[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <66402D07.6010804@gmail.com>
Date: Sat, 11 May 2024 21:44:23 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com
CC: Corey Lopez <Corey.lopez09160587@...mail.com>
Subject: Re: Microsoft Device Firmware Configuration Interface
(DFCI) in Linux efivars directory
Solar Designer wrote:
> Hi,
>
> Corey's message is confused and there's no indication in it whether the
> system was compromised, so that part doesn't need further discussion,
> but as a moderator I don't mind someone explaining Linux's (and other
> systems') exposure of the EFI variables and DFCI and what it means for
> security as well as what it does not.
>
While he is definitely somewhat confused, he claims at the start to have
detected a compromise, but does not give details about the indications
that led him to that conclusion.
As far as I can tell from a quick perusal, (landing at
<URL:https://microsoft.github.io/mu/dyn/mu_feature_dfci/DfciPkg/Docs/Scenarios/DfciScenarios/>)
it seems that DFCI "Zero Touch" is actually tightly bound to Microsoft
cloud services, and there is supposed to be a local option to remove the
zero touch certificate (thus disabling it more-or-less permanently) if
DFCI is not in use on the machine. The example implies that the UEFI
configuration tool ("BIOS setup") should provide this option.
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
