Security: Difference between revisions

From coreboot
Jump to navigation Jump to search
Line 3: Line 3:


== Free software ==
== Free software ==
=== Coreboot ===
Note that while Coreboot itself is free software, many boards still use blobs. Some however don't require any. If so they are typically supported by [http://libreboot.org/ Libreboot], a coreboot distribution.
=== Security fixes ===
=== Security fixes ===
Fixes can take months before being available on non-free firwmares, if you are lucky enough to have them.
Fixes can take months before being available on non-free firwmares, if you are lucky enough to have them.
Line 10: Line 14:
* [https://review.coreboot.org/gitweb?p=coreboot.git;a=commit;h=ce2564ac519fd974eeaa070ccb30d5a12e0c3334 Fix for the memory sinkhole issue]
* [https://review.coreboot.org/gitweb?p=coreboot.git;a=commit;h=ce2564ac519fd974eeaa070ccb30d5a12e0c3334 Fix for the memory sinkhole issue]


Security fixes are usually mentioned in coreboot ChangeLog on the blog.
Security fixes are usually mentioned in Coreboot ChangeLog on the blog.
 
=== Coreboot ===
Note that while coreboot itself is free software, many boards still use blobs. Some however don't require any. Typically thoses that don't are supported by [http://libreboot.org/ Libreboot], a coreboot distribution.


=== Auditable code ===
=== Auditable code ===
Because the boot firmware is the first code that executes on the main CPU, it's an interesting [https://en.wikipedia.org/wiki/Rootkit#Firmware_and_hardware target for rootkits]:
Because the boot firmware is the first code that executes on the main CPU, it's an interesting [https://en.wikipedia.org/wiki/Rootkit#Firmware_and_hardware target for rootkits]:
* The code that runs first has to load what runs next, so it can patch it. That patch can then in turn patch what's next and so on.
* The code that runs first has to load what runs next, so it can patch it. That patch can then in turn patch what's next and so on.
* The code that runs first can setup SMM on X86 or TrustZone on some ARM SOCs. SMM/Trustzone are more powerful than ring0. On x86 devices, non-free boot firmwares have a tendency to put a lot of code to run in SMM. In contrast coreboot keep it to a minimum.
* The code that runs first can setup SMM on X86 or TrustZone on some ARM SOCs. SMM/Trust zone are more powerful than ring0. On x86 devices, non-free boot firmwares have a tendency to put a lot of code to run in SMM. In contrast Coreboot keep it to a minimum.
* Being stored in a flash chip, separately from the OS and its data, non-free boot firmware have a tendency not to be updated by the end user, nor reflashed externally. That permits a very high persistency.
* Being stored in a flash chip, separately from the OS and its data, non-free boot firmware have a tendency not to be updated by the end user, nor reflashed externally. That permits a very high persistence.


Given the above, being able to know what your boot firmware does is very important.
Given the above, being able to know what your boot firmware does is very important.
Line 28: Line 29:
However this isn't sufficient to verify that you are running the right binary:
However this isn't sufficient to verify that you are running the right binary:


Dumping the flash chip externally is strongly advised for that, since some chipsets makes it too easy for the SMM code to give back (to flashrom) a binary than differs from the one in the flash chip.
Dumping the flash chip externally is strongly advised for that, since some chipsets makes it too easy for the SMM code to give back (to Flashrom) a binary than differs from the one in the flash chip.


== Existing security features ==
== Existing security features ==

Revision as of 13:10, 14 June 2016

Introduction

This page explains how Coreboot can help with various security aspects of your system, compared to proprietary/closed-source boot firmware implementations(BIOS/EFI/UEFI). It doesn't however address issues such as the Intel Management Engine or AMD PSP.

Free software

Coreboot

Note that while Coreboot itself is free software, many boards still use blobs. Some however don't require any. If so they are typically supported by Libreboot, a coreboot distribution.

Security fixes

Fixes can take months before being available on non-free firwmares, if you are lucky enough to have them. With free software boot fimrwares, security issues can be fixed, and in coreboot many are.

Examples:

Security fixes are usually mentioned in Coreboot ChangeLog on the blog.

Auditable code

Because the boot firmware is the first code that executes on the main CPU, it's an interesting target for rootkits:

  • The code that runs first has to load what runs next, so it can patch it. That patch can then in turn patch what's next and so on.
  • The code that runs first can setup SMM on X86 or TrustZone on some ARM SOCs. SMM/Trust zone are more powerful than ring0. On x86 devices, non-free boot firmwares have a tendency to put a lot of code to run in SMM. In contrast Coreboot keep it to a minimum.
  • Being stored in a flash chip, separately from the OS and its data, non-free boot firmware have a tendency not to be updated by the end user, nor reflashed externally. That permits a very high persistence.

Given the above, being able to know what your boot firmware does is very important.

Reproducible builds

Coreboot has reproducible builds. That permits to verify that a given binary corresponds to a given source code.

However this isn't sufficient to verify that you are running the right binary:

Dumping the flash chip externally is strongly advised for that, since some chipsets makes it too easy for the SMM code to give back (to Flashrom) a binary than differs from the one in the flash chip.

Existing security features

Given that, with coreboot, the hardware initialization is separated from the boot logic, many security features only makes sense when implemented in payloads. Nevertheless, coreboot implement some security features.

Coreboot GRUB SeaBIOS Depthcharge Tianocore
Password verification No Yes No ?
Signature verification Yes Yes No<ref>This can be achieved by configuring SeaBIOS to only load an IPXE option rom, that in turn verifies signatures. Loading other option rom has also to be avoided. This is possible on some laptops for instance.</ref> Yes
Can open encrypted partition No Yes No No

Resisting to "external" attacks

If we, for now, start by assuming that coreboot and what resides in the boot flash is trusted, we then might still have other untrusted chips in the same device:

The Embedded controller

Some laptops, like the chromebooks, do have free software on the embedded controller. This is the way to go. However some laptops don't.

This chip usually handles:

  • The keyboard. This can be abused to do a keylogger.
  • Power switches to wifi/bluetooth/data-modem
  • On some thinkpads it controls a LED to illuminate the keyboard. This results in having a long wire that goes from the EC to that light. This can be abused as an antenna.

Since coreboot has to talk to such chip, input comming from such chip, such as its firmware revision should be considered as untrusted.

Storage medium firmwares

The following storage mediums typically use non-free firmwares:

If we assume that the hard disk firmware is potentially malicious, we then can workaround it by making sure that the code stored on that disk is not modified on the fly by the hard disk firmware.

To do that we can take advantage of the fact that we run code from the boot flash first, which doesn't have such issue.

Code signing and encryption can be used to do that, however care must be taken not to be vulnerable to TOCTU(Time of check, time of use) attacks.

Code signing

  • GRUB can check files signature
  • dm-verity implements integrity checking at the partition level, but that result in making it read-only.

Encryption

  • GRUB has support for opening encrypted partitions (and LVM).

DMA issues

DMA is often understood as a way to access the RAM independently of the CPU.<ref> https://en.wikipedia.org/wiki/Direct_memory_access </ref> However, DMA is, in a more broad context, just a way to do "memory to memory" transfers. That might not involve the main CPU RAM at all, like with SATA's DMA.

Bus capable of accessing the main CPU's RAM:

  • PCI
  • PCI Express

Bus not capable of accessing the main CPU RAM:

  • Serial port, Parallel port, USB

References for the current BIOS issues

RAM wiping

SMI issues

ATA issues

Firewire issues

TPM issues

Ideas

RAM wiping after each boot

This is not very useful: The most interesting time would be right before power-off, which could be implemented in SMM. Unfortunately a cautious attacker just pulls the plug.


To prevent reading data after a reboot, a payload could be adapted to clean out memory. Using applications that manage sensible data sensibly (ie. wipe after use) is still a better solution.

See also

References

<references>