firmware nor operating system. It passively sniffs the traffic between the USB keyboard and the computer, to be dumped out later.

  • source
  • parent
  • hideshow 1 child comment