Difference between revisions of "Security"
From coreboot
(Start a security page.) |
m (→Common security features) |
||
| (4 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
This page explains how coreboot can help with various security aspects of your system, compared to closed-source, legacy BIOS/EFI/firmware implementations. | This page explains how coreboot can help with various security aspects of your system, compared to closed-source, legacy BIOS/EFI/firmware implementations. | ||
| − | = | + | <div style="color:red">This page is work in progress!</div> |
| − | == | + | == Common security features == |
| − | + | * Boot password (like BIOS password) | |
| + | * RAM wiping after each boot | ||
| + | * Signature verification - option to boot from payload only signed images | ||
| + | * Support to encrypted block devices/volumes | ||
| − | + | [[Bayou]] / [[coreinfo]] have "BIOS password"-like feature, using SHA-1 hashes stored in NVRAM or the (flash) ROM chip. | |
| − | + | Coreboot can be full-secure solution for your hardware, without this issues, which have "legacy" BIOS: | |
| − | == Firewire issues == | + | == Current BIOS issues == |
| + | |||
| + | === RAM wiping === | ||
| + | |||
| + | * http://citp.princeton.edu/memory/ | ||
| + | * [[Coreinfo]] as demo payload for coreboot, [http://www.coreboot.org/images/3/3d/Coreinfo_ramdump.jpg showing your RAM contents after a cold boot]. | ||
| + | |||
| + | === SMI issues === | ||
| + | |||
| + | * http://www.ssi.gouv.fr/fr/sciences/fichiers/lti/cansecwest2006-duflot.pdf | ||
| + | * http://tracker.coreboot.org/trac/coreboot/ticket/42 | ||
| + | |||
| + | === ATA issues === | ||
| + | |||
| + | * http://coreboot.org/pipermail/coreboot/2005-May/011686.html | ||
| + | * http://www.heise.de/ct/english/05/08/172/ | ||
| + | |||
| + | === Firewire issues === | ||
| + | |||
| + | * http://md.hudora.de/presentations/firewire/ | ||
| + | * http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation | ||
| + | |||
| + | === TPM issues === | ||
| + | |||
| + | * http://tracker.coreboot.org/trac/coreboot/ticket/49 | ||
Latest revision as of 15:22, 15 May 2010
This page explains how coreboot can help with various security aspects of your system, compared to closed-source, legacy BIOS/EFI/firmware implementations.
This page is work in progress!
Contents |
[edit] Common security features
- Boot password (like BIOS password)
- RAM wiping after each boot
- Signature verification - option to boot from payload only signed images
- Support to encrypted block devices/volumes
Bayou / coreinfo have "BIOS password"-like feature, using SHA-1 hashes stored in NVRAM or the (flash) ROM chip.
Coreboot can be full-secure solution for your hardware, without this issues, which have "legacy" BIOS:
[edit] Current BIOS issues
[edit] RAM wiping
- http://citp.princeton.edu/memory/
- Coreinfo as demo payload for coreboot, showing your RAM contents after a cold boot.
[edit] SMI issues
- http://www.ssi.gouv.fr/fr/sciences/fichiers/lti/cansecwest2006-duflot.pdf
- http://tracker.coreboot.org/trac/coreboot/ticket/42
[edit] ATA issues
- http://coreboot.org/pipermail/coreboot/2005-May/011686.html
- http://www.heise.de/ct/english/05/08/172/
[edit] Firewire issues
- http://md.hudora.de/presentations/firewire/
- http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation
